What are the signs that access recertification is not working well?

Common warning signs include heavy spreadsheet use, long review cycles, poor visibility into system access, and dependence on large manual effort every audit period. If teams can only see access after pulling data together by hand, they are likely missing interim changes. Another signal is when audit findings keep repeating because monitoring between audits is weak or absent.

Why Recertification Breaks Down in Real Organisations

access recertification is only useful when reviewers can see current entitlements, understand business context, and act before access drifts further. When the process relies on spreadsheets, stale exports, or manual chasing, it stops being a control and becomes a periodic paperwork exercise. That creates a false sense of assurance because the review may be complete on paper while risk continues to accumulate between cycles.

For teams managing service accounts, API keys, and other machine access, the problem is often sharper than in human access reviews. NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts, which helps explain why recurring reviews often miss what actually changed. Current guidance suggests that recertification should be tied to inventory accuracy, ownership clarity, and timely revocation, not just approval completion. For broader control design, the OWASP Non-Human Identity Top 10 is useful because it frames the access-lifecycle weaknesses that recertification is supposed to catch.

In practice, many security teams discover recertification is failing only after access has already drifted beyond what the review process can reliably explain.

How Access Review Failure Shows Up Operationally

The strongest sign is not simply that reviews are slow, but that the organisation cannot produce a trustworthy answer to a basic question: who still has access, why do they have it, and who approved it last time? When that answer requires multiple teams, ad hoc exports, and manual reconciliation, the recertification process is compensating for weak identity data rather than enforcing governance.

Another common failure mode is reviewer fatigue. If managers or system owners are approving long lists without context, they tend to accept entries they do not recognise, especially when the access model lacks clear ownership, usage evidence, or expiration dates. That is why repeat exceptions and unchanged review outcomes matter. A healthy process should surface removals, role corrections, and ownership disputes. If every cycle ends with nearly identical results, the review is probably rubber-stamping instead of reassessing.

For machine access, the same problem appears when teams cannot separate active, dormant, and orphaned access. Reviews that do not connect to rotation, revocation, or system telemetry usually miss interim changes such as newly created tokens, reused secrets, or permissions expanded for a temporary task. That is one reason broader identity-control frameworks such as NIST controls for access review and account management remain relevant, even when the immediate issue is process quality rather than a single technical flaw.

In practice, recertification breaks down when the control is detached from authoritative identity data, because reviewers are then judging access snapshots instead of continuously governed entitlements.

Common Failure Patterns and What They Mean

Tighter recertification often increases administrative overhead, so organisations have to balance review depth against the cost of keeping the data current. The tradeoff is real: a process that is too lightweight may miss risk, while a process that is too heavy becomes unscalable and invites shortcuts.

If every cycle requires extensive spreadsheet cleanup, the underlying access inventory is probably not authoritative enough for governance use.
If reviewers approve access they cannot explain, the review workflow lacks role context, asset ownership, or usage evidence.
If findings repeat across audit periods, the issue is usually not reviewer behaviour alone but weak remediation follow-through between cycles.
If revocations are consistently delayed, the process is failing as a lifecycle control, not just as a reporting control.

In mature environments, recertification is not judged by how many attestations are collected but by whether it changes access decisions, removes stale privileges, and exposes ownership gaps quickly enough to matter. A useful external reference point is the NIST SP 800-53 Rev 5 Security and Privacy Controls, which maps well to periodic review, account management, and continuous oversight expectations.

Risk and Threat Considerations

When recertification is weak, the material risk is lingering access that no one can confidently justify or remove. That creates a governance gap for both human and non-human identities, and it is especially dangerous where privileged or long-lived access accumulates over time. The consequence is not just audit failure; it is expanded exposure surface and delayed detection of privilege drift.

Failure mechanism: stale entitlements persist because review data is incomplete, reviewers lack context, or remediation is not enforced after the certification closes. Attackers and opportunistic insiders can then exploit excess standing access, while dormant credentials and orphaned accounts remain available long after they should have been removed.

Impact: unauthorised access becomes harder to spot, separation of duties weakens, and incidents become more difficult to investigate because the organisation cannot reliably prove why access still exists. In environments with machine identities, the same weakness can leave API keys, service accounts, or tokens active well beyond their intended purpose.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	6 — Access Control Management	Recertification failure reflects weak account review and access governance.
Recommendation — Automate periodic access reviews and promptly remove unnecessary accounts and privileges.
NIST CSF 2.0	PR.AA — Identity Management, Authentication, and Access Control	Poor recertification signals breakdowns in access governance and entitlement assurance.
	DE.CM — Continuous Monitoring	Repeat findings and interim changes show monitoring gaps between review cycles.
	GV.RM — Risk Management Strategy	Recertification quality is a governance issue affecting exposure acceptance and remediation priority.
Recommendation — Maintain authoritative access inventories and review entitlements on a recurring basis. Track entitlement drift continuously so access changes are visible before the next review. Set risk-based review thresholds and escalate unresolved access exceptions quickly.
OWASP Non-Human Identity Top 10	NHI-01 — Inventory and Ownership	Weak recertification often means machine identities lack clear inventory and accountable owners.
Recommendation — Inventory all non-human identities with named owners before starting certification.

Practitioner Guidance

What to verify: Confirm that every certification list is generated from an authoritative source, not a manually assembled export. If reviewers cannot trace an entitlement back to an owner, system, and approval history, the control is already too weak to trust.

Decision rule: Treat repeated approvals, large unexplained exceptions, and slow revocation as evidence that the process is measuring compliance activity rather than access risk. If the review does not change access outcomes, redesign the workflow before expanding it.

What practitioners underestimate: The biggest failure is often not missing a few accounts, but normalising review noise until nobody expects the process to remove anything meaningful. That is when recertification stops being a governance control and becomes audit theatre.

Practitioner takeaway: A good recertification process should steadily reduce ambiguity, stale access, and unresolved ownership, not merely produce signed-off reports on schedule.