Because a completed review is not the same as a well-informed decision. If the reviewer lacks entitlement context, ownership, and business purpose, the certification becomes a routing task instead of a control. That produces audit evidence without materially improving whether access is still appropriate.
Why disconnected reviews become governance theater
Disconnected access reviews fail when the person certifying access cannot see the context that makes the decision meaningful. A reviewer who does not know the entitlement’s owner, the business process, the system criticality, or whether the access is still needed can only confirm that a row was approved. That creates the appearance of governance without a reliable decision behind it.
The practical problem is not the review event itself, but the loss of judgment quality. If entitlement context is split across tools, teams, or spreadsheets, the review devolves into a queue-clearing exercise, especially when reviewers are asked to validate hundreds of items they do not use themselves. The result is weak recertification, stale access that survives, and no clear accountability for why the entitlement remained.
Access reviews work best when the evidence needed to decide is already attached to the item being reviewed: owner, application, business purpose, risk level, last use, and whether the access is role-based or exception-based. When that context is missing, the reviewer is forced to infer, and inference is a poor substitute for governance.
What “disconnected” usually means in practice
Disconnected reviews are usually a signal that the review workflow is not tied closely enough to identity lifecycle, role design, or entitlement ownership. That can happen when certifications are run from a separate governance tool that lacks current entitlement metadata, when application owners are not mapped correctly, or when the review is triggered on a calendar instead of by a meaningful change such as role change, inactivity, or elevation.
This is why effective review design is not just about cadence. It depends on the surrounding control plane, including who can answer questions about the access, who can revoke it, and whether the review can feed directly into remediation. NHIMG’s Access Reviews and Certification Guide is useful here because it frames reviews as a decision process, not a paperwork step, and ties them to closed-loop remediation.
In mature programs, the review is one checkpoint inside a larger governance flow. That flow should already know whether access was granted through a role, an exception, a joiner-mover-leaver event, or an emergency path. If the reviewer has to reconstruct that story manually, the control is operating too far from the source of truth.
How to reduce the governance gap without overcomplicating the control
The most effective improvement is to connect the review to the metadata that answers the reviewer’s basic questions before the item is certified. That usually means consistent ownership, entitlement naming, last-access evidence where appropriate, and a clear distinction between birthright access, standing privilege, and exception access. Where the control covers service identities or automated actors as well as people, the review must also reflect that broader population.
NHIMG’s IAM and IGA Basics is a strong companion reference because it separates access governance from mere access administration. For practitioners, that distinction matters: a certification process that cannot reach accurate entitlement data is not really governing access, only recording an opinion about it.
When the problem is overprivilege or role drift, a review alone is rarely enough. Pair the review with role cleanup, entitlement ownership, and a rapid revoke path for clearly unjustified access. NHIMG’s Role Mining and Role Design Guide supports that model by showing how cleaner role structures reduce review noise and make decisions easier to defend.
Risk and Threat Considerations
Disconnected reviews create residual access risk because they can generate audit artifacts while leaving excessive or obsolete access in place. Over time, that weakens the organisation’s ability to demonstrate least privilege, timely revocation, and accountable ownership. It also makes it easier for dormant or overprivileged access to persist unnoticed across systems.
Failure mechanism: The review asks a human to certify access without giving that human the control evidence needed to distinguish legitimate access from inherited, stale, or excessive access. The workflow then records completion even when the underlying entitlement decision was low quality.
Impact: The organisation may pass an audit step but still carry the same privilege exposure, which increases the chance of inappropriate access, delayed revocation, and failed assurance over governance effectiveness.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Disconnected reviews affect account and entitlement lifecycle decisions. |
| AC-6 — Least Privilege | The question centers on whether access remains appropriate and excessive access persists. | |
| AU-6 — Audit Review, Analysis, and Reporting | Governance risk rises when review evidence exists without meaningful analysis or action. | |
| Recommendation — Tie certification outcomes to timely removal or adjustment of unnecessary access. Use review outcomes to reduce access to the minimum necessary for each role or task. Correlate review findings with remediation evidence to confirm the control changed access. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Disconnected certifications weaken the governance of who should have access. |
| Recommendation — Ensure access review evidence is tied to current owner, purpose, and approval records. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | The issue is failure to manage and validate access rather than simple review completion. |
| Recommendation — Review and remove unnecessary access using authoritative entitlement data. | ||
Practitioner Guidance
What to prioritise: Put entitlement owner, business purpose, and current access history on the same screen as the certification action. If a reviewer has to leave the workflow to find those details, the control is already degrading.
What to verify: Check that the review can drive actual remediation, not just disposition. A good test is whether a denied entitlement is revoked quickly, with a visible record of who acted and when.
Common mistake: Treating review completion rates as the success metric. High completion with low decision quality is governance theater, not control effectiveness.
Practitioner takeaway: The value of an access review is determined less by how often it runs than by how much decision context it brings to the reviewer, because context is what turns certification into control.
Related resources from NHI Mgmt Group
- When do NHI access reviews create more value than a one-time cleanup?
- When does JIT access create more risk than it reduces?
- Why do manual access reviews create more governance risk in environments with many applications and reviewers?
- Why do disconnected access requests and provisioning workflows create governance risk?