People change roles, and access can accumulate without anybody noticing. A review needs to understand which tasks each role still performs.
What would you ask the contractor to document before changing permissions? Would you approve a proposed access list first and test a few ordinary workflows afterwards?
.
