Are user access rights reviewed periodically?

Answer this one honestly, because it is the control most likely to exist on paper and not in the calendar. "Access is reviewed quarterly" appears in almost every access control standard. A quarterly review that last happened ten months ago is the single most common finding in a first SOC 2 audit, and a reviewer asking a follow-up will ask for the date of the last one.

If your reviews are real, name the cadence, name who performs them, and name the date of the most recent. If they are not yet real, the answer that works is the one that says what you actually do: "access is reviewed on a rolling basis as part of onboarding and offboarding; a formal quarterly review is being introduced from [quarter]". A reviewer can price that risk, and they cannot price a claim that turns out to be aspirational.

There is a more useful thing to understand about this question, though: periodic review is not the control the reviewer is worried about. What worries them is the person who left the company in March and whose GitHub access is still live in September. A quarterly review would find that up to three months late. What actually addresses it is offboarding, and the strongest answer to this question mentions both: the periodic review as the backstop, and same-day revocation on departure as the primary control.

The other place these answers narrow too far is scope. Reviewing the identity provider is not reviewing access, because the things that are not behind it are exactly the risky ones: direct database credentials, the cloud provider root account, the third-party SaaS somebody bought on a company card, shared credentials in a password manager vault. A review that covers the identity provider and says so is honest. A review that covers the identity provider and is described as covering access is not.