Yes, there’s a database and people who audit access, ensure that permissions are periodically reviewed (i.e. just because you needed access 5 years ago doesn’t mean your current duties still require the same access), and other events can trigger reviews (e.g. a large amount of personal debt could make someone a greater risk).