What breaks when identity governance relies on spreadsheets and email approvals?

Access decisions lose traceability, version control, and reliable ownership. Spreadsheets can document entitlement data, but they cannot enforce review timing, prove revocation, or keep pace with cross-system change. The result is stale access, slow remediation, and weak audit evidence across the identity lifecycle.

Why This Matters for Security Teams

When identity governance lives in spreadsheets and email threads, the process becomes advisory instead of enforceable. Review dates slip, approvers change, and entitlement records diverge from what is actually active in the target systems. That gap matters because auditors and incident responders need evidence that access was reviewed, approved, and removed on time, not just recorded somewhere after the fact. NIST’s Cybersecurity Framework 2.0 emphasizes repeatable governance outcomes, which manual tracking struggles to provide at scale.

NHIMG research on Ultimate Guide to NHIs — Regulatory and Audit Perspectives shows why lifecycle evidence matters: identity controls must support continuous review, revocation, and traceability across environments. Spreadsheet-driven governance can document intent, but it cannot reliably prove that access changed everywhere it should have. In practice, many security teams discover the failure only after an access review, audit request, or breach investigation exposes mismatched ownership and stale permissions.

How It Works in Practice

Manual governance usually starts with a spreadsheet listing identities, owners, entitlements, and review dates, then routes approvals through email. That works only when the environment is small, stable, and slow-moving. As soon as identities span cloud platforms, SaaS tools, CI/CD systems, and machine workloads, the record becomes a snapshot rather than a control. A spreadsheet can say who should have access; it cannot enforce revocation, reconcile drift, or prove that an approval still matches current risk.

Practitioners increasingly replace this with workflow-backed identity governance, policy-as-code, and system-integrated review evidence. The operational pattern is simple:

• Use a source of truth for identity ownership and entitlement metadata.
• Trigger reviews on schedule or by event, not by calendar reminders in inboxes.
• Connect approvals to the actual provisioning and deprovisioning systems.
• Log reviewer, decision, timestamp, and resulting change in an immutable record.
• Reconcile active access against the authoritative record to detect drift.

That model aligns with NHIMG guidance in the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs, where lifecycle control is the point, not the spreadsheet itself. It also reflects the lessons in Top 10 NHI Issues, especially the recurring problem of stale access after business or technical change. These controls tend to break down when approvals are separated from enforcement because the final step never reaches the live system.

Common Variations and Edge Cases

Tighter governance often increases process overhead, so organisations must balance speed against control depth. That tradeoff is real in environments with low risk and few entitlements, where lightweight tracking may be sufficient for a short period. Best practice is evolving, but current guidance suggests manual approvals should be transitional, not the operating model for high-change or high-impact access.

Edge cases appear when access is temporary, delegated, or cross-functional. Email approvals often fail to capture whether the reviewer had current authority, whether the request matched the person’s actual role, or whether the approval expired before use. This is especially problematic for non-human identities, where ownership changes, credentials rotate, and service accounts outlive the people who created them. NHIMG’s 52 NHI Breaches Analysis shows how often weak lifecycle visibility becomes an operational weakness.

One useful benchmark comes from NHIMG’s The State of Secrets in AppSec: leaked secrets can take weeks to remediate, which illustrates why delay compounds risk. The same principle applies to access reviews. If governance depends on inbox archaeology and spreadsheet reconciliation, it will lag behind the system of record and leave stale access in place long enough to matter. The model is weakest where identities are numerous, approvals are informal, and revocation must happen across more than one platform.

Related resources from NHI Mgmt Group

• Why is it important to integrate identity and data governance?
• Why do air-gapped deployments create identity governance risk?
• What makes agentic AI an NHI governance issue?
• What is the difference between attack surface management and NHI governance?