Topic starter
07/06/2026 8:11 pm
TL;DR: C1.ai says manual user access reviews are backward-looking and cannot keep pace with daily joiner, mover and leaver events, privilege creep, and shadow applications, so teams are moving toward event-driven continuous identity assurance. The control problem is no longer proving a review happened, but proving risk is being reduced in real time.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “The IGA Maturity Curve: Shifting from Reviews to Assurance”.
Key questions
Q: What breaks when access reviews are treated as a quarterly checkbox?
A: Quarterly reviews assume access remains stable long enough to be meaningfully assessed later.
Q: Why does continuous assurance reduce IGA risk more effectively than manual review?
A: Continuous assurance reduces risk because it evaluates access when changes happen, not after the fact.
Q: What are the signs that an access review process is failing in practice?
A: A failing access review process usually shows up as long approval cycles, overloaded reviewers, repeated manual preparation, and heavy engineering effort just to launch each campaign.
Practitioner guidance
- Replace calendar-based certifications Shift high-risk entitlements from quarterly or annual review cycles to event-triggered checks tied to joiner, mover, leaver, and role-change events.
- Map access data coverage Inventory which applications, identities, and entitlement sources are visible to your governance process and close the blind spots first, especially across SaaS applications.
- Reduce manual evidence collection Automate report gathering, entitlement aggregation, and reviewer workflow so governance teams spend time on exceptions and decisions rather than data chasing.
Bottom line: Manual access reviews no longer match the speed of modern identity change, so governance programmes that rely on snapshots will keep missing drift and stale privilege.
What's in the full article
C1.ai's full blog covers the operational detail this post intentionally leaves for the source:
- The webinar framing and discussion points from Treasure Data's GRC perspective on continuous assurance
- The connector and data-collection approach used to expand visibility across SaaS applications
- The practical shift from manual reporting to automation-backed governance workflows
- The discussion of how AI changes the division of work between humans and identity systems
👉 Read C1.ai's analysis of the IGA maturity curve and continuous assurance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/06/2026 9:59 pm
Manual access review is a lagging assurance model, not a control state. Quarterly or annual certification assumes entitlement risk changes slowly enough for a snapshot to remain valid. In SaaS-heavy environments, that assumption fails because access changes continuously and business context changes with it. The implication is that IGA maturity is no longer measured by how many reviews are completed, but by how quickly entitlement risk is reduced.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should teams govern non-human identities as assurance becomes continuous?
A: Teams should apply the same visibility, ownership, and purpose checks to non-human identities that they use for human access, but at machine speed. Service accounts, tokens, and automation identities often outlive the business purpose that created them, so continuous governance should track when they are created, used, and retired.
👉 Read our full editorial: The IGA maturity curve: from reviews to continuous assurance