ITGC access management audits expose identity governance gaps

At a glance

What this is: This article is a practical ITGC audit checklist for access management and its central finding is that manual review processes miss orphaned accounts, risky permissions, and weak evidence trails.

Why it matters: It matters because ITGC findings often surface the same governance failures that later affect NHI, autonomous, and human identity programmes: poor lifecycle control, weak review cadence, and incomplete proof of access decisions.

Context

ITGC access management audits test whether an organisation can prove that only the right identities retain the right access, and that the evidence behind those decisions is complete. In practice, the control problem is not limited to one review event. It spans access approval, review, revocation, reporting, and the ability to show auditors that each step happened as designed.

The article frames the gap clearly: manual access governance becomes fragile when permissions are spread across many systems, review evidence is assembled late, and exceptions are handled inconsistently. That is a governance problem as much as a control problem, because compliance depends on a repeatable identity lifecycle rather than one-off inspection activity.

Key questions

Q: What breaks when fraud investigations depend on spreadsheets and ad hoc team pings?

A: The main failure is latency. By the time someone gathers the numbers, the signal may have gone cold and the fraud pattern may have shifted. That slows investigation, hides the orders driving the issue, and makes executive reporting stale. Teams also lose consistency, because different analysts may assemble different views of the same problem.

Q: When should organisations prioritise automated access reviews over manual audit sampling?

A: They should prioritise automation when access is distributed across many systems, when role changes happen frequently, or when privileged access is in scope. In those environments, manual sampling only tells you what was visible at a moment in time. Automated review and certification give continuous coverage where audit windows would otherwise miss drift.

Q: What are the signs that ITGC or ITAC is failing?

A: Look for mismatches between the control layer and the evidence you can produce. Examples include applications processing data without validation, users retaining access that exceeds their role, changes reaching production without testing, or recovery plans that have not been exercised. Those signals usually mean the control exists on paper but not in the operational layer it was meant to govern.

Q: Who is accountable when residual access remains after an employee leaves?

A: Accountability sits with the identity, security, and system owners who control issuance, use, and retirement of the credential. Human offboarding is not complete until the organisation can show that access was removed everywhere it existed. For regulated environments, that evidence should be auditable and tied to the same lifecycle record as the original entitlement.

Technical breakdown

Why access reviews fail when permissions are scattered

Access reviews depend on a clean inventory of who has access to what, across systems, roles, and exceptions. When access lives in spreadsheets, ad hoc exports, and disconnected admin consoles, the reviewer is certifying a moving target rather than a governed entitlement set. Orphaned accounts and stale role assignments are not just hygiene issues. They are evidence that the review process lacks authoritative identity data and consistent lifecycle ownership.

Practical implication: Establish one authoritative entitlement source before relying on periodic reviews.

How evidence collection breaks down in manual ITGC audits

Audit evidence is only useful when it proves both design and operating effectiveness. Screenshots, policies, logs, and interview notes must line up with the control being tested, otherwise the audit trail becomes a narrative instead of proof. Manual collection tends to miss timing, ownership, and remediation context, which is why auditors often find gaps between documented policy and actual access behaviour.

Practical implication: Tie each access control to a specific evidence pack that shows operation over time, not just policy existence.

What continuous monitoring changes for access governance

Continuous monitoring shifts access governance from point-in-time checking to ongoing control validation. That matters because access risk is rarely static. Role changes, contractor exits, and privilege drift can all create exposure between audit cycles. In ITGC terms, the issue is not whether an audit eventually catches the problem, but whether the organisation can detect and correct it before the control fails in production.

Practical implication: Use automated alerts and recurring certifications to surface entitlement drift before the next audit window.

Threat narrative

Attacker objective: The objective is to exploit governance drift and use retained access to reach data or systems that should already have been revoked.

1. Entry occurs when excessive or residual access remains active after a role change, termination, or temporary assignment ends.
2. Credential or entitlement abuse follows when an identity can still reach sensitive systems and data despite no longer needing that access.
3. Impact emerges through unauthorised viewing, leakage, or manipulation of regulated business data, which then becomes an audit and compliance failure.

Breaches seen in the wild

• New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ITGC access management is really a lifecycle problem, not a checklist problem. The article is strongest when it shows that access reviews, evidence gathering, and reporting only work if identity data stays current across the full entitlement lifecycle. Manual checkpoints cannot compensate for poor ownership, delayed revocation, or fragmented visibility. The practitioner lesson is that control design has to start with lifecycle governance, not audit paperwork.

Orphaned accounts are the clearest signal that governance and operations have diverged. Once a former employee, contractor, or administrator retains access, the control environment has already lost synchronisation with business reality. That is not merely an audit defect. It is a governance failure that often precedes fraud, leakage, or a failed control test. Teams should treat orphaned access as proof that offboarding and certification are not connected.

Access reviews without trustworthy entitlement data create false confidence. A reviewer cannot certify what they cannot see, and disconnected exports tend to hide both over-permissioned roles and shadow exceptions. The result is a process that appears compliant while leaving the highest-risk access untouched. Practitioner implication: access certification needs authoritative, continuously updated identity records to mean anything.

Evidence quality is now part of access control quality. If policies, screenshots, logs, and approvals do not align, the organisation cannot demonstrate control effectiveness even if the control was partly in place. This is why audit readiness and identity governance are converging into the same operational discipline. Practitioners should treat evidence integrity as a control outcome, not a documentation chore.

ITGC access management exposes the same governance gaps that affect NHI programmes. The article’s manual-review failure mode mirrors what happens when non-human access is governed as a static permission set rather than a lifecycle with ownership, revocation, and review. The concept here is identity review drift: when certification cadence, entitlement change, and revocation timing stop lining up, the audit passes only on paper. The practical conclusion is that governance has to follow access motion, not calendar rhythm.

What this signals

Identity review drift: when certification cadence, entitlement changes, and revocation timing stop aligning, access governance becomes audit theatre instead of a living control. That is the deeper lesson from ITGC access management work. Programmes need to treat identity state as continuously changing, otherwise review outcomes will always lag the real environment.

Automated monitoring does not replace governance, but it does expose where governance has gone stale. In access-heavy environments, the practical boundary between compliant and non-compliant often appears in the delay between a change and the revocation that should have followed it.

For practitioners

• Standardise entitlement inventories Create a single, reconciled view of user, role, and application access before starting audit certification cycles so reviewers are not working from partial exports.
• Link offboarding to access revocation Require leaver processing to trigger immediate removal of application, cloud, and financial-system access, then verify that removals are reflected in the audit trail.
• Separate evidence packs by control Build one evidence pack per access control with approvals, logs, and remediation records kept together so operating effectiveness can be proven quickly.
• Automate recurring access certifications Use scheduled certifications for high-risk roles and privileged accounts so stale access is reviewed before it accumulates across multiple audit periods.
• Escalate orphaned accounts immediately Treat inactive or ownerless accounts as remediation items, not review exceptions, because they signal a broken lifecycle control rather than a cosmetic issue.

Key takeaways

• ITGC access management exposes a familiar governance pattern. When access is reviewed manually, organisations often discover that lifecycle control and audit evidence have drifted apart.
• The article shows why orphaned accounts, over-permissioned roles, and inconsistent evidence collection are not separate problems. They are all signs that access governance is no longer authoritative.
• The control lesson is straightforward. Access governance has to be continuous, reconciled, and tied to revocation timing if it is going to survive audit scrutiny.

Key terms

• ITGC access control: An IT general control that governs who can access systems, data, and functions, and how that access is approved, reviewed, and removed. In audit terms, it must be demonstrable through evidence, not asserted through policy language alone.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Orphaned Account: An orphaned account is an identity that remains active without a clear owner or business purpose. These accounts are dangerous because they often escape review, retain unnecessary access, and provide attackers with low-friction entry points into otherwise governed environments.
• Evidence of Operating Effectiveness: Evidence of operating effectiveness is proof that a control was not only designed correctly but also performed consistently during the period under review. In access governance, this usually means approvals, logs, certifications, and remediation records that align with the control being tested.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.