Notifications
Clear all
Topic starter
06/07/2026 9:41 am
TL;DR: Quarterly access reviews can still fail audits when they document activity without preventing, detecting, or correcting inappropriate access, according to Zluri’s analysis of a financial services case. The real governance test is whether controls stop over-provisioning, catch drift between reviews, and fix root causes before the next cycle.
NHIMG editorial — based on content published by Zluri: Security & Compliance Access Review Controls: Preventive, Detective, and Corrective Controls Explained
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities.
Questions worth separating out
Q: What breaks when access reviews are treated as the main control instead of a governance check?
A: When access reviews become the primary control, organisations end up certifying whatever access already exists instead of preventing bad access from being created.
Q: Why do access reviews fail even when completion rates and documentation look good?
A: High completion rates do not guarantee control effectiveness.
Q: How can security teams tell whether access governance is actually working?
A: Look for falling exception volumes, shorter remediation times, fewer recurring findings, and tighter alignment between role baselines and actual entitlements.
Practitioner guidance
- Separate process metrics from control metrics Track how many entitlements were prevented, detected, and remediated, then compare those numbers against review completion rate and SLA adherence.
- Enforce preventive baselines at provisioning Use role baselines and approval workflows to block access that exceeds birthright permissions during onboarding or role change.
- Automate offboarding and orphan detection Trigger revocation from termination events and continuously scan for orphaned accounts, including contractor and service accounts with no active owner.
What's in the full article
Zluri's full blog post covers the operational detail this post intentionally leaves for the source:
- The full 10-control breakdown with specific preventive, detective, and corrective mappings for access governance.
- Practical examples of how dormant, orphaned, and excessive access detection works across real application environments.
- Implementation guidance for remediation SLAs, root-cause analysis, and audit trail integrity in quarterly review programmes.
- The control-by-control table that maps each access problem to the mechanism that prevents or corrects it.
👉 Read Zluri’s analysis of preventive, detective, and corrective access review controls →
Access review controls: are your quarterly checks actually governing?
Explore further
06/07/2026 9:57 am
Process without enforcement is not identity governance. A quarterly review can be completed with high attendance, good documentation, and still fail to control access if provisioning, monitoring, and offboarding are not technically enforced. The article’s financial services example shows that auditable activity and secure outcomes are separate things. The implication is that identity programmes must stop using process completion as a proxy for control effectiveness.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- That confidence gap matters because 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: Who is accountable when inappropriate access survives a quarterly review?
A: Accountability sits with the control owners, not just the reviewers. IAM, IGA, HRIS, and application owners all contribute to whether access is prevented, detected, and revoked on time. If no one owns the downstream revocation and root-cause correction, review completion cannot be treated as governance completion.
👉 Read our full editorial: Access review controls that turn quarterly checks into governance
