Deloitte interview question

How you would proceed with user access review?