Watch this video on YouTube
What should an IS auditor review to determine user permissions granted for a specific resource?