Topic starter
06/11/2026 6:39 pm
TL;DR: Manual access governance produces audit evidence without real control, according to READI, because spreadsheet-based reviews and ticket queues create artifacts that decay between cycles, while offboarding delays and scale turn a temporary workaround into hidden control debt. The governance assumption that documentation equals current authorization no longer holds.
Editorial analysis by NHI Mgmt Group, based on content published by READI: “The hidden cost of “good enough” governance.”.
Key questions
Q: How can security teams know whether access reviews are producing real control?
A: They should compare review outputs with live HR, IdP, and application state, then check whether drift keeps reappearing between cycles.
Q: Why do manual offboarding processes create identity risk?
A: Manual offboarding creates identity risk because it depends on people remembering every connected system and every entitlement path.
Q: How should I prioritise disconnected applications for identity governance?
A: Prioritise disconnected applications by identity risk, starting with systems that grant privileged access, hold sensitive data, or rely on exports, email approvals, and manual re-imports.
Practitioner guidance
- Classify manual governance as a control gap, not a process variant Separate applications that are merely reviewed from those whose access can actually be enforced, then rank them by business criticality and entitlement risk.
- Measure revocation latency by application Track the elapsed time between a leaver or role-change event and the actual removal of access, then use that lag to prioritise the worst manual workflows.
- Tie every certification to a live system change Require the review process to trigger or verify an actual entitlement update in the target system, not just a spreadsheet mark-off.
Bottom line: Manual access governance can satisfy audit expectations while still leaving access state uncontrolled in practice.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Manual governance creates control debt, not just operational friction: When access reviews rely on exported lists and human follow-up, the organisation accrues a gap between documented approval and live enforcement. That gap is survivable in a small estate, but it becomes structural as more applications stay disconnected from the identity stack. The practical consequence is that audit evidence grows faster than actual control.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between access approval and access control evidence?
A: Approval is a workflow event that says someone granted permission. Evidence is the structured record that proves the decision was justified, policy-aware, and traceable through provisioning and usage. In regulated environments, approval without evidence leaves too much ambiguity for auditors and weakens the organisation’s ability to defend least privilege.
👉 Read our full editorial: Manual access governance hides control debt at scale