Topic starter
08/07/2026 6:55 pm
TL;DR: Mid-sized companies are still relying on scripts, spreadsheets, and manager approvals to run access reviews, leaving audit evidence fragmented and risky, according to OpenIAM. Manual workforce IAM does not just slow compliance cycles, it preserves standing access, hides excessive privileges, and turns every audit into a governance stress test.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “Workforce Identity & Access Management for Mid-Sized Companies | Simplify Compliance”.
Key questions
Q: What breaks when workforce IAM reviews are run from spreadsheets?
A: Spreadsheet-based reviews break when the organisation cannot prove that access data, approvals, and revocations came from the same controlled process.
Q: Why do manual user access reviews create compliance risk?
A: Manual reviews create compliance risk because they depend on exports, spreadsheets, and human follow-up to prove that access was correctly evaluated and removed.
Q: How do security teams know whether enterprise IAM is actually working?
A: They should look for evidence that entitlements are narrow, short-lived, and fully traceable.
Practitioner guidance
- Replace spreadsheet-led certifications Move access reviews to a governed workflow that pulls entitlements from source systems, preserves reviewer decisions, and maintains a complete audit trail for employee, contractor, and privileged access.
- Tie reviews to entitlement changes Trigger recertification when roles, departments, or vendor relationships change so that standing access does not survive beyond the business need that created it.
- Enforce least privilege by default Review high-risk roles first and remove unused administrative entitlements before the next audit cycle, rather than waiting for annual certification to expose them.
Bottom line: Manual workforce IAM creates a compliance problem because review decisions, evidence, and revocation are often separated across scripts, spreadsheets, and email threads.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:17 pm
Manual workforce compliance is a governance design problem, not a documentation problem. Scripts and spreadsheets can collect data, but they do not create trustworthy control evidence on their own. When approvals, revocations, and review history are assembled by hand, the organisation is trying to prove a live access model with stale artefacts. The practical conclusion is that governance quality depends on whether access state and evidence are generated by the same system of record.
A question worth separating out:
Q: What is the difference between access certification and access revocation?
A: Access certification is the decision to keep or remove access, while revocation is the technical action that removes it. A programme that stops at certification has only completed half the control. Mature IAM processes connect the two so an approval or denial is automatically reflected in the target system.
👉 Read our full editorial: Workforce IAM compliance gaps are the hidden risk for mid-sized firms