Topic starter
24/06/2026 10:30 pm
TL;DR: Access reviews work poorly when reviewers have only static entitlement lists and no decision context, according to RSA Security. Identity teams need risk triage, peer comparison and access rationale so certification becomes defensible governance, not volume processing.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Updated RSA Governance & Lifecycle Access Reviews Accelerate Action, Reduce Effort”.
Key questions
Q: How should IAM teams make access certification decisions more defensible?
A: Give reviewers the information needed to judge whether access is still justified: who has it, why they have it, and whether it looks unusual compared with similar users.
Q: What are the signs that an access review process is failing in practice?
A: A failing access review process usually shows up as long approval cycles, overloaded reviewers, repeated manual preparation, and heavy engineering effort just to launch each campaign.
Q: Why do access review approvals turn into rubber-stamping without context?
A: Reviewers need usage, account status, and role-change information to judge whether access is still justified.
Practitioner guidance
- Prioritise high-risk access in certification queues Rank entitlements by risk before review starts so reviewers spend time on access most likely to be inappropriate or exceptional.
- Attach access rationale to each entitlement Present who has access and why they have it, so reviewers can evaluate whether the business justification still holds.
- Use peer comparison for exception detection Compare each user with peers in the same role or function to surface outliers that deserve challenge before certification.
Bottom line: Access reviews fail when they are built around static lists instead of decision context.
Glossary terms: Access Certification, Identity Decision Chain, Entitlement Drift, Review Triage
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 7:13 am
Access review quality breaks when governance is reduced to list processing. The article exposes a familiar IGA failure mode: reviewers are asked to make judgment calls with too little identity context, so certification turns into throughput management. That is not a UI problem. It is a control-design problem, because the programme is trying to certify access without the evidence needed to justify the decision.
A question worth separating out:
Q: When should organisations compare users during access reviews?
A: Compare users whenever access decisions depend on role, function, or peer group consistency. Peer comparison is most useful when entitlement sets have drifted, when exceptions are common, or when reviewers need a quick way to identify outliers before approving access.
👉 Read our full editorial: Access reviews need context, not just faster certification workflows
This post was modified 1 day ago by NHI Mgmt Group