TL;DR: Manual quarterly access reviews leave ERP, cloud, and ITSM environments exposed to audit findings, insider fraud, and segregation-of-duties failures, according to SafePaaS. Continuous, evidence-based identity governance is now the practical baseline because reactive certification cycles cannot keep pace with modern entitlement sprawl.
At a glance
What this is: This article argues that user access review is shifting from periodic compliance checking to continuous identity governance because manual review cycles miss audit findings, fraud risk, and segregation-of-duties violations.
Why it matters: IAM, IGA, and PAM teams should treat access review as an always-on control layer, because entitlement sprawl and privileged access anomalies outpace spreadsheet-based certification models.
By the numbers:
- Nearly 75% of access-related audit findings stem from poor visibility and manual review processes.
Context
Continuous user access review is the practice of checking who has access, what they can do, and whether that access still makes sense as business conditions change. In this article, the governance gap is that quarterly certification treats access as static even when ERP, cloud, and ITSM entitlements change continuously.
The core identity governance problem is not only compliance reporting. It is the operational failure to keep pace with privilege misuse, toxic access combinations, and segregation-of-duties conflicts across distributed enterprise systems. That makes review quality, evidence quality, and remediation speed the real control questions.
Key questions
Q: What breaks when access reviews are treated as a quarterly checkbox?
A: Quarterly reviews assume access remains stable long enough to be meaningfully assessed later. That assumption fails when users, service accounts, or agents only need access for a short task window. The result is stale entitlement approval, weak evidence quality, and a false sense of governance because the review happens after the risk has already moved on.
Q: Why do poor access reviews lead to SoD violations and fraud risk?
A: Poor reviews miss toxic combinations that only become visible when entitlements are analysed together across systems. That lets one user accumulate conflicting capabilities, such as creating and approving the same transaction. The result is not just a policy issue. It is a practical opening for fraud, error, and audit findings.
Q: How can IAM teams tell whether access governance is actually working?
A: Look for complete discovery coverage, low revocation latency, and certification results that match actual entitlement inventories. If reviews keep finding unknown apps, abandoned accounts, or recurring exceptions, the process is generating activity but not control.
Q: Should privileged access reviews be handled separately from standard user access reviews?
A: They should be governed differently because privileged accounts carry higher blast radius and tighter accountability requirements. Standard access review can focus on broad entitlement validity, while privileged review must also verify business justification, dormant account status, and deprovisioning evidence. Combining them without extra scrutiny hides the riskiest access.
Technical breakdown
Why quarterly access certification fails in modern enterprises
Quarterly certification assumes access can be reviewed after it has been granted and before material harm occurs. In practice, entitlement sprawl across ERP, cloud, and ITSM systems creates a moving target, especially when users accumulate indirect access through role changes, application integrations, and inherited permissions. Manual spreadsheets and email-based sign-offs do not provide durable evidence, consistent decision logic, or timely remediation. The control fails when visibility lags behind actual access state, and auditors only see the gap after the fact. Continuous review changes the operating model from retrospective checking to policy-driven governance tied to current entitlement data.
Practical implication: replace periodic sampling with continuous entitlement visibility and exception handling.
How segregation-of-duties conflicts become an operational control failure
Segregation of duties works only when a single user cannot assemble conflicting privileges across systems or workflows. The article points to toxic access combinations and over-provisioned users as recurring problems because manual review does not reliably catch cross-application conflicts. In complex ERP environments, SoD is often violated through combinations that look harmless in isolation but become risky in aggregate. That is why governance has to evaluate entitlements contextually, not as disconnected approvals. Continuous analysis of access combinations turns SoD from an after-the-fact audit test into a live control condition.
Practical implication: evaluate SoD across applications and roles, not one entitlement at a time.
Why privileged access needs continuous governance, not periodic certification
Privileged accounts create the highest control risk because a single dormant or over-scoped profile can bypass ordinary business restrictions. When access reviews are periodic, high-risk accounts may remain active long after the business reason for access has changed. The article's emphasis on integration with privileged access management reflects a broader governance truth: privileged access is not just a monitoring problem, it is a lifecycle and accountability problem. Evidence must show who approved access, why it still exists, and how exceptions are remediated before they compound into audit exposure.
Practical implication: tie privileged access review to lifecycle events and approval evidence, not audit season.
Threat narrative
Attacker objective: The objective is to misuse excessive access for fraud, unauthorized activity, or control evasion before governance catches up.
- Entry occurs when users receive excessive or inherited access through manual provisioning, role drift, or weak approval workflows.
- Credential or privilege abuse follows when over-provisioned entitlements enable toxic access combinations, insider fraud, or unauthorized changes.
- Impact appears as audit findings, segregation-of-duties violations, and financial or operational losses that are discovered too late for prevention.
Breaches seen in the wild
- Secrets in VS Code extensions 2025: Wiz found 550+ secrets in VS Code extensions, including publishing tokens able to push malicious updates to about 150,000 installs.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Continuous access review is no longer a compliance adjunct. It is the control layer that decides whether identity governance is preventive or merely documentary. When access state changes continuously but review happens quarterly, the governance model is already behind reality. The implication is that identity programmes must measure control freshness, not just certification completion.
Entitlement visibility is the prerequisite for access governance. The article's emphasis on poor visibility and manual review shows that most review failures are data failures before they are process failures. If entitlement truth is fragmented across ERP, cloud, and ITSM systems, reviewers are certifying stale information. Practitioners should treat access inventory quality as a governance control, not an IT housekeeping task.
Privilege risk is now a lifecycle problem across human and machine identities. The article explicitly says every identity, human or machine, must be governed from provisioning to deprovisioning. That broadens access review from a human certification exercise into lifecycle governance for service accounts, automated workflows, and privileged users alike. The practitioner conclusion is that governance must follow the identity subject, not the system boundary.
SoD enforcement is becoming an always-on analytical problem. In complex enterprise stacks, toxic combinations emerge from cross-system entitlements that manual review rarely detects in time. A continuous model turns SoD from a periodic audit checklist into a live control condition with evidence, routing, and remediation. The implication is that SoD programmes need analytical monitoring, not just policy statements.
Identity governance now sits at the centre of operational resilience. The article frames access control as a business protection issue, not only a compliance obligation. That is the right direction: if access review cannot keep pace with entitlement drift, the organisation inherits fraud exposure, audit exposure, and weak accountability simultaneously. Practitioners should treat governance maturity as a resilience metric.
From our research library:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
What this signals
Continuous access review is becoming the default governance model. Quarterly certification made sense when entitlements changed slowly and visibility was centralised. In distributed ERP, cloud, and ITSM environments, the review control has to move closer to issuance, change, and deprovisioning events.
Access inventory quality is now a governance dependency. If organisations cannot assemble a current view of who can do what across systems, then every recertification cycle is partly an exercise in delayed discovery. That shifts IGA from a periodic compliance function into a continuous control service.
Privileged access and ordinary user access can no longer be separated operationally. Both depend on the same entitlement truth, the same evidence trail, and the same remediation path when access drifts from business need. The programme question is no longer whether to review access, but when the review becomes stale.
For practitioners
- Replace quarterly certification with continuous review Move high-risk applications, privileged roles, and sensitive SoD combinations into an always-on review workflow that re-evaluates access when entitlements change, not only at audit intervals.
- Build a single entitlement source of truth Aggregate access data from ERP, cloud, ITSM, and privileged access systems so reviewers are certifying current entitlements instead of spreadsheet snapshots.
- Prioritise toxic access detection Flag combinations that create segregation-of-duties conflicts, especially where one user can approve, create, and release sensitive transactions across systems.
- Tie privileged access to lifecycle events Require approval evidence, review triggers, and deprovisioning checks for dormant or high-risk privileged accounts so access does not outlive business need.
Key takeaways
- Manual access reviews create a delay between entitlement drift and governance action, which is exactly when audit findings, fraud risk, and SoD failures accumulate.
- The article cites nearly 75% of access-related audit findings as stemming from poor visibility and manual review processes, underscoring the scale of the control gap.
- Continuous, evidence-based identity governance is the control shift that matters because it connects entitlement data, approval logic, and remediation in one operating model.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing who has access to what across enterprise systems. |
| Recommendation — Use PR.AA-05 to keep access permissions current and reviewable across business applications. | ||
| CIS Controls v8 | CIS-5 — Account Management | The piece centres on provisioning, review, and deprovisioning discipline for user accounts. |
| Recommendation — Apply CIS-5 to enforce account review, approval, and removal workflows across systems. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article's continuous governance model depends on credential and account lifecycle control. |
| AC-6 — Least Privilege | Least privilege is the policy goal behind continuous access review and SoD enforcement. | |
| Recommendation — Use IA-5 to manage authenticators and reduce the window for stale or over-scoped access. Apply AC-6 to remove excess access and verify entitlements against current business need. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article explicitly covers continuous provisioning and deprovisioning governance for human and machine identities. |
| Recommendation — Use NHI-01 to ensure identities are removed from access paths when business need ends. | ||
Key terms
- Continuous Access Review: Continuous access review is the practice of evaluating identity permissions using live usage and behavior signals instead of relying only on periodic certifications. It helps teams find stale access, unusual patterns, and over-permissioned identities before those conditions become incident paths.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
- Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
- Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org