Access review controls fail when process replaces governance

At a glance

What this is: This resource hub argues that access reviews fail when organisations treat them as a compliance process instead of an actual control system.

Why it matters: It matters because IAM, NHI, and human access governance all break in the same place when review cadence, scope, and remediation do not translate into effective control.

By the numbers:

• Most organizations discover 60-80 apps they didn't even know existed during this phase.
• 120 days annually equals $144,000 in IT costs doing manual work instead of building systems.
• The article notes that manual processes consume 596 hours annually and leave 18% of revocations unexecuted.

👉 Read Zluri's access review resource hub for practical maturity guidance

Context

Access reviews are supposed to answer a simple governance question: who has access to what, and is that access still justified. In practice, many organisations turn the activity into spreadsheet choreography, where the evidence looks complete but the control outcome stays weak. That gap matters across human IAM, service accounts, and broader identity lifecycle programmes because a review that does not change access is not a control.

Zluri frames the problem as a maturity issue, but the deeper issue is structural. Teams often optimise for audit completion while missing scope, remediation, and verification. For practitioners, that means the same failure mode shows up whether the identity is human, non-human, or privileged: access drifts, exceptions persist, and the review process becomes theatre rather than governance.

Key questions

Q: What breaks when access reviews are treated as a compliance exercise instead of a control?

A: The main failure is that teams can complete the review without changing access. That leaves stale entitlements, inherited permissions, and unresolved exceptions in place while creating a false audit trail. A control is only effective when it changes the access state or reliably detects and corrects risk.

Q: Why do access reviews still fail even when completion rates are high?

A: High completion rates do not prove that the right identities, entitlements, or systems were reviewed. If discovery is incomplete, scoping is weak, or remediation never happens, the organisation has process compliance but not control effectiveness. The failure is usually structural, not motivational.

Q: How can security teams know whether access reviews are actually working?

A: Look for evidence that reviews reduce standing access, close remediation tickets, and remove inherited or stale entitlements inside the target systems. If the same findings recur every quarter, the programme is producing paperwork, not governance. Effective reviews leave the environment measurably cleaner after each cycle.

Q: Who should own remediation after an access review finds an issue?

A: Ownership should be explicit before the review starts. Security may coordinate, managers may attest, and app owners may approve, but someone must be accountable for executing the change and proving that it took effect. Without clear ownership, review findings become permanent exceptions.

Technical breakdown

Why access review processes are not controls

A process is the sequence of steps a team follows. A control is the mechanism that prevents, detects, or corrects failure. Access reviews often collapse these ideas into one another, which is why high completion rates can coexist with unresolved access risk. If reviewers cannot reliably scope entitlements, identify stale access, or prove that revocations happened, then the review is only documentation. The control has not actually constrained access, and the organisation is relying on human diligence instead of enforceable governance.

Practical implication: map each review stage to a control outcome, not just a task list.

Why scope and discovery are the real failure points in access review

Discovery determines whether the review is looking at the right population. In large estates, the hard problem is not running the review, but finding all the applications, identities, group memberships, and delegated paths that matter. If app discovery misses systems, or if group-based entitlements sit outside the review boundary, the organisation gets a clean attestation over incomplete data. That is how access review programmes pass on paper while leaving unexamined privilege behind.

Practical implication: validate discovery coverage before each attestation cycle and test for hidden entitlement paths.

How remediation turns access review from evidence into governance

A review only becomes a control when decisions lead to timely change in access state. The common failure is remediation lag, where reviewers mark items for revocation but the actual entitlement remains active. That creates a split between policy intent and operational reality. For IAM and lifecycle teams, this is the point where access review intersects with offboarding, privileged access, and identity hygiene. Without enforced follow-through, the review is a reporting exercise, not a risk-reduction mechanism.

Practical implication: tie review decisions to enforced remediation workflows and verify the resulting access state.

NHI Mgmt Group analysis

Access review is only a control when it changes entitlement state. Completion metrics can look healthy while stale access, group inheritance, and unresolved exceptions continue to expose the environment. That is why review governance must be judged by revoked, corrected, or constrained access, not by the number of reviewers who clicked approve. Practitioners should treat attestation as evidence of action, not the action itself.

The real governance gap is hidden access scope. Organisations frequently review named users while missing the access paths that matter most, including group-based entitlements and delegated administration. The result is a clean-looking process over an incomplete object model. That gap shows up across human IAM and NHI governance alike, because both fail when discovery does not match the true access graph.

Privilege review cadence should follow risk, not calendar habit. The article’s staged maturity model points to a broader truth: review frequency only matters when it reflects how quickly access can become dangerous. Privileged and high-change access deserve tighter oversight than low-risk read-only accounts. Practitioners should stop treating quarterly review as the default answer and align cadence to the actual blast radius of the identity type.

Delegating access reviews without control design just distributes failure. Manager review, app-owner review, and security-led review all break if the underlying data is incomplete or remediation is not enforced. Distributed responsibility is useful only when the organisation defines who owns discovery, who owns decisioning, and who owns execution. Practitioners should build a governance model that makes each role accountable for a different control outcome.

Identity review theatre: the dangerous pattern here is a programme that proves activity instead of control. That is the phrase practitioners should remember when access review completion is celebrated despite repeated findings. The implication is straightforward: if the review does not reduce residual access, it is not mature governance, whatever the audit dashboard says.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to the 2024 ESG Report: Managing Non-Human Identities.
• Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
• The governance question now extends beyond human access reviews, so practitioners should also study the NHI Lifecycle Management Guide for provisioning, rotation, and offboarding control.

What this signals

Access review theatre is becoming an enterprise-wide risk pattern. Teams that measure success by completion alone will keep missing the hidden paths that matter: inherited access, shadow applications, and delayed revocation. The practical shift is to make discovery coverage and remediation closure part of the operating model, not an after-action report.

Identity governance will keep converging across human, NHI, and privileged access. Once organisations accept that the same control failure appears across those identity types, they can stop treating access reviews as a human-only exercise. That is why the next maturity step is not more attestations, but tighter lifecycle linkage between review, revocation, and entitlement proof.

Hidden entitlement paths are the new review blind spot. When SSO groups, delegated admin, and app inheritance sit outside the review boundary, the programme certifies the wrong object. Practitioners should prepare for broader discovery requirements and stronger evidence standards, especially in estates where access is federated across multiple identity systems.

For practitioners

• Separate process from control ownership Document which step creates evidence, which step makes a decision, and which step actually changes access. If those responsibilities blur together, completion metrics will continue to mask control failure.
• Rebuild discovery before expanding review scope Inventory applications, SSO groups, delegated admin paths, and shadow access paths before the next certification cycle. A review that misses 60-80 apps is not comprehensive, no matter how well the spreadsheet looks.
• Enforce remediation verification Require proof that a revoked entitlement is no longer effective in the target system, not just evidence that someone marked it for removal. This matters most where access is inherited through groups or automated provisioning.
• Use risk-based review cadence Reserve the shortest review cycles for privileged, high-change, and high-blast-radius access, and lengthen cadence only where the access model is genuinely stable. Calendar-driven uniformity is a weak proxy for governance.
• Test for hidden access paths Include inherited permissions, multi-IDP mappings, and group-based assignments in every audit sample so the review boundary matches the real entitlement graph. If the review cannot see the path, it cannot govern it.

Key takeaways

• Access reviews fail when organisations optimise for completion instead of entitlement change.
• Discovery gaps, inherited access, and unverified remediation explain why review programmes keep producing the same findings.
• Practitioners should align review cadence, scope, and execution proof to actual risk, not calendar habit.

Key terms

• Access Review Control: A control that verifies whether access is still appropriate and removes or flags access that is no longer justified. In practice, it must change entitlement state, not just collect attestations or generate audit evidence, or it remains a process artifact rather than governance.
• Access Certification: A formal attestation process in which reviewers confirm whether users or accounts should retain access. It becomes meaningful only when the organisation can prove that decisions were executed, especially where access is inherited through groups, delegated administration, or automated provisioning paths.
• Remediation Verification: The proof that an approved revoke or correction actually took effect in the target system. This matters because a closed ticket or completed spreadsheet does not guarantee that access disappeared, particularly in federated environments with multiple identity providers and inherited permissions.
• Discovery Coverage: The portion of real applications, accounts, groups, and entitlement paths that a review programme can see and include. Poor discovery coverage creates false confidence because the organisation certifies only the identities it already knows about, while hidden access remains outside governance.

What's in the full article

Zluri's full resource hub covers the operational detail this post intentionally leaves for the source:

• Step-by-step access review maturity guidance for teams moving from ad-hoc checks to scaled governance.
• Specific process templates for periodic, continuous, and risk-based access review programmes.
• Detailed implementation advice for access certification, recertification, and remediation workflows.
• Practical coverage of review delegation, reporting, and audit readiness across different programme stages.

👉 The full Zluri hub breaks down access review stages, audit readiness, and scaling patterns in detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.