Topic starter
05/07/2026 5:44 pm
TL;DR: Access management absorbs most ITGC audit effort because identities change continuously, evidence goes stale quickly, and auditors test both design and operating effectiveness across human and non-human identities, according to Zluri. That makes lifecycle-linked access controls, not periodic paperwork, the decisive audit boundary.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “ITGC Audit for Access: A Practical Checklist and Testing Guide”.
Key questions
Q: What breaks when access reviews are not tied to identity lifecycle events?
A: Reviews become a backward-looking checklist instead of a control that removes real excess access.
Q: Why do non-human identities need to be included in ITGC access testing?
A: Because machine identities carry the same audit risk as users when they touch material systems.
Q: How do teams know whether access review evidence is still reliable?
A: They should check whether the evidence is retrievable, tied to specific identities and applications, and linked to the period actually under review.
Practitioner guidance
- Map every audit-scope application to a named owner Tie each in-scope system to a business or application owner who can attest to access appropriateness, review results, and remediation decisions.
- Tie de-provisioning to lifecycle events Connect termination and role-change triggers directly to access removal so the evidence shows when the identity changed and when access actually changed.
- Include service accounts in recurring reviews Inventory machine identities, assign ownership, and sample their access on the same cadence as human accounts when they reach in-scope systems.
Bottom line: Access audits fail when the organisation cannot prove that access changes and evidence changes stayed aligned across the review period.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 5:45 pm
Access governance fails when evidence is treated as a snapshot instead of a lifecycle record. The article shows that auditors are not asking whether a review was performed once, but whether the entitlement state can be proven across the whole period under review. In identity programmes, that means the evidence model has to follow joiner, mover, and leaver events rather than quarterly artifacts. Practitioners should treat stale evidence as a governance defect, not just an audit inconvenience.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Should organisations prioritise lifecycle-triggered de-provisioning over periodic recertification?
A: They should treat them as complementary, but lifecycle-triggered removal should come first when access changes are frequent. Recertification catches drift, while lifecycle automation prevents stale access from surviving long enough to become an audit finding.
👉 Read our full editorial: ITGC access audits fail when identity lifecycle evidence goes stale