When is Access Control report refreshed?

Summary

After making a user security change (added an existing user to a new entity group), access control report does not reflect change.

Content

We had to add a user to a new entity security group to grant him access to the entity. Refreshed database after change.

I ran an access control report for the user, hoping to confirm that he now has access to the new entity but the change was not captured on the report.

I ran the report again after 24 hrs in case there was a lag & still the report did not capture the new entity change.