Topic starter
06/11/2026 6:37 pm
TL;DR: User access reviews remain the primary control for catching role drift, orphaned access and lingering service account permissions, according to Serval analysis, but manual review cycles still struggle when provisioning, offboarding and remediation are disconnected. The real weakness is not review frequency alone, but the assumption that access decisions stay intelligible long enough to be reconstructed later.
Editorial analysis by NHI Mgmt Group, based on content published by Serval: “How to build an audit-proof user access review process”.
By the numbers:
- Frameworks including SOX, HIPAA, GDPR, ISO 27001, SOC 2, and PCI DSS require or support periodic reviews.
Key questions
Q: How should teams handle stale access found during user access reviews?
A: Teams should revoke stale access, confirm the business owner, and reissue only the entitlements still needed within a defined window.
Q: Why do access reviews miss orphaned service account permissions?
A: Access reviews miss orphaned service account permissions when the account has no clear owner, no current inventory record, or no documented service account's purpose.
Q: What is the difference between access certification and access revocation?
A: Access certification is the decision to keep or remove access, while revocation is the technical action that removes it.
Practitioner guidance
- Tighten review scope to current role and ownership Group entitlements by business role, system owner and risk tier before sending them to reviewers.
- Include service accounts in every review cycle Do not exclude machine and application accounts just because they are not tied to a person.
- Bind offboarding to access removal Trigger deprovisioning when a worker leaves, not at the next periodic review.
Bottom line: User access reviews are most useful when they expose entitlement drift that would otherwise remain hidden across role changes, leaver events and contractor offboarding.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
User access reviews are not the control failure point. They are the symptom detector for a provisioning and offboarding model that was already losing track of entitlement state. When reviews find stale access, the programme has already allowed access to outlive its justification. The deeper issue is that many organisations treat certification as the place where governance starts, when it should be the final checkpoint on a lifecycle that already knows who approved what and why.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: When does just-in-time access help more than traditional access review processes?
A: Just-in-time access helps most when organisations have too much standing privilege and too many repetitive certifications. It works by making access temporary and task-scoped, which lowers review volume and reduces exposure time. It is less useful if revocation is unreliable or if the organisation cannot operationally enforce the expiry.
👉 Read our full editorial: User access reviews expose where governance still breaks down