An internal auditor is concerned with privilege creep that is associated with transfers inside the company. Which mitigation measure would detect and correct this?

User rights reviews are a detective and corrective control that periodically audit all user accounts and permissions, identifying access that was granted for previous roles but never revoked. This directly addresses privilege creep by comparing current permissions against current job requirements. Reviews can then trigger removal of excess privileges, bringing users back into compliance with least privilege principles.

Least privilege and job rotation are preventive controls that reduce the chance of privilege creep occurring, but they do not detect or correct accumulated excess permissions after the fact.

Change management governs how changes are requested and approved in an environment but does not specifically audit or remediate existing user permission assignments.

Change control is a subset of change management focused on controlling modifications to systems, not on reviewing or correcting user access rights.