Notifications
Clear all
Topic starter
12/06/2026 1:02 am
TL;DR: As access environments grow more complex, multi-level access reviews can reduce manual work, improve audit readiness, and strengthen accountability, according to Zluri. The deeper issue is that review cadence, remediation lag, and entitlement sprawl now create a governance gap that traditional certification workflows struggle to close.
NHIMG editorial — based on content published by Zluri: How to Simplify Audits with Multi-Level Access Reviews
By the numbers:
- 36% of companies describe this process as being extremely manual.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: How should IAM teams reduce manual work in access reviews without weakening control?
A: Automate the evidence collection, reviewer routing, and remediation handoff so people focus on decisions rather than administration.
Q: When does multi-level access review add value, and when does it become overhead?
A: It adds value when the access decision is genuinely ambiguous, privileged, or business critical, because extra reviewers can catch context that a single reviewer misses.
Q: What breaks when access review outcomes are not tied to revocation?
A: The control breaks at the point where governance ends and enforcement should begin.
Practitioner guidance
- Bind certification to revocation workflows Route denial decisions and privilege reductions directly into identity and access enforcement systems so reviewers are not left creating tickets that age out before action is taken.
- Use multi-level review for disputed or high-risk access only Reserve second-level approvers for privileged, exception, or cross-functional access cases where the added context changes the decision, not for every routine entitlement.
- Measure review-to-remediation latency Track the time between access review completion and actual entitlement change, then treat slow closure as a governance defect rather than a reporting issue.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step campaign setup for multi-level access reviews across users, applications, and entitlements
- How the platform assigns first-level and second-level reviewers and handles delegated review actions
- Details of the auto-remediation flow that applies revoke or modify actions after approval decisions
- Examples of audit-ready report output for SOX, HIPAA, PCI DSS, and similar compliance work
👉 Read Zluri’s analysis of multi-level access reviews and audit simplification →
Multi-level access reviews: what IAM teams are missing?
Explore further
12/06/2026 10:41 am
Multi-level access review is a control against review fatigue, not a substitute for lifecycle governance. More approvers can improve decision quality, but they do not solve stale entitlements, missing offboarding, or delayed revocation. The discipline only works when it is tied to identity lifecycle controls and not treated as a standalone compliance ritual. Practitioners should judge it by how much access it actually removes, not by how many signatures it collects.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who is accountable when audit-ready access reports still leave standing access in place?
A: IAM and control owners remain accountable because a report is not the same as a revoked entitlement. Audit evidence shows that a review happened, but it does not prove that access was removed. Accountability sits with the team responsible for making review decisions operational, not just documentable.
👉 Read our full editorial: Multi-level access reviews reveal the audit gap in IAM
