Systems automatically generate access reports to support periodic reviews
Pulling access listings directly from identity provider exports and per-application reports means the review checks what access exists, not what someone remembers granting.
Generating access listings from system exports depends on the same identity data A.8.15's logs capture, but serves periodic review rather than event logging.
Generating access listings for periodic review depends on identity data rather than the real-time behavioral monitoring A.8.16 is primarily about.