Access reviews are one of the most widely required and least loved identity controls. Auditors expect them, regulations reference them, and yet reviewers frequently approve everything because they have hundreds of items, no context and a deadline. The result is a signed-off record that changes nothing. This guide explains how to design access reviews (also called access certifications or recertifications) that actually remove unnecessary access, for people, service accounts, OAuth apps and AI agents.
Key takeaways
- The purpose of an access review is to remove access that is no longer needed. Measure success by revocations and risk reduced, not completion rates.
- Rubber-stamping is the main failure mode. Reduce volume, add context and focus reviewers on risky items.
- Use risk-based and event-driven reviews alongside periodic campaigns: review when people move, when access is unused or when privilege is high.
- Include non-human identities: service accounts, API keys, OAuth grants and AI agents are often never reviewed at all.
- Close the loop: revocations must actually be carried out and verified.
Why reviews are required
Access reviews support least privilege and are expected by many frameworks and regulations, including SOX controls over financial systems, PCI DSS, ISO/IEC 27001 access control requirements, HIPAA, DORA and NIS2. The frequency and scope vary, so confirm your specific obligations. See the Identity Security Regulatory Map.
Types of review
| Type | Reviewer | When to use |
|---|---|---|
| Manager review | Line manager reviews their reports' access | Broad coverage; managers know roles but not systems |
| Application or resource owner review | Owner reviews who has access to their system | Sensitive applications and data |
| Privileged access review | Security or system owners | Admin rights, production access; more frequently |
| Role and entitlement definition review | Role owners | Checking roles still contain the right permissions |
| Non-human identity review | NHI or application owner | Service accounts, API keys, OAuth apps, AI agents |
| Event-driven (micro) review | Manager or owner | Triggered by role change, dormancy, anomaly or risk |
Why reviews fail
- Volume: reviewers face hundreds of line items at once.
- No context: entitlement names such as "GRP_FIN_RW_03" mean nothing to a manager.
- No usage data: reviewers cannot see whether access is used.
- Wrong reviewer: managers asked to judge technical entitlements they do not understand.
- No consequences: approving everything has no cost; revoking risks complaints.
- No follow-through: revocations are logged but not executed in target systems.
Designing effective reviews
Reduce volume
- Exclude birthright access granted automatically by role and reviewed at the role level.
- Automatically revoke clearly unnecessary access (for example, unused for 90 days) with owner notification, instead of asking reviewers.
- Split large campaigns into smaller, more frequent reviews.
Add context
- Show human-readable entitlement descriptions, risk level and data sensitivity.
- Show last used date and how access was granted (role, request, exception).
- Highlight outliers: access that peers in the same role do not have.
- Flag segregation of duties conflicts. See the Segregation of Duties Guide.
Focus on risk
- Review privileged and sensitive access more often (for example, quarterly) and low-risk access less often.
- Trigger reviews on movers, long-term leave, contractor extensions and dormant access. See the Joiner-Mover-Leaver Guide.
Make decisions accountable
- Require justification for approving high-risk access.
- Detect rubber-stamping, such as approving hundreds of items in seconds, and escalate.
- Report revocation rates by reviewer and department.
Close the loop
- Execute revocations automatically through provisioning connectors, or through tracked tickets with deadlines.
- Verify removal in the target system.
Reviewing non-human identities
NHIs rarely appear in review campaigns because they have no manager. Include them by:
- Assigning owners first. See the NHI Ownership and Accountability Guide.
- Asking owners to confirm each NHI is still needed, its permissions are appropriate, and its credentials are current and stored correctly.
- Showing permissions granted versus used, credential age and last activity.
- Including OAuth apps and integrations, with scopes and vendors. See the SaaS and OAuth App Governance Guide.
- Including AI agents, with their tools, data access and autonomy level. See the Agentic AI Identity Guide.
Metrics
- Percentage of access revoked per campaign, and for privileged access.
- Time from revocation decision to verified removal.
- Rubber-stamp indicators (average time per decision, approve-all rates).
- Coverage: percentage of applications, privileged accounts and NHIs included in reviews.
Practitioner checklist
- Define review scope, frequency and reviewers by risk.
- Reduce volume through birthright exclusions and automatic removal of unused access.
- Provide context: descriptions, usage, peer comparison, risk and SoD conflicts.
- Add event-driven reviews for movers, dormancy and anomalies.
- Include service accounts, API keys, OAuth apps and AI agents with named owners.
- Automate and verify revocations.
- Measure outcomes, not just completion.
Standards and references
- ISO/IEC 27001:2022 (access control and review of access rights)
- PCI DSS v4.0.1 (Requirement 7 and 8 access review requirements)
- NIST SP 800-53 Rev. 5 (AC-2 Account Management)
- OWASP Non-Human Identities Top 10 (2025)
Related NHI Mgmt Group resources: IAM and IGA Basics · IGA Buyer's Guide · NHI Lifecycle Management Guide · Role Mining and Role Design Guide
