Due to privilege creep, a contractor's actual access scope often exceeds the initially approved scope, so the checklist should include a step to regularly compare request forms with the actual permissions in the IAM system.