Topic starter
25/06/2026 12:38 am
TL;DR: Manual user access reviews are still the dominant model in many environments, but disconnected applications, limited APIs, and complex hybrid estates make them slow, error-prone, and hard to evidence, according to Cerby. The real issue is not just review fatigue: access governance breaks when controls cannot be consistently proved across the full application footprint.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “How Cerby Streamlines User Access Reviews (UARs) to Save Time and Strengthen Compliance”.
Key questions
Q: What breaks when user access reviews depend on disconnected applications?
A: Coverage breaks first, then evidence quality.
Q: Why does manual access review create risk for financial services organisations?
A: Manual access review increases risk because it is slow, fragmented, and hard to keep current across many systems.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay.
Practitioner guidance
- Inventory disconnected applications first Classify which systems cannot currently support automated entitlement collection, review, or revocation, then assign explicit ownership for each gap.
- Separate evidence capture from reviewer effort Define a standard artefact set for each access review, including entitlement snapshot, reviewer decision, remediation action, and timestamped completion evidence.
- Map manual review exceptions to compliance obligations Identify where manual workflows still carry SOX, HIPAA, GxP, or insurer scrutiny, then document compensating controls and residual risk.
Bottom line: Disconnected applications are not just an integration nuisance, they are a governance gap that weakens the reliability of user access reviews.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:34 am
Access review coverage is now constrained by application reach, not reviewer effort. Cerby’s article shows the governance bottleneck clearly: manual review programmes can look active while still leaving disconnected applications outside dependable control. The issue is structural because access governance only works where entitlement data can be collected, compared and acted on consistently. Practitioners should read this as a coverage problem, not a process diligence problem.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: What should organisations do when an application cannot support automated access review?
A: Treat the system as a governed exception, assign a named owner, document the manual evidence path and define a remediation plan to reduce the dependency. If the application stays out of automation indefinitely, the organisation should assume audit friction and residual access risk remain.
👉 Read our full editorial: User access reviews are breaking under disconnected app sprawl