Entity’s Senior Management or the Information Security Officer periodically reviews and approves the list of people that have access to audit logs