Topic starter
08/07/2026 6:56 pm
TL;DR: Quarterly access reviews validate access at a point in time, but role changes create hidden exposure between cycles as old entitlements persist, new privileges are added, and access drift builds, according to OpenIAM. Calendar-based governance can prove oversight without reflecting the real-time access posture of internal mobility.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “How Role Changes Between Quarterly Access Reviews Create Hidden Risk”.
Key questions
Q: What breaks when access reviews do not keep pace with role changes?
A: When reviews lag behind role changes, stale permissions survive longer than the job that justified them.
Q: Why do role changes create so much access creep?
A: Role changes create access creep because organisations are faster at adding new access than removing old access.
Q: How can IAM teams detect access drift after internal mobility?
A: Look for users whose current role does not explain all active entitlements, especially after promotions, transfers, or project assignments.
Practitioner guidance
- Tie role changes to entitlement removal Trigger deprovisioning and re-approval workflows when a user changes role, not only when a review campaign opens.
Bottom line: Role changes between reviews create hidden IAM exposure because old access can stay active while new access is granted.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:18 pm
Role-change access risk is an entitlement lifecycle problem, not a review-frequency problem. The article shows that quarterly certification can be completed exactly as designed while exposure still increases the same day a person changes roles. That means the control is validating governance activity, not the actual state of authority. Practitioners should read this as a lifecycle timing failure: access change events happen continuously, but review evidence arrives on a schedule.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: When should organisations move from fixed access review cycles to event-based reviews?
A: They should do it when role churn, contractor turnover, or privilege changes happen more often than a quarterly or annual cycle can reflect. Event-based reviews are better for access that changes with business activity, while fixed cycles are acceptable only for low-risk, stable entitlements.
👉 Read our full editorial: Role changes between access reviews create hidden IAM risk