Chief among these are that access rights should be reviewed in conjunction with business managers at some regular interval (quarterly or monthly, depending on your risk disposition), anytime someone undergoes a significant role transfer within a firm, and most importantly when someone leaves a firm.