Allmond recommends that GLS develop written policies and procedures for the annual monitoring of all user accounts. For user accounts relating to service organization systems, GLS should proactively generate or request a listing of user accounts, if one is not already provided by the service organization, and perform a review of the current system users and their permissions. The reviews should be documented and evidence of the review for each system should be retained according to the Agency’s document retention policy.