A common mistake is looking only at high-level access approvals and missing whether privileges were actually fulfilled, changed, or revoked in the operational systems. Auditors also miss service accounts and bot access when they focus too narrowly on employee identities. Effective review compares request logs, fulfillment records, and termination events to confirm that access governance works end to end.
What auditors typically overlook in access and provisioning reviews
Audits often stay at the request-and-approval layer and stop before testing whether access was actually provisioned, changed, or removed in production systems. That gap matters because the control objective is end-to-end governance, not paperwork. In practice, the review should tie approvals to fulfillment logs, termination events, and the live state of privileged and non-human accounts, including service accounts and bots.
When this control is judged properly, the question is not only whether a manager signed off. It is whether the granted entitlement matches the approved scope, whether it was implemented in the correct system, and whether removal occurred on time after role change or departure. That is why lifecycle evidence and technical evidence have to be reviewed together, not as separate audit topics.
- Request records show intent.
- Provisioning records show what was actually created or changed.
- Termination and deprovisioning records show whether access was removed.
- System state confirms whether the control worked after the process ended.
One useful way to think about the review is that approvals are necessary but not sufficient. A clean approval trail can still coexist with orphaned access, excessive privilege, stale entitlements, or accounts that remain active after the business reason has expired. The strongest audit evidence therefore comes from reconciling people, systems, and timestamps across the full access lifecycle.
Why service accounts, bots, and other non-human access are commonly missed
Auditors frequently focus on employee identities because those are easy to recognise in HR-driven workflows, but many of the most dangerous access paths are not human at all. Service accounts, automation users, API-linked identities, and bots often sit outside normal joiner-mover-leaver checks, which means they can escape review even when their privileges are broader or more persistent than those of staff accounts. NHIMG research shows this gap is still common, with only 5.7% of organisations reporting full visibility into their service accounts.
This is where access review becomes a population question, not just an employee question. If the audit scope excludes non-human access, the result can look compliant while the environment still contains dormant credentials, overbroad permissions, and accounts that no one can clearly own. The practical issue is not the label on the account, it is whether it can still authenticate, still act, and still reach sensitive systems.
- Confirm that service accounts are inventoried and assigned owners.
- Check whether bot and integration accounts are subject to the same approval and revocation logic as user accounts.
- Verify that privileged non-human access is time-bounded, reviewed, and rotated where appropriate.
- Test for accounts that persist after applications are retired, moved, or repurposed.
Auditors also miss the difference between a credential existing and a credential being governed. A service account can be documented in a policy file and still be exposed in code, CI/CD tooling, or an unmanaged secret store. That is why review quality depends on tracing the control into the systems where the identity actually operates.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Lifecycle and Ownership | Access review failures often stem from missing ownership and offboarding for service identities. |
| NHI-03 — Secrets and Credential Management | Provisioning controls fail when credentials outlive approvals or remain active after termination. | |
| NHI-05 — Visibility and Discovery | Auditors miss access when non-human accounts are not fully inventoried across systems. | |
| Recommendation — Assign every non-human account an owner and enforce lifecycle review before approval closes. Rotate or revoke credentials when provisioning or deprovisioning changes the access state. Discover and inventory service accounts, bots, keys and tokens before relying on review results. | ||
| CIS Controls v8 | 5 — Account Management | This question centers on whether accounts are actually provisioned, changed and removed correctly. |
| 6 — Access Control Management | The review is about whether permissions match approved business need and are removed on time. | |
| 8 — Audit Log Management | Auditors need request, fulfillment and revocation logs to prove the control worked end to end. | |
| Recommendation — Reconcile account creation, modification and removal with approved requests and termination events. Limit access to approved need and verify that revocation occurs when need ends. Collect and retain approval, provisioning and revocation logs for audit reconciliation. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication and Access Control | The issue is whether identities and access states are governed across their lifecycle. |
| GV.RM — Risk Management Strategy | Incomplete access review creates residual privilege and governance risk that must be managed. | |
| Recommendation — Validate that identity lifecycle records match current access in production systems. Set review coverage to include technical provisioning and non-human access paths. | ||
| NIST Zero Trust (SP 800-207) | AC-4 — Policy Enforcement of Access Decisions | Provisioning controls should enforce actual access decisions, not just document them. |
| Recommendation — Enforce access decisions in the target system and verify the resulting state. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Orphaned or overprivileged accounts are a common abuse path when provisioning reviews are weak. |
| Recommendation — Hunt for stale or excessive valid accounts that remain usable after supposed deprovisioning. | ||
Practitioner Guidance
What to verify: Reconcile three evidence sets for the same sample population: approved access requests, fulfilled provisioning changes, and revocation or termination events. If any one of those is missing, the control may be procedural rather than effective.
Common mistake: Treating employee recertification as a complete access review. That approach misses shared accounts, service identities, bot credentials, and long-lived entitlements that often create the largest residual exposure.
What good looks like: The reviewer can show that every meaningful entitlement has an owner, a business justification, a current system instance, and a documented removal path when the justification ends.
Practitioner takeaway: The audit question is not “Was access approved?” but “Did the right identity get the right access, in the right system, for the right period, and was it actually removed when that period ended?”
Related resources from NHI Mgmt Group
- What do organisations get wrong when they treat physical access badges and digital authentication as separate controls?
- When should organizations review access controls?
- What do IAM teams get wrong when they focus only on faster access provisioning?
- What do security teams get wrong about client-level access controls in shared service environments?
