Access Control / Account Request
A one-page request for a system account or access rights: what, how much, why, for how long, who approves, a security acknowledgement and a block for IT to record what it did.
Free. Fill in, print, save as PDF or download as Word without an account. Saving to your account needs a free account.
Country versions
- International
- United States *
- Korea *
- Japan *
- Germany *
* check with local advice
A template, not advice.
Read more
What it is
An access request form is the paper trail behind a login. It records who asked for access to which system, what exactly they need, why, for how long, who approved it and who set it up. In a small business that trail is what lets you answer, months later, why a person still has access to the payroll folder. It is also the first thing a customer, an auditor or an insurer asks to see when you say that you control access.
The form leads you to ask for the least access that does the job: a named system, a level (read, edit, approve or administrator), the exact folders or functions, and an end date if the need is temporary. The days of temporary access are counted for you, and a review interval is recorded so that access does not quietly outlive its reason. A short security acknowledgement and a block for IT to note what was done close the loop. The form never asks for a password, and it grants nothing by itself: the system owner and IT decide what is set up. It is a general template, not legal or security advice.
When to use it
- A new starter, a contractor or an intern needs accounts.
- Someone changes role and needs different, or fewer, permissions.
- Temporary access is needed for cover, a project or an audit and should expire on a date.
- A leaver's access has to be removed and the removal recorded.
- A customer or auditor asks how access to their data is controlled.
How to fill it in
- Choose the type of request: new, change, extend temporary access or remove. For a change or removal enter the existing user name, never the password.
- Name the system and describe exactly which data, folders or functions you need. Pick the lowest access level that works.
- Say how sensitive the most sensitive data is that you will see, and write the reason in terms of a task, a role or a project.
- Choose permanent or temporary. For temporary access set the end date and check the days counted.
- Read the acknowledgements and tick them, or tick them on the printout.
- Have the line manager, and the system or data owner if that is someone else, approve and sign.
- Pass the form to IT. IT records the result, the date, the ticket and the next review. File it where the next review will find it.
Common mistakes
- Asking for "the same as a colleague" instead of what the job needs.
- Requesting administrator rights where edit rights would do.
- Leaving temporary access without an end date, so that it never ends.
- Writing the password on the form or sending it by email.
- Having the request approved by the requester or by someone with no authority over the system.
- Never reviewing access. It piles up when people change roles.
- Forgetting to remove access when someone leaves, and to record that it was removed.
Steps at a glance
- Fill in
- Check the preview
- Save as PDF, Word or Excel
Country versions
Pick the country you need. Each version uses the wording and layout commonly found there; a version marked “check with local advice” should be read by someone who knows the local rules before it is used.
- International (XX): Written in English, Korean, Japanese, German
- United States (US): Written in English – check with local advice
- Korea (KR): Written in Korean, English – check with local advice
- Japan (JP): Written in Japanese, English – check with local advice
- Germany (DE): Written in German, English – check with local advice
Designs
The same form in several designs. The fields and the wording stay the same; only the look changes.
- Boxed form
- Ledger
- Compact
- Banner
- Warm
- Plain (black and white)
- Modern
- Formal
- Side band
- Classic
- Minimal
- Executive
Your details fill it in
Fields that ask for your name, address or company details are filled from My details, so you do not type them again; you can still change any field for one form. Signed in, your details stay in your account; otherwise they stay in this browser only. A passport, identity or social security number is never saved.
Questions
- Does this form give me access?
- No. It records a request and an approval. The system owner and IT decide what is set up, and they may grant less than you asked for.
- How often should access be reviewed?
- It depends on the risk. Administrator access and access to sensitive data are often reviewed every three months, other access once a year. The form lets you pick every 3, 6 or 12 months; your own policy decides.
- Who should approve the request?
- The line manager confirms that the work needs the access. The owner of the system or data confirms that the access is appropriate. In a small firm they may be the same person, but never the requester.
- Can I use it when someone leaves?
- Yes. Choose "Remove access or account", name the systems, and let IT record the date it was done. That record is the proof that the access ended.
- Is this form enough for ISO 27001 or a SOC 2 audit?
- QuoteBill cannot say. A standard asks for a whole set of controls, and a signed request with a dated review is one piece of evidence among others. We make no claim of conformity; ask your auditor what they need to see.
- Is this form legal, tax or accounting advice?
- No. It is a template: it gives you the usual structure and wording, not advice. Rules differ by country and case, so have someone qualified read anything that matters before you sign, send or file it.
- Which countries and designs does it come in?
- It comes in 5 country versions: International, United States, Korea, Japan, and Germany. 12 designs.
A form is a template, not legal, tax or accounting advice. Rules differ by country and case.