Topic starter
25/06/2026 12:27 am
TL;DR: Manual access reviews, email approvals, and spreadsheet-based governance break down as user counts, apps, and compliance demands grow, leading to missed revocations, stale entitlements, and slower audits, according to SecurEnds. Automation shifts IGA from episodic cleanup to continuous control, and the real prize is not convenience but reduced control failure across lifecycle, compliance, and risk management.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “From Manual to Automated IGA: Benefits and ROI”.
Key questions
Q: What breaks when identity governance relies on spreadsheets and email approvals?
A: Access decisions lose traceability, version control, and reliable ownership.
Q: Why do manual IGA processes create more compliance risk as organisations grow?
A: Because growth multiplies users, applications, and access changes faster than human reviewers can track them.
Q: What are the signs that access governance is failing in practice?
A: The clearest signs are slow remediation, repeated rubber stamp access reviews, and missed permissions outside traditional HR linked systems.
Practitioner guidance
- Replace spreadsheet-based certifications Move access reviews into a governed workflow that captures reviewer decisions, timestamps, and entitlement scope in one place instead of across ad hoc files and email threads.
- Automate joiner-mover-leaver changes Connect HR, directory, and SaaS identity sources so onboarding, role changes, and offboarding trigger access updates from a single authoritative event stream.
- Centralise evidence for audits Store approvals, review results, and policy exceptions as structured records that can be retrieved without reconstructing the trail from screenshots or ticket history.
Bottom line: Manual identity governance fails when review cycles cannot keep pace with access changes across modern enterprise environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:22 am
Manual identity governance creates control debt, not just administrative overhead. The article describes spreadsheets, email chains, and tickets as the operating model, but that model does not preserve a live entitlement state. Each review cycle becomes a cleanup event instead of a continuous control, which means the organisation is always reconciling yesterday's access. The practitioner conclusion is that manual IGA is structurally misaligned with enterprise scale.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: When should automation be used in identity governance workflows?
A: Use automation when the decision is repetitive, threshold-driven, and well understood, such as notifying managers, initiating mini-reviews, or disabling clearly risky access. Keep humans focused on ambiguous cases that require business judgment. The goal is faster containment, not removing accountability from the process.
👉 Read our full editorial: Manual identity governance no longer scales for enterprise IGA