TL;DR: Repeated access reviews do not reduce segregation of duties risk when the same conflicts return quarter after quarter; SafePaaS argues the real gap is risk closure, not review frequency. The broader lesson is that governance must prevent conflicts before provisioning, route exceptions to owners, and track remediation so risk actually changes over time.
At a glance
What this is: This is an analysis of why access reviews often fail to reduce segregation of duties risk, concluding that governance has to close risk rather than merely document it.
Why it matters: It matters because IAM, IGA, PAM and compliance teams need governance that changes exposure, not just governance that produces completed certifications.
Context
Access governance is supposed to decide whether effective access is appropriate, but many programmes still stop at recording reviewer approval. When the same segregation of duties conflicts keep returning, the problem is not visibility alone. It is that the control has not changed the underlying risk state.
In practical terms, that means organisations need to govern human and non-human identities through the same decision layer when access affects financial, operational, or administrative processes. Review cadence matters, but prevention, remediation ownership, and evidence of closure matter more than the number of certification cycles completed.
Key questions
Q: What breaks when access reviews keep finding the same SoD conflicts?
A: The control breaks when certification becomes a record-keeping exercise instead of a decision that changes access. Repeated conflicts mean the programme is not closing risk through removal, mitigation, or prevention. In practice, the same toxic entitlement combinations keep surviving across cycles because nothing forces remediation before the next review.
Q: When should organisations prioritise preventive access checks over more review cycles?
A: Organisations should prioritise preventive checks when repeated findings show that review cadence is not reducing exposure. If the same conflicts return every quarter, adding another certification cycle only repeats the same workflow. Preventive controls matter most when access affects sensitive business processes and risky grants can be blocked before they become standing entitlement.
Q: How can teams tell whether access governance is actually working?
A: Look for short revocation times, low rates of stale entitlements, and repeatable access review outcomes across systems. If accounts remain active after role changes or offboarding, governance is not effective. Good measurement focuses on whether access is removed when it stops being justified.
Q: How should security teams govern human and non-human access in the same programme?
A: They should use one governance model for ownership, approval, review, and revocation, but apply it differently by actor type. Human identities rely on joiner-mover-leaver processes, while NHIs need secrets, certificates, and token lifecycle controls. AI agents add runtime behaviour that must also be monitored. The goal is consistent oversight, not identical workflows for every identity type.
Technical breakdown
Why repeated access reviews do not close SoD risk
A recurring access review is not the same thing as a closed control. The review can be completed procedurally even when the same conflicting entitlements remain in place, because the workflow only asks whether access looks acceptable at a point in time. Without policy checks before provisioning and automated follow-up after approval, the organisation is only re-acknowledging exposure. Segregation of duties analysis has to evaluate role combinations, sensitive privileges, and business context before access is granted, otherwise the conflict simply survives into the next cycle.
Practical implication: Treat recurring SoD findings as a control-design failure, not a reviewer performance issue.
How policy-based access governance changes the decision point
Policy-based access governance moves the control upstream. Instead of waiting for a quarterly certification to catch bad access, the system checks proposed access against SoD and sensitive-access rules at request time, then routes exceptions with the supporting business context. That changes governance from a snapshot to a decision process. The important architectural shift is that approval, mitigation, and rejection are recorded against the policy that triggered them, so access decisions remain tied to a durable rationale rather than a reviewer’s memory of a role name.
Practical implication: Evaluate requests against business rules before provisioning so conflicts never become standing access.
Why remediation and time-to-remediation matter more than review volume
Risk falls when a conflict is removed, mitigated, prevented, or formally accepted by the right owner. Simply flagging an issue is not a governance outcome, because the exposure remains live until something changes. Time-to-remediation is therefore a better indicator than the raw count of conflicts found. It shows whether the programme is shrinking risk or merely collecting backlog. For identity governance, especially where access influences record-to-report, procure-to-pay, payroll, treasury, and other material processes, closure is the control objective.
Practical implication: Measure how long exceptions stay open and require every finding to end in closure, mitigation, or documented acceptance.
Threat narrative
Attacker objective: The objective is to preserve toxic access long enough for a conflicted identity to act inside sensitive business processes without being corrected by governance.
- Entry occurs when inappropriate access is granted through role assignment, local administration, or another provisioning path without a policy check at request time.
- Credential or privilege abuse follows when the access remains active across repeated review cycles and no workflow forces removal, mitigation, or formal acceptance.
- Impact is sustained because the same entitlement conflict continues to exist in the business process, leaving financial and operational controls exposed.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Access review completion is not risk closure: A certification programme can look healthy while the underlying entitlement conflict never changes. That is because review activity measures completion, not whether the risk state has actually been reduced. The distinction matters most in ERP and other material applications where the same toxic combinations reappear after every cycle. Practitioners should treat repeated findings as evidence that governance is acknowledging risk instead of closing it.
Automated access governance is a decision layer, not a reporting layer: The article’s core point is that effective governance sits between request and provisioning, not after the fact. It needs entitlement context, business context, and policy logic to decide whether access should exist at all. That reframes the problem from certification throughput to control enforcement across the identity lifecycle.
Time-to-remediation is the more honest control metric: Counting conflicts found can make a programme look active while the backlog grows. Measuring how quickly a finding moves to removal, mitigation, prevention, or formal acceptance tells you whether governance is actually shrinking exposure. For practitioners, the operational question is no longer how many reviews were completed, but how quickly risk was closed.
Human and non-human identities need the same closure discipline: The article’s mention of non-human identities is important because service accounts, integrations, bots, and AI agents can create the same access-governance burden as people when they carry risky privileges. The governance model should not assume a human reviewer is the only accountable subject. Identity type changes the workflow, but not the need for closed-loop control.
Risk closure depends on ownership, not volume: A large volume of reviews, flags, or exceptions does not improve control maturity unless each item has an accountable owner and a final state. That is the real gap this article exposes. IAM and IGA teams should focus on whether governance decisions survive into remediation evidence, because only then does access governance change enterprise risk.
What this signals
Risk closure, not review volume, is the real governance objective: Access certification only proves that someone looked at the entitlement. It does not prove the entitlement was removed, mitigated, or justified in a way that changed enterprise exposure. Teams that keep seeing the same conflicts need to re-centre governance on closed-loop remediation rather than periodic sign-off.
Closed-loop governance is the named concept that matters here: Access decisions should not stop at detection. The control needs a tracked path from request to approval, exception ownership, remediation, and final disposition, otherwise compliance activity can increase while the actual risk remains unchanged. That is true across ERP, SaaS, and other materially governed applications.
For practitioners
- Define closure states for every access exception Require every SoD or sensitive-access finding to end in prevent, remove, mitigate, or formally accept, with a named owner and due date.
- Push conflict checks into request time Evaluate proposed entitlements against SoD and sensitive-access rules before access is provisioned, not only during certification.
- Expose entitlement-level context to reviewers Show the effective privileges beneath role names, plus the business entity, process, and geography that make the access risky.
- Track time-to-remediation for repeat findings Measure how long conflicts remain open by severity, application, owner, and remediation route so backlog is visible as risk, not output.
- Extend governance to non-human identities Include service accounts, integrations, bots, and AI agents in access ownership and exception handling so they cannot sit outside closure workflows.
Key takeaways
- Repeated access review findings usually indicate a governance closure problem, not a lack of certification activity.
- The meaningful measure is whether risky access is prevented, removed, mitigated, or formally accepted by the right owner.
- IAM teams should judge access governance by time-to-remediation and repeat findings, because those metrics show whether risk is actually moving.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CSA Cloud Controls Matrix, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | The article is about governing access decisions, certification, and remediation across enterprise identities. |
| Recommendation — Apply IAM domain controls to make access decisions policy-driven and closed-loop. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post centres on whether entitlements are appropriate and actually changed by governance. |
| Recommendation — Use PR.AA-05 to ensure access permissions are reviewed, justified, and reduced when inappropriate. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article focuses on account lifecycle, entitlement review, and exception remediation. |
| Recommendation — Apply CIS-5 to maintain account ownership, review access, and remove unneeded privileges. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Repeated SoD conflicts show that least privilege is not being enforced through access governance. |
| Recommendation — Use AC-6 to restrict entitlements to the minimum required and remove conflicting privileges. | ||
| MITRE ATT&CK | TA0006 — Credential Access | Persistent risky access can be abused to reach sensitive systems and business processes. |
| Recommendation — Map standing privileged access to TA0006 and hunt for accounts that retain conflict-bearing entitlements. | ||
Key terms
- Access Governance: Access governance is the policy and workflow layer that manages how access is requested, approved, certified, and revoked. In SaaS environments it helps standardise control across many applications, reducing inconsistency between teams. It is most effective when it covers both human accounts and non-human identities.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
- Time to Remediation: The elapsed time between discovering a material access risk and reducing it through prevention, removal, mitigation, or formal acceptance. It is a stronger governance signal than the number of findings because it shows whether the programme is actually shrinking exposure.
- Mitigating control: A mitigating control is a compensating safeguard used when risky access cannot be eliminated. It may be a reconciliation, approval workflow, detective report, or exception review. In practice, the control is only meaningful if a team can prove it executed for the relevant users and period.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 15, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org