Topic starter
06/07/2026 9:35 am
TL;DR: Access reviews, stale access, and AI-assisted role mining can all be automated across the company, with audit evidence, SoD checks, and reviewer workflows captured in one place, according to Lumos. The governance lesson is that continuous identity oversight now depends on review automation, not periodic cleanup.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “How Lumos Uses Lumos to Reduce Organizational Risk via Effective Governance”.
Key questions
Q: What breaks when access reviews stay manual?
A: Manual reviews break when reviewers cannot validate current business context quickly enough to identify toxic access, orphaned accounts, or stale approvals.
Q: Why do stale entitlements keep reappearing in access governance programmes?
A: Stale entitlements reappear when review cadence is slower than entitlement change and when reviewers lack context about actual usage.
Q: What are the signs that user access reviews are not working well?
A: Common warning signs include long review cycles, heavy reliance on spreadsheets, inconsistent evidence collection, and app owners who delay or ignore assigned reviews.
Practitioner guidance
- Standardise access review workflows Move review initiation, reviewer assignment, decision capture, and remediation tracking into one governed workflow so the control has a single audit trail.
- Embed SoD policy logic in recertification Configure segregation of duties rules so reviewers see entitlement combinations and conflicts directly in the review screen, not in a separate policy document.
- Use usage context to reduce false approvals Include application usage data, role context, and entitlement history so reviewers can distinguish active need from stale or out-of-scope access.
Bottom line: Manual access reviews create governance drift when evidence, decisions, and remediation are handled in separate workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:49 am
Manual access reviews are now a control failure, not just an operations burden. When reviews depend on tickets, spreadsheets, and email follow-up, the programme loses timing, context, and evidence continuity. That means least privilege can be asserted on paper while stale access persists in production. For practitioners, the important question is whether review governance is still truly enforcing decisions or merely documenting them after the fact.
A question worth separating out:
Q: How should organisations connect access reviews to compliance outcomes?
A: They should make each review produce an auditable chain from finding to remediation to sign-off. Compliance is stronger when the report shows what was checked, what changed, who approved the change and whether any exceptions remain open. That turns review from a checkbox exercise into evidence of control operation.
👉 Read our full editorial: Lumos' governance model shows where manual access reviews fail