TL;DR: Spreadsheet-based access reviews in manufacturing create the appearance of compliance while stripping out SoD conflict context, lifecycle events, and remediation evidence, according to OpenIAM. The deeper problem is that review cadence, not role names alone, determines whether access governance can actually catch inappropriate entitlements.
At a glance
What this is: This is an analysis of why manufacturing access reviews fail when they are run as spreadsheets rather than governed workflows, with the key finding that context loss breaks the review decision.
Why it matters: It matters because IAM, IGA, and PAM teams need reviews that capture SoD conflicts, lifecycle triggers, and remediation proof across human and non-human access, not just signed-off lists.
Context
Spreadsheet access reviews in manufacturing fail because they separate the approval action from the identity context that makes the decision meaningful. When reviewers only see role names, they cannot evaluate segregation-of-duties conflicts, transfer history, contractor expiry, or the wider access profile that changes the actual risk.
Manufacturing makes this problem worse because access spans SAP, directory groups, plant applications, contractor accounts, and privileged access across multiple plants and systems. A fixed spreadsheet cycle can record that a review happened, but it cannot prove that the right access was judged, revoked, and documented at the point risk changed.
Key questions
Q: What breaks when access reviews are run as spreadsheets in manufacturing?
A: The review loses the identity context needed to make a meaningful decision. Managers see role names but not SoD conflicts, lifecycle changes, contractor expiry, or privilege combinations, so the process becomes a sign-off exercise rather than a control. The failure is structural because the evidence trail records the review, not the governance outcome.
Q: Why do spreadsheet access reviews create compliance risk even when managers sign them?
A: Because a signature only proves that a list was checked. It does not prove that reviewers understood the access, identified a conflict, or that revoked access was removed and documented. Compliance risk remains when the workflow cannot show decision context, remediation timestamps, and exception rationale.
Q: How should manufacturing teams know whether access review controls are working?
A: Look for a review process that exposes conflict context, reacts to lifecycle events, and produces timestamped revocation evidence. If reviewers approve role names without seeing business impact or if removals are not tracked to completion, the control is not working as intended.
Q: What is the difference between a reviewed spreadsheet and a governed access review?
A: A reviewed spreadsheet is a static artefact that shows a list was circulated and marked up. A governed access review presents the full user profile, captures risk-informed decisions in workflow, ties revocations to completion, and retains exportable evidence for audit and remediation.
Technical breakdown
Why role names are not reviewable evidence
A spreadsheet reduces access review to a row-by-row approval exercise, but a role name is only a label, not a risk statement. In manufacturing, the same user may hold several roles that are individually acceptable yet collectively create a segregation-of-duties conflict, especially across procurement, finance, and production workflows. Without application context, entitlement metadata, and conflict mapping, the reviewer is blind to the control objective. The review therefore tests whether someone can mark a list, not whether access governance is functioning.
Practical implication: present access reviews with role meaning and conflict context, not exported entitlement lists.
How lifecycle events disappear in spreadsheet campaigns
Spreadsheet reviews are usually periodic, which means they are detached from the events that actually change access risk. A plant transfer, promotion, termination, or contractor expiration can happen weeks or months before the next scheduled campaign, leaving inappropriate access active in the meantime. In identity governance terms, the problem is not only review frequency but review timing relative to joiner-mover-leaver events. If the process does not react to lifecycle changes, it cannot distinguish current access from stale access.
Practical implication: trigger access review workflows from lifecycle events, not only from calendar cadence.
Why remediation proof is part of the control, not a back office detail
A completed spreadsheet can show that reviewers clicked approve or revoke, but it does not by itself prove that revoked access was actually removed. That breaks the audit trail because the control outcome is not the signature, it is the enforced change and the evidence that follows. Manufacturing environments often need to show who approved, what was revoked, when the removal occurred, and what exception rationale, if any, was recorded. Without that chain, the review is administrative documentation rather than governed remediation.
Practical implication: require timestamped revocation evidence and exception tracking inside the review workflow.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Spreadsheet access reviews create an evidence illusion, not an access governance control. The core failure is that the artefact records a review event while stripping away the context that determines whether the decision was valid. In manufacturing, that context includes SoD conflicts, plant transfers, contractor expiry, and privilege elevation across systems. Practitioners should treat the spreadsheet as an administrative extract, not as a governance mechanism.
Identity context is the control surface that makes access review meaningful. A manager cannot judge a SAP role in isolation when the real risk depends on what other roles, directory memberships, and business events sit around it. That is why role names alone are insufficient for enterprise review. The implication is that access governance must present the full user profile, not a narrowed entitlement snapshot.
Manufacturing exposes the weakness of schedule-led governance more sharply than most sectors. Plant operations move people between roles frequently, contractors churn quickly, and access spans both enterprise and shop-floor systems. Quarterly or annual review cadences cannot keep pace with those changes. The practitioner conclusion is straightforward: review design must follow lifecycle events, not just calendar commitments.
Remediation evidence is the boundary between compliant-looking and defensible review practice. A review without tracked revocation, exception rationale, and exportable history cannot satisfy audit expectations in a meaningful way. This is not a formatting issue. It is the difference between showing that someone looked at a list and showing that inappropriate access was actually controlled.
Context stripping is the named failure mode this article exposes. The spreadsheet model was designed for a world where access could be judged from static role labels and periodic sign-off. That assumption fails when access risk depends on lifecycle state, cross-system combinations, and remediation proof. The implication is that identity governance has to preserve context as part of the review object itself.
From our research library:
- 61% of organisations still define privileged users as humans only, overlooking the role of non-human identities in privileged access, according to KPMG.
- Read next: Ultimate Guide to NHIs — Regulatory and Audit Perspectives
What this signals
Context stripping is the failure pattern to watch: when access review artefacts collapse role names, lifecycle status, and SoD evidence into a spreadsheet, the process stops testing governance and starts testing document handling. Manufacturing programmes should assume that any review design without embedded access context will eventually approve risk by default.
Manufacturing teams should treat lifecycle-triggered review design as a governance requirement, not an optimisation. When mover, leaver, and contractor events are not part of the review trigger model, stale access persists between campaigns and the control only reports backward-looking compliance.
Review evidence must be built into the workflow: if revocation timestamps, exception rationale, and completion status are not captured at the point of decision, auditors will reconstruct the gap faster than the team can explain it.
For practitioners
- Replace spreadsheet reviews with governed review workflows Present entitlement data with business context, SoD conflict indicators, lifecycle state, and an auditable decision trail so reviewers can assess actual risk rather than role labels.
- Trigger reviews from lifecycle events Fire review campaigns from plant transfers, role changes, terminations, and contractor expirations so access is reassessed when risk changes, not only on a fixed schedule.
- Map role combinations before review distribution Identify access combinations across SAP, directory services, and plant applications that create SoD conflicts, then surface those conflicts to reviewers before approval.
- Track revocations to completion Require timestamps, completion status, and exception rationale for every revoke decision so the review record proves removal, not just reviewer intent.
Key takeaways
- Spreadsheet access reviews fail because they strip out the identity context that makes access decisions meaningful.
- In manufacturing, the weakness is amplified by frequent role changes, contractor churn, and cross-system access combinations that spreadsheets do not surface.
- A defensible review process needs lifecycle triggers, conflict context, and timestamped remediation evidence, not just marked-up role lists.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Spreadsheet reviews hide overbroad access because role labels obscure effective privilege. |
| Recommendation — Map hidden effective access to NHI-05 and surface privilege combinations before reviewer approval. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing entitlement decisions with proper context and evidence. |
| Recommendation — Apply PR.AA-05 to ensure access decisions are reviewed with role meaning, conflict context, and evidence. | ||
| MITRE ATT&CK | TA0008 — Lateral Movement | Uncontrolled cross-system access combinations widen lateral movement opportunities in manufacturing estates. |
| Recommendation — Map excessive cross-system entitlements to TA0008 and prioritize the paths that create the broadest movement risk. | ||
| CIS Controls v8 | CIS-5 — Account Management | Periodic review of user and contractor accounts is central to the access governance failure described. |
| Recommendation — Use CIS-5 to enforce timely review, revocation, and lifecycle control across employee and contractor accounts. | ||
Key terms
- Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
- Lifecycle Trigger: A lifecycle trigger is the event or source signal that causes an access change, such as a role update, termination, or transfer. If the trigger is stale, missing, or poorly governed, the identity system can keep access alive long after the business need has ended.
- Remediation evidence: Remediation evidence is the record that shows an access issue was identified and corrected. It usually includes the reviewer, the decision, the change request, and the completed revocation or adjustment, which allows auditors to verify that the control actually closed the gap.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on September 14, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org