Topic starter
25/06/2026 1:16 am
TL;DR: SAP Access Control user access reviews automate scheduling, delegation, approvals, removals, and audit trails to validate that users still need assigned permissions, according to Pathlock. The core governance issue is not the workflow itself but whether review design, role modelling, and data quality are strong enough to prevent stale or excessive access from surviving the cycle.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “Guide to SAP (GRC) Access Control’s User Access Review”.
Key questions
Q: What breaks when user access reviews are not in place?
A: Privilege creep, orphaned access, and weak accountability are the first things to break.
Q: Why do periodic access reviews miss the risks this article describes?
A: Periodic reviews miss fast-moving risk because they evaluate access after the fact, often long after the triggering condition has changed.
Q: How should IAM teams choose between business roles and technical roles in certification?
A: Use business roles when reviewers can judge access by job function, and use technical roles when the control requires entitlement-level precision.
Practitioner guidance
- Tighten campaign scope to current source data Run repository and HR synchronization before each certification cycle so the request set reflects current users, roles, and managers rather than stale assignments.
- Use role granularity that matches the reviewer decision Assign business roles where managers can certify job-function access, and reserve technical-role detail for reviews that require entitlement-level validation.
- Add admin review before reviewer assignment Validate the generated request list for wrong managers, duplicate entries, and missing owners before the workflow reaches the approval stage.
Bottom line: SAP access review workflows can standardise certification, but they do not by themselves guarantee that the right access is being reviewed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:34 am
Manual certification is not the control, the decision quality is. The article makes clear that workflow automation can standardise routing, logging, and escalation, but those mechanics do not guarantee governance value. If the reviewer receives the wrong scope, or if the role model masks excessive access, the process still completes while the risk survives. That means certification programmes should be judged on access quality outcomes, not on how smoothly the workflow runs.
A question worth separating out:
Q: How do security teams know whether certificate-based access is actually working?
A: They test the failure path, not just the happy path. A valid control should deny access when the revocation responder is unavailable, the certificate is revoked, or the listener is misconfigured. If those cases still permit access, the boundary is not enforcing policy reliably.
👉 Read our full editorial: SAP access review workflows expose the limits of manual certification