Notifications
Clear all
Topic starter
11/06/2026 11:35 pm
TL;DR: Manual access review reporting still leaves auditors with incomplete, unreliable evidence because reviewers juggle spreadsheets, changing app inventories, and remediation tracking, according to Zluri. Identity governance needs tamper-resistant, scope-controlled reporting that proves controls worked, not just that reviews happened.
NHIMG editorial — based on content published by Zluri: Access Management Simplify Report Generation With Next-Gen IGA
Questions worth separating out
Q: How should teams make access review reports audit-ready?
A: Teams should build reports from governed identity data, not from manual spreadsheets.
Q: Why do manual access review reports fail in practice?
A: Manual reports fail because reviewers must reconcile apps, identities, permissions, and remediation actions while the environment keeps changing.
Q: What breaks when access review evidence is not preserved as a single record?
A: What breaks is the audit trail.
Practitioner guidance
- Standardise review evidence capture Define a required evidence set for every access review cycle, including scope, approver, decision, remediation status, and completion proof.
- Lock finalized reports as immutable records Make the post-review report read-only once the cycle closes and record any later correction as a separate audit event.
- Use pre-review baselines for anomaly detection Generate inactive user, archived user, orphaned account, and apps-needing-review reports before certification begins.
What's in the full article
Zluri's full report covers the operational detail this post intentionally leaves for the source:
- Field-by-field examples of an audit-ready user access review report
- Supplementary pre-review reports for inactive users, archived users, and orphaned accounts
- Export formats and report controls for auditor handoff
- Role-based reviewer restrictions and read-only finalization details
👉 Read Zluri's article on simplifying audit-ready access review reports →
Access review reports: what audit teams are missing?
Explore further
12/06/2026 8:18 am
Access review reporting is becoming an evidence integrity problem, not a paperwork problem. When reviewers cannot reliably connect identities, permissions, actions, and remediation status, the programme loses audit value even if the review itself was completed. The issue is structural because the evidence trail is assembled after the fact instead of being governed as part of the review workflow. Practitioners should treat reporting as a control output, not an administrative task.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: Who should own the integrity of access review outputs?
A: Identity governance and control owners should own it jointly. The business reviewer supplies the decision, but the governance process must ensure the output is immutable, scope-bound, and exportable in an auditor-friendly format. That is how accountability stays clear when the review is challenged.
👉 Read our full editorial: Access review reporting gaps expose audit evidence failures
