Active User Access Review

I am doing interviews to establish a workflow for our User Access Review and working on determining where everything lives at the moment. Does anyone else do a review like this? and if so what do you look at other than testing the users access to systems and making sure that they have the correct permissions for their role. 

Thank you for your help.