Periodic review can confirm yesterday’s state, but lifecycle control changes access when identity events happen. Joiner, mover, and leaver processing removes lag between employment status and effective privilege, which is essential when the same identity spans directories, apps, and delegated ownership.
Why lifecycle control beats point-in-time review
Access review answers a snapshot question: who had access when the review ran. Lifecycle control answers a state-change question: who should have access right now, based on a joiner, mover, or leaver event. That distinction matters because privilege drift is usually created by delay, not by the annual review itself.
When an identity changes role, manager, location, vendor status, or employment status, the control that changes access at the event boundary reduces exposure immediately. Review still has value, but it is a backstop. If you rely on review alone, the organisation keeps carrying stale entitlements until the next cycle.
The difference is especially important when one identity can reach multiple directories, SaaS apps, shared admin paths, and delegated ownership chains. In that environment, a single missed offboarding step can preserve more access than a reviewer would expect from one record in one system.
Where review-only models fail operationally
Review-only models fail because they depend on human detection of a condition that already exists. By the time a reviewer sees the entitlement, the person may have moved teams, lost the business need, or left entirely. The access is technically visible, but the decision is late.
Lifecycle control closes that gap by tying entitlement changes to authoritative events. Joiner processing grants the minimum required access, mover processing removes outdated access and adds the new set, and leaver processing revokes access and related credentials or tokens. That creates a cleaner control boundary than asking managers to rediscover the same mismatch weeks later.
For practitioners, the key operational point is that review quality also depends on lifecycle quality. A weak joiner-mover-leaver process produces bloated review lists, false confidence, and more manual exceptions. A strong lifecycle process makes the review smaller, cleaner, and more meaningful. Joiner-Mover-Leaver (JML) Guide is useful here because it treats the event-driven control plane as the primary mechanism, not an administrative afterthought.
What good lifecycle control looks like in practice
Good lifecycle control starts with an authoritative source for status change, then enforces access decisions automatically or semi-automatically across connected systems. It should know who owns the identity, what entitlements are attached, which credentials or tokens need rotation, and which systems are still waiting for deprovisioning.
It also needs exception handling. Some access should be time-bound, some should be approved with a business justification, and some should be escalated when removal would break a critical service. The point is not zero friction. The point is that access reflects current need rather than historical accumulation.
Where organisations mature this well, access review becomes a verification layer, not the primary correction mechanism. That is why lifecycle ownership, entitlement cleanup, and periodic certification work best together. IAM and IGA Basics provides the broader control model, while Access Reviews and Certification Guide helps teams close the loop when a review still uncovers stale access.
Risk and Threat Considerations
Review-only governance leaves a window where former employees, movers, or service owners retain valid access after the business need has ended. That creates unnecessary exposure, especially when credentials, API tokens, or delegated admin rights can be reused before the next certification cycle.
Failure mechanism: Access persists because the control depends on a scheduled human review instead of an immediate identity event, so stale privileges survive role changes and offboarding delays.
Impact: The organisation carries avoidable privilege creep, higher blast radius, and a longer period in which compromised or obsolete access can be abused.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Lifecycle control governs credential issuance, rotation, and revocation. |
| AC-2 — Account Management | Joiner-mover-leaver processing is account lifecycle control. | |
| AC-6 — Least Privilege | Lifecycle control reduces standing excess access more effectively than review alone. | |
| Recommendation — Automate credential rotation and revocation when identity events occur. Link account changes to authoritative joiner, mover, and leaver events. Remove obsolete access as soon as need changes. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Lifecycle control ensures access rights are granted, changed, and removed on time. |
| A.5.16 — Identity management | Identity lifecycle governs how identities are created, changed, and removed. | |
| Recommendation — Review and update access rights at every lifecycle event. Maintain authoritative identity records and sync access changes from them. | ||
Practitioner Guidance
What to prioritise: Tie joiner, mover, and leaver triggers to the systems that actually grant access, not just to the HR record. If the source event does not reach directories, SaaS apps, and delegated owners quickly, the lifecycle control is only partial.
What to verify: Check whether movers lose obsolete access as reliably as leavers do. Many programmes handle offboarding better than role change, even though mover drift often creates the longest-lived excess access.
What good looks like: Reviews should find edge cases, not routine stale access. If each quarterly certification keeps discovering the same obvious old entitlements, the real defect is lifecycle automation, not reviewer diligence.
Practitioner takeaway: Use access review to confirm the control environment, but use lifecycle control to keep the environment current. If access changes lag the business event, the organisation is governing yesterday’s state.
Related resources from NHI Mgmt Group
- Why do lifecycle workflows matter for access control?
- When should organisations move from periodic review to runtime access control?
- Why does periodic access review matter when organisations operate under industry or legislative obligations?
- What is the difference between role-based access control and a periodic user access review?