What breaks when organisations launch access reviews without full visibility?

They certify only the access they can see, which usually means the review excludes shadow IT, embedded apps, and non-SSO tools. That creates false confidence because the process looks complete while leaving a large part of the access estate untouched. The first control is discovery, not approval.

Why access reviews fail when the estate is only partially visible

Access reviews are only as complete as the inventory behind them. When shadow IT, embedded applications, local accounts, and non-SSO tools are missing from the review scope, the organisation is not actually reviewing “all access”, it is reviewing a visible subset. The practical result is not just an incomplete process, but a distorted control signal that can hide excess privilege and stale access.

That matters because certification is often treated as evidence of control effectiveness. If the underlying population is incomplete, the review can still appear successful while leaving material exposure untouched. IAM and IGA Basics is useful here because access reviews depend on discovery, entitlement context, and lifecycle governance before any certification decision can be trusted.

What partial visibility does to certification quality

Partial visibility breaks the logic of recertification. Reviewers tend to approve what appears on the list, which encourages rubber stamping and creates false confidence in the result. The organisation may conclude that access has been validated, when in reality it has only validated the subset that was federated, integrated, or already mapped to a known system.

This is especially damaging in environments with mixed identity sources. Access can be granted through embedded app roles, direct database permissions, vendor-managed tools, or legacy platforms that never land in the same governance workflow. Access Reviews and Certification Guide addresses the practical design problem, and Identity Visibility and Intelligence Platforms (IVIP) Guide is relevant because visibility and correlation are what turn scattered access signals into a reviewable estate.

One overlooked failure mode is that hidden systems often carry the riskiest access, not the least. Shadow tools and embedded apps are common places for long-lived credentials, overbroad permissions, and weak ownership. If those sources are outside the certification process, the review does not merely miss edge cases, it systematically excludes the parts of the estate most likely to drift.

How to make access reviews trustworthy again

The first control is discovery, not approval. Before launching a certification campaign, the organisation should be able to answer what systems exist, which identities can reach them, and which access paths are outside the main SSO or governance plane. That includes local accounts, service access, and application-specific entitlements that do not surface through the primary IAM stack.

Start with inventory quality, then build the review population from that inventory.
Separate “known and governed” access from “known but not governed yet” access.
Require owners for embedded apps and shadow systems before asking them to certify anything.
Escalate any access source that cannot be discovered, mapped, or reassigned to a business owner.

For broader lifecycle closure, NHI Lifecycle Management Guide and Joiner-Mover-Leaver (JML) Guide both reinforce the same operational point: the review is only credible when provisioning, movement, and removal are visible end to end. Where the estate includes machine or application access, Privileged Access Management Guide becomes relevant because privileged and standing access should be handled with stronger controls than a generic certification workflow.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	CM-8 — System Component Inventory	Access reviews depend on knowing the complete system and account population.
	AC-2 — Account Management	The question concerns governed access review and certification of account populations.
	IA-5 — Authenticator Management	Hidden systems often rely on unmanaged credentials that bypass review workflows.
Recommendation — Maintain a current inventory of systems and accounts before certifying access. Review and revoke access only after all account sources are identified and mapped. Track and rotate authenticators that sit outside normal access certification paths.
ISO/IEC 27001:2022	A.5.9 — Inventory of information and other associated assets	You need a complete asset inventory before access certification can be trusted.
	A.5.15 — Access control	The topic is about controlling and reviewing access across the full estate.
Recommendation — Inventory all systems and associated access paths before running certification. Apply access control consistently across governed and previously hidden systems.

Practitioner Guidance

What to prioritise: Validate the access inventory before launching a campaign. If the review input is incomplete, the output will be politically useful but operationally weak.

What to verify: Check whether the review population includes non-SSO applications, embedded permissions, service access, and locally managed accounts. If any of those classes are absent, treat the certification as partial by definition.

Common mistake: Using a clean completion report as proof of coverage. Completion only proves the workflow ran, not that the organisation had line of sight into the full access estate.

Practitioner takeaway: A good access review is a discovery exercise with approval attached, not an approval exercise pretending discovery already happened.