Notifications
Clear all
Topic starter
08/07/2026 6:51 pm
TL;DR: Access reviews often complete on schedule while still failing as governance, because reviewers lack the purpose, usage, risk, and baseline context needed to make confident decisions, according to OpenIAM. Without that context, approval becomes the default outcome and entitlement sprawl quietly persists.
NHIMG editorial — based on content published by OpenIAM: Access Review Context: Why Approval Without Confidence Is a Governance Risk
Questions worth separating out
Q: How should organisations improve access review decisions without creating more reviewer fatigue?
A: Put the evidence in front of the reviewer before asking for a decision.
Q: Why do access reviews often approve access that should be removed?
A: Because approval is the least disruptive choice when the reviewer lacks confidence.
Q: What signals indicate that an access review programme is not working well?
A: High completion rates paired with low revocation rates, especially for dormant or privileged access, are a strong warning sign.
Practitioner guidance
- Instrument review decisions with context Add purpose, usage, risk, and peer baseline data directly into the reviewer workflow so approvers are not deciding from entitlement names alone.
- Prioritise high-risk entitlements first Route privileged, dormant, or out-of-role access into an escalated review queue before routine certification cycles begin.
- Replace spreadsheet-driven recertification Unify access ownership, ticket history, and usage telemetry in one review surface so decisions are made with the same evidence that granted the access.
What's in the full article
OpenIAM's full article covers the operational detail this post intentionally leaves for the source:
- A step-by-step breakdown of the four decision inputs reviewers need at certification time
- The article's own examples of how missing context leads to over-approval in routine access reviews
- A clearer explanation of why completion metrics can stay high while governance quality degrades
- Practical framing for organisations still relying on manual review packets and spreadsheet exports
👉 Read OpenIAM's analysis of why access review context determines governance quality →
Access review context: is your governance really making decisions?
Explore further
08/07/2026 7:12 pm
Access review context is the real control, not certification volume. Reviews that move quickly but lack purpose, usage, and baseline evidence do not produce governance. They produce recorded decisions without decision integrity, which is why completion metrics can rise while excess access remains untouched. The implication is that access review programmes must be judged by confidence in the outcome, not by whether the queue was cleared.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who is accountable when access reviews become a compliance exercise instead of a control?
A: Accountability sits with the identity governance owners who design the review process, the system owners who supply evidence, and the business approvers who sign off on access. Under NIST Cybersecurity Framework 2.0, governance must support risk-informed decisions, so a review process that hides context is a governance failure, not just an operational one.
👉 Read our full editorial: Access review context is the missing control in governance
