Topic starter
19/08/2026 3:32 pm
TL;DR: Access reviews, audit responses, and governance decisions fail when teams assume identity data is accurate without independently verifying connectors, mappings, entitlements, and vault records, according to Hydden. That makes attestation a control for proving data integrity, not just completing a review, and the underlying assumption collapse matters for IAM, PAM, and NHI governance alike.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “How Do You Know Your Identity Data Is Right?”.
Key questions
Q: What breaks when access reviews are the primary identity control?
A: The control breaks because access can change, be abused, and disappear between review cycles.
Q: When does data accuracy become a governance problem rather than a technical one?
A: Data accuracy becomes a governance problem when multiple systems hold different versions of the same business fact and no one owns the authoritative record.
Q: What are the signs that identity data is out of sync across systems?
A: Common signs include role changes that appear in one directory but not another, offboarded users still present in at least one account store, and IdP lookups that return conflicting attributes.
Practitioner guidance
- Verify collector and mapping integrity Test the connector configuration, attribute mappings, and collection scope before each certification cycle so the review is based on current source data rather than a stale snapshot.
- Reconcile governance views against source records Compare accounts, roles, memberships, and entitlement sets side by side between the governance platform and the authoritative system to surface drift before approval.
- Certify vault contents against authoritative sources Require PAM or password manager records to reconcile back to directory and application sources so vaulted accounts are only approved when ownership and existence still align.
Bottom line: Identity attestation addresses a basic but often ignored problem: access reviews can be completed against incorrect identity data and still appear successful.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:14 pm
Data attestation is a governance control, not a review feature. The point is not to speed up certification but to prove that the data being certified is correct before a decision is recorded. In practice, that moves attestation upstream of approval and makes data integrity part of the control objective. Organisations that treat review completion as evidence of correctness are confusing workflow completion with governance assurance.
A question worth separating out:
Q: How should auditors evaluate evidence from completed access reviews?
A: Auditors should look for more than a returned spreadsheet. The stronger evidence is a durable record that shows the reviewed datasets, the configuration used to collect them, the reviewer who signed off, and the activity history behind the decision. That lets the examiner test whether the evidence itself was reliable.
👉 Read our full editorial: Identity data attestation closes the gap in access reviews