What it asks for. Access rights to information and assets should be granted, reviewed, changed and removed in line with the organisation's access control policy and rules. This covers the full lifecycle, not only the initial request.
In practice. Every request is approved by the asset or system owner, provisioned according to the least privilege and need to know principles, and recorded. Access is reviewed at regular intervals, more often for privileged and high risk systems, and changes after a move or exit are made promptly. Many organisations automate this through an identity governance tool fed by the HR system. An auditor will sample joiners, movers and leavers and ask for approval records and completed access review reports with the actions taken.
Common gaps. Reviews are often rubber-stamped by managers who approve everything shown to them. Service accounts, local application accounts and SaaS tools outside single sign-on are frequently left out of the review scope entirely.