Yes, because access decisions change when role changes, department moves, and real usage are visible in the same workflow. Without those signals, reviewers cannot separate current need from stale entitlement, which weakens least privilege governance across the programme.
Why combine access reviews with HR signals and usage telemetry?
Access reviews become more accurate when reviewers can see both formal workforce changes and how access is actually used. HR signals explain why entitlement ownership may have changed, while telemetry shows whether the access is active, rare, or dormant. That combination reduces rubber-stamping and helps reviewers focus on entitlements that no longer match current work.
When a mover event, role change, or department transfer is visible in the same workflow, the reviewer can judge whether an entitlement still fits the person’s current job rather than only the historical grant reason. Usage data adds the operational reality check: an entitlement that has not been used for months is a different case from one used regularly for a legitimate business function.
A practical model is to treat HR changes as the trigger for reassessment and usage telemetry as the evidence layer for deciding keep, reduce, or revoke. That does not replace manager or app-owner judgment, but it gives them better context and less manual lookup across separate systems.
Where the workflow breaks down if signals are separated
Separating review, HR, and telemetry creates stale decisions. Reviewers end up certifying access based on old titles, incomplete manager memory, or static entitlement names, which makes least privilege harder to sustain over time. The result is slower remediation, more access creep, and weaker evidence that a recertification was based on current need.
It also creates an operational blind spot for orphaned or over-retained access. If a user has changed teams but the review system still sees the original grant context, unnecessary access can survive multiple review cycles. If telemetry is absent, rarely used access can look harmless even when it is no longer justified by the role.
For a governance programme, the main failure is not just incorrect approvals. It is the accumulation of many small, plausible approvals that are individually defensible but collectively inconsistent with least privilege.
How to design a review process that uses all three signals
Good design starts with joining the signals at the entitlement level, not in separate reports. The review item should show the current owner, the HR event history, and a concise usage summary so the reviewer can make one decision with enough context. That is especially useful for role changes, temporary assignments, contractors, and elevated access that should not remain static.
For access review programmes that also govern machine or application accounts, the same logic applies to service ownership and usage patterns. NHIMG’s IAM and IGA Basics is a useful foundation for understanding why entitlement governance works better when lifecycle and review are tied together. Where the review process also needs structured recertification patterns, the Access Reviews and Certification Guide is directly relevant. If your environment has significant non-human accounts, NHI Lifecycle Management Guide helps connect review outcomes to provisioning, rotation, and offboarding.
The most useful workflow rule is simple: if HR shows a mover or leaver event, the reviewer should not rely on the pre-change access picture; if telemetry shows no business use, the reviewer should not treat “possible need” as enough to keep the entitlement. That combination makes the review evidence-based rather than title-based.
Risk and Threat Considerations
When access reviews ignore HR context or usage evidence, organisations tend to preserve entitlements long after the original business need has passed. That increases privilege creep, makes entitlement ownership ambiguous, and raises the chance that dormant access can later be abused without attracting attention.
Failure mechanism: A stale role, outdated manager relationship, or misleading entitlement description causes reviewers to certify access that no longer matches the person’s current function, while missing inactive access that looks legitimate on paper.
Impact: Excess access persists across review cycles, least privilege degrades, and the organisation has weaker evidence that high-risk entitlements were actually assessed against current employment and real use.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Access reviews, HR signals, and telemetry support account and entitlement governance. |
| Recommendation — Link review evidence to account ownership and remove stale access promptly. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | The question is about reviewing, updating, and revoking access as workforce context changes. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Usage telemetry is used as evidence during access review decisions. | |
| Recommendation — Review account status and disable or adjust access when job context changes. Correlate usage logs with entitlement reviews to validate actual access need. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Combining HR changes and telemetry strengthens periodic access rights review and revocation. |
| A.8.15 — Logging | Usage telemetry provides operational evidence for entitlement decisions. | |
| Recommendation — Reassess access rights when role or employment status changes. Retain and review logs that show whether access is actively used. | ||
Practitioner Guidance
What to verify: Make sure each review item shows the current HR state, the entitlement owner, and a plain-language usage summary. If any one of those is missing, the reviewer is guessing rather than certifying.
Decision rule: If the HR signal indicates a mover, leaver, or temporary assignment end, require a fresh review decision rather than allowing a prior approval to carry forward. If telemetry shows no use over a meaningful period, treat retention as an exception that needs justification.
Common mistake: Teams often use telemetry only as an after-the-fact audit aid. It is more valuable when it shapes the reviewer’s decision at the moment access is being recertified.
Practitioner takeaway: The strongest programme design is not “more review,” it is better review context, so reviewers can remove stale access without forcing every entitlement into the same approval pattern.
Related resources from NHI Mgmt Group
- How should security teams run access reviews for non-human identities?
- When do NHI access reviews create more value than a one-time cleanup?
- What breaks when organisations rely only on access reviews and ignore telemetry data?
- How should security teams govern non-human identities that have persistent access?