Access review audits fail on evidence, not just completion rates

At a glance

What this is: This is a guide to what auditors actually test in access review audits, with the key finding that completion rates alone do not prove control effectiveness.

Why it matters: It matters because IAM and IGA teams need evidence-quality controls, not just workflow completion, if they want access reviews to stand up in SOX, SOC 2, PCI DSS, and similar audits.

Context

Access review audits are not just about whether a review happened. They test whether the control was designed correctly, operated consistently, and produced evidence that an auditor can independently verify.

For IAM and IGA teams, that means the control is judged on proof, not intent. If revocations, scope, reviewer qualification, and retention cannot be demonstrated, a completed review can still fail audit testing.

The article also shows why this is a governance problem, not a tooling problem. A strong process can still collapse under weak evidence handling if audit trails are editable, incomplete, or impossible to reproduce.

Key questions

Q: What breaks when access review evidence cannot be independently verified?

A: The control loses audit credibility even if the review was completed on time. Auditors need evidence that revocations happened, scope was complete, and the underlying data was reliable. If proof is editable, incomplete, or retrospective, the review becomes an activity record rather than a defensible control outcome.

Q: Why do access reviews still fail even when completion rates are high?

A: High completion rates do not prove that the right identities, entitlements, or systems were reviewed. If discovery is incomplete, scoping is weak, or remediation never happens, the organisation has process compliance but not control effectiveness. The failure is usually structural, not motivational.

Q: What are the most common access review audit mistakes?

A: Teams often rely on tickets marked complete, store evidence in editable locations, skip validation of revocations, or fail to prove that the source access population was complete. Those mistakes weaken operating effectiveness even when the review process looks orderly on paper.

Q: How should organisations prepare access governance evidence for a midyear audit?

A: Organisations should start by inventorying who has access to what, why they have it, and whether the access still matches current job responsibilities. The strongest audit evidence comes from documented roles, access reviews, approval records, and logs that show access was granted, validated, and removed according to policy. An IGA process helps keep that evidence consistent and retrievable.

Technical breakdown

Control design versus operating effectiveness in access reviews

Auditors separate whether an access review should work from whether it actually worked. Control design asks if the review frequency, scope, reviewer qualification, and remediation timing are capable of addressing the risk. Operating effectiveness asks whether those steps happened in the tested period. A quarterly review for in-scope financial systems may be well designed, but if one cycle slipped into the next quarter, the control still fails on execution. That distinction is why completion metrics are not enough on their own.

Practical implication: Map each access review control to both design expectations and period-specific evidence of execution.

Why evidence hierarchy matters in audit testing

Auditors trust system-generated evidence most, because it is harder to alter after the fact. Audit logs, platform timestamps, and automated reports carry more weight than tickets, emails, or retrospective summaries. The article’s core lesson is that evidence quality is part of control quality. If the proof lives in editable documents or shared folders, the auditor will question whether the control can be independently validated. That is especially true when the audit test includes reperformance or recalculation.

Practical implication: Prefer immutable, system-generated artifacts for every access review and keep them tied to the exact control period.

Reperformance is the hard test most teams underestimate

Reperformance means the auditor tries to verify the outcome independently, not just inspect the paperwork. In access review audits, that can include testing whether revoked users can still authenticate or recalculating completion percentages from source records. This is why a completed Jira ticket is not equivalent to proven revocation. The control has to leave a trail that survives independent checking, otherwise the review becomes a record of activity rather than evidence of effectiveness.

Practical implication: Build validation testing into remediation so every revocation can be proven, not merely recorded.

NHI Mgmt Group analysis

Evidence quality is now part of the control, not a separate audit wrapper: access review programmes fail when they treat completion as the objective and evidence as an afterthought. The article shows that auditors evaluate whether the evidence itself can withstand independent testing, which means the governance model has to treat proof as a first-class control outcome. For IAM teams, that shifts the centre of gravity from workflow closure to verifiable control operation.

Completion metrics can mask broken control assurance: a 94% completion rate does not tell an auditor whether revoked access was actually removed, whether the source population was complete, or whether reviewers were qualified to certify access. That is why access review governance has to separate throughput from assurance. In practice, high completion with weak evidence is not maturity, it is fragility.

Auditability depends on evidence immutability and traceability: editable shared drives, retrospective summaries, and unverified extracts create a control story that looks complete but cannot be defended. The governance lesson is that audit readiness is built into the evidence chain long before the auditor arrives. Organisations that cannot trace source data, reviewer action, and remediation verification are running a documentation process, not a control process.

Access review programmes need a named evidence discipline: call it evidence-first governance. It is the discipline of designing reviews so system-generated proof, remediation validation, and retention are built into the process rather than stitched on afterward. That concept matters because auditors increasingly test the reliability of the record as much as the record of the review itself. Practitioners should manage evidence as a governed asset, not an administrative by-product.

This is a lifecycle issue as much as a compliance issue: access review evidence has its own lifecycle, from capture to retention to retrieval. When that lifecycle is weak, even good remediation can become non-defensible in audit. The practical consequence is that IAM, IGA, and compliance teams need to coordinate on the evidence chain the same way they coordinate on access itself.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: Access Reviews and Certification Guide

What this signals

Evidence-first governance: access review programmes now need controls that protect the proof as carefully as they protect the access decision. If the review trail can be edited, reconstructed, or partially lost, the control becomes difficult to defend even when the operational work was sound.

Auditability is becoming a lifecycle requirement, not a reporting exercise. IAM and IGA teams should treat source extracts, certification records, remediation validation, and retention as one governed chain rather than separate admin tasks.

For practitioners

• Build a validation step after every revocation Confirm that removed access can no longer authenticate or perform the risky action, and retain the validation result with the remediation record.
• Store evidence in system-generated form Use audit logs, timestamps, and platform reports as the primary record for each review cycle instead of editable summaries or shared-drive exports.
• Test reviewer qualification before certification Verify that reviewers understand the systems and access they are certifying, and retain training or qualification evidence where the framework expects it.
• Separate completion from control effectiveness Track whether the review finished, whether the scope was complete, and whether remediation was independently verified as distinct control outcomes.
• Retain review artifacts by audit period Keep source extracts, certification records, remediation tickets, and validation evidence in a package that can be retrieved quickly during inspection.

Key takeaways

• Access review audits fail when teams cannot prove that revocations, scope, and reviewer actions were real, even if the review itself was completed.
• The practical weakness is not usually the absence of a process, but the absence of immutable evidence that stands up to independent testing.
• Organisations need evidence-first access review governance, with validation and retention built into the control rather than added after the fact.

Key terms

• Control Effectiveness: The degree to which a control actually works in real operating conditions, not just on paper. Auditors assess whether the control is designed well, executed consistently, and supported by evidence that shows it reduced the intended risk.
• Operating Effectiveness: Operating effectiveness is the proof that a control works in real conditions, not just on paper. In DORA contexts, assessors look for logs, timestamps, approvals, and repeatable execution that show the control kept functioning over time.
• Evidence Hierarchy: The order auditors use to judge how reliable proof is. System-generated logs and timestamped records are stronger than manually written summaries because they are harder to alter and closer to the event itself. In identity governance, the hierarchy determines whether an access review can be trusted or merely described.
• Reperformance: An audit test where the reviewer independently repeats the control to see whether the result matches what the organisation claimed. In access review audits, reperformance can include attempting authentication after revocation or recalculating completion rates. It is one of the strongest checks because it proves the outcome, not the narration.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.