TL;DR: ISO 27001 user access reviews are meant to verify that users still have appropriate permissions, but the article shows how stale access, missing approvals, and weak evidence routinely break audit readiness according to SecurEnds. The real issue is not the review cadence itself, but whether organisations can prove access was removed, documented, and traceable when roles and people changed.
At a glance
What this is: This article explains how ISO 27001 user access reviews can still fail governance and audit expectations when approvals, removals, and evidence trails are incomplete.
Why it matters: It matters because IAM and IGA teams need access reviews that produce defensible proof, not just a scheduled activity, across human, NHI, and privileged access processes.
Context
ISO 27001 user access review is a governance control, not just a periodic housekeeping task. The article centres on the gap between access review activity and provable access control, especially when people move roles or leave and old permissions remain.
In practice, the failure mode is familiar: reviews happen, but the organisation cannot show what changed, who approved it, or whether revoked access actually disappeared. That leaves audit teams with process claims but weak evidence, which is where certification risk starts.
Key questions
Q: What breaks when ISO 27001 user access reviews do not produce audit evidence?
A: The review stops being defensible. Auditors need to see who reviewed access, what changed, when it changed, and why the decision was made. If that trail is missing, the organisation may have performed the task but cannot prove control, which is enough to create certification and governance risk.
Q: Why do stale permissions create ISO 27001 governance risk even when reviews run on schedule?
A: Because the schedule does not correct the underlying access data. If joiner, mover, and leaver updates are late or incomplete, the review only revalidates stale entitlements. That leaves old access in place long enough to fail least-privilege expectations and weaken audit confidence.
Q: How do organisations know whether access reviews are working?
A: Access reviews are working when they lead to timely removals, reduced exception volume, and role definitions that stop accumulating unused rights. If the same accounts keep reappearing with the same excess access, the review process is only producing paperwork. Evidence of change is the real success signal.
Q: Should privileged access reviews be handled separately from standard user access reviews?
A: They should be governed differently because privileged accounts carry higher blast radius and tighter accountability requirements. Standard access review can focus on broad entitlement validity, while privileged review must also verify business justification, dormant account status, and deprovisioning evidence. Combining them without extra scrutiny hides the riskiest access.
Technical breakdown
Why ISO 27001 access reviews fail without traceable evidence
An access review is only defensible when the organisation can prove four things: the scope of users reviewed, the decision made for each entitlement, the person who approved or rejected that decision, and the timestamped outcome. In ISO 27001 terms, this supports control A.9.2.5 by showing that access rights remain appropriate over time. The article highlights that manual review activity often exists without durable records, which means the control may be performed but not demonstrable. Auditors do not accept intent. They look for evidence that access governance is repeatable and bounded.
Practical implication: preserve reviewer actions, approvals, exceptions, and removals as audit evidence, not as informal workflow notes.
How stale access turns review cadence into a false signal
Regular review cadence does not fix stale entitlements if joiner, mover, and leaver changes are not reflected in the access list. The technical issue is lifecycle drift: account state and business role state diverge, so reviews are validating yesterday’s permissions against today’s job. That is why old access can persist for months even in organisations that claim to run compliance checks. ISO 27001 expects access to be intentionally assigned and revalidated, which means the data feeding the review must be current before the review can be trusted.
Practical implication: reconcile HR, directory, SaaS, and cloud access sources before certification cycles begin.
Why privileged access needs a separate review path
Privileged access is not just another row in the review spreadsheet. Admin rights expand blast radius, so they need tighter ownership, clearer approval traces, and more explicit justification than standard end-user access. The article correctly separates privileged access under A.9.2.3 from general user access reviews because elevated rights are where audit scrutiny intensifies. If the review process treats admin entitlements like routine permissions, the organisation loses visibility into who can change systems, data, and controls themselves.
Practical implication: isolate privileged entitlements into a dedicated review workflow with named accountability and explicit revocation evidence.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
ISO 27001 user access review is an evidence problem before it is a scheduling problem. Organisations often focus on whether reviews happen quarterly or twice yearly, but auditors care more about whether the outcome is provable. If the organisation cannot show approvals, removals, and reviewer ownership, the control exists only in policy form. The practitioner conclusion is simple: access governance must be built around evidence quality, not calendar frequency.
Access review gaps usually reflect joiner-mover-leaver drift, not isolated mistakes. When HR, IAM, and application owners maintain different views of access state, permissions outlive business need. That creates a governance mismatch that recertification alone cannot correct. The practical lesson is that review programmes must be tied to lifecycle integrity, or stale entitlements will keep reappearing.
Privileged access requires a stricter governance model than ordinary user access. A.9.2.3 exists because admin rights create higher impact if left unreviewed or uncleared. Treating elevated permissions as part of the same workflow as standard access hides risk and weakens audit defensibility. The implication for practitioners is to separate privileged review governance from baseline access certification.
Traceability is the real control variable in ISO 27001 access governance. A review without timestamps, reviewer identity, and recorded disposition cannot support certification or audit challenge. That is why automation matters only when it improves the quality and persistence of the record, not when it simply speeds up checkbox completion. The programme conclusion is that governance maturity shows up in evidentiary completeness.
Named concept: review evidence integrity. This is the gap between performing a user access review and producing audit-grade proof that the review occurred and changed something meaningful. In ISO 27001 programmes, that gap is where most certification friction appears. Practitioners should treat evidence integrity as a control outcome in its own right, because without it the review cannot be trusted.
What this signals
Review evidence is the control boundary. ISO 27001 programmes often overrate the cadence of review and underrate the quality of the record. The real question is whether the access decision can be reconstructed later with enough fidelity for audit and governance challenge.
Lifecycle drift is what turns access reviews into a recurring cleanup exercise. When movers and leavers are not synchronised into the entitlement source of truth, recertification becomes a lagging indicator. Practitioners should treat reconciliation as part of the control, not as a separate hygiene task.
For practitioners
- Strengthen review evidence integrity Record reviewer identity, decision, timestamp, and entitlement change for every access certification cycle so auditors can reconstruct the full path from review to revocation.
- Separate privileged access reviews Route admin and elevated permissions through a dedicated workflow with explicit approvals and separate sign-off from standard user access.
- Reconcile lifecycle sources before review Compare HR, directory, SaaS, and cloud records before certification begins so movers and leavers do not inflate the entitlement list.
- Automate exception logging Capture every exception, remediation note, and closure status in the same system that runs the review so evidence is retained in one audit trail.
Key takeaways
- The article shows that ISO 27001 access reviews fail most visibly when organisations cannot prove the review happened in an audit-grade way.
- The recurring risk is stale access and missing approvals, which leave compliance gaps even when review activity is nominally in place.
- Separating privileged access, tightening lifecycle reconciliation, and preserving complete evidence trails are the controls that make reviews defensible.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about proving access rights are reviewed and justified over time. |
| Recommendation — Map review evidence to PR.AA-05 and verify each entitlement has current approval and disposition. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article centres on keeping access aligned to business need and removing excess rights. |
| Recommendation — Use AC-6 to remove standing excess access and justify every retained entitlement. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle drift and stale permissions are the governance gaps in this article. |
| Recommendation — Apply CIS-5 to reconcile accounts, remove inactive access, and retain review evidence. | ||
| ISO/IEC 27001:2022 | A.8.2 — Privileged Access Rights | The article explicitly separates privileged access review from standard user review. |
| Recommendation — Treat privileged access as a separate review stream with explicit approval and revocation records. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article's leaver gap shows how access persists after role or employment changes. |
| Recommendation — Offboard non-human or shared access promptly and prove revocation in the review trail. | ||
Key terms
- Access review evidence: Access review evidence is the record that shows an entitlement was examined, assessed, and either retained or removed for a reason. Strong evidence includes the reviewer, the date, the decision, and any remediation path, which is what makes governance auditable rather than assumed.
- Lifecycle Drift: Lifecycle drift is the gap between the intended state of an identity and the access that remains active in systems after the business context changes. It often appears as delayed revocation, stale privileges, or unowned credentials, and it is a practical indicator that governance is out of sync.
- Privileged Activity Review: The process of examining high-risk administrative actions to confirm they were authorised, necessary, and traceable. In VMware and SQL Server environments, this review depends on logs that connect configuration changes and management actions to accountable identities.
- Joiner-Mover-Leaver Synchronisation: The alignment of HR, IAM, and application records so access changes follow employment or role changes without delay. When this synchronisation fails, access reviews become a catch-up exercise and stale permissions persist. The control works only when lifecycle data and entitlement data move together.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 7, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org