Topic starter
10/06/2026 9:44 pm
TL;DR: Access reviews often satisfy auditors while still consuming 149 person-days per cycle, leaving 25,000 data points, 18-day remediation delays, and recurring violations hidden in the process, according to Zluri. The real issue is not completion but governance design: manual review models are too slow, too broad, and too weak to reduce risk.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “User Access Review Best Practices (How to Review 10x Faster Without Sacrificing Accuracy)”.
Key questions
Q: What breaks when access reviews rely on spreadsheets and other manual tracking methods?
A: Spreadsheets and other manual methods break down when access volume, role churn, and system integrations grow.
Q: Why do quarterly access reviews still leave the same violations in place?
A: Because recurring findings usually reflect upstream lifecycle problems, not just reviewer mistakes.
Q: How can IAM teams tell whether access review coverage is actually meaningful?
A: They should measure what was excluded as well as what was approved.
Practitioner guidance
- Map hidden application coverage Compare identity-provider-visible applications with finance, browser, desktop, MDM, and CASB discovery sources to find the applications that reviews are currently missing.
- Certify groups before users Review role and group assignments first, then validate membership only where needed, so certification follows the structure already used to provision access.
- Automate revocation execution Connect review decisions to application APIs so approved removals are executed and confirmed without waiting on ticket queues or spreadsheet follow-up.
Bottom line: The article shows that access reviews can be completed on time and still fail to reduce risk when the workflow is too manual, too broad, and too slow to remediate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 5:43 am
Access review scale has become a governance design problem, not a compliance task. Once the review population reaches tens of thousands of entitlements, the limiting factor is no longer auditor expectation but human review capacity. The article shows that the control can be completed on schedule while still leaving large numbers of repeated violations unresolved. The practitioner lesson is that scale changes the nature of the control from certification to triage.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Should organisations prioritise continuous monitoring over periodic certification?
A: They should treat certification as necessary but insufficient, then prioritise continuous monitoring for controls that can fail quickly, especially access, identity, and third-party dependencies. Periodic certification still matters for governance, but only live validation shows whether the control is effective when the environment changes after the audit window closes.
👉 Read our full editorial: User access reviews are failing the scale test in IAM governance
This post was modified 4 days ago by NHI Mgmt Group