Topic starter
08/07/2026 6:53 pm
TL;DR: Access reviews can complete on schedule while still producing approvals based on assumption, because managers are often asked to certify entitlements they cannot understand or risk-rate, according to OpenIAM. The governance gap is not review volume but decision quality: if access is not legible, certification becomes paperwork, not control.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “Why Managers Approve Access They Don't Understand During Access Reviews”.
Key questions
Q: How should security teams design access reviews so managers can make real decisions?
A: Security teams should present access in business terms, show why it was granted, and include enough context for the reviewer to judge current need.
Q: Why do access reviews still fail even when completion rates are high?
A: High completion rates do not prove that the right identities, entitlements, or systems were reviewed.
Q: What are the signs that an access review process is failing in practice?
A: A failing access review process usually shows up as long approval cycles, overloaded reviewers, repeated manual preparation, and heavy engineering effort just to launch each campaign.
Practitioner guidance
- Rebuild review screens around business meaning Show what each entitlement enables in plain language, including the business function, data touched, and action scope, so reviewers are not certifying system labels.
- Expose risk cues at certification time Flag privileged entitlements, regulated systems, and exception-based access directly in the review workflow so high-risk items do not blend into routine approvals.
- Require ownership and grant rationale Attach the approval owner, original business justification, and current role context to each access item so reviewers can judge whether the need still exists.
Bottom line: Access review programmes can look healthy while failing to validate the access they certify.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:15 pm
Decision quality, not review completion, is the real governance control: access reviews can produce clean completion metrics while still failing to validate whether access is justified. The problem is structural because certification workflows often ask reviewers to approve entitlements they cannot interpret. Governance teams should stop treating completion rate as evidence of control effectiveness.
A few things that frame the scale:
- 7% of security leaders admit they do not know how often their AI systems are making autonomous changes to infrastructure, according to the 2026 Infrastructure Identity Survey.
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: How do you know if access review context is good enough?
A: Context is good enough when a reviewer can identify what the entitlement does, why it exists, who owns it, and whether the risk justifies keeping it. If any of those elements is unclear, the review is incomplete in practice even if the workflow is finished.
👉 Read our full editorial: Access review decision quality is failing enterprise governance