Topic starter
16/01/2026 4:38 pm
TL;DR: Access requests are still one of the most error-prone parts of the identity lifecycle, with 73.9% of organisations reporting employees retain access they do not need and more than half admitting to overly permissive accounts, according to Fabrix Security. Turning approvals into a traceable control matters because audit evidence, least privilege, and SoD all depend on decision lineage, not just ticket closure.
Editorial analysis by NHI Mgmt Group, based on content published by Fabrix Security: “Turning Access Requests into an Audit-Ready Control”.
By the numbers:
- 73.9% of organisations say employees still hold access they do not need.
Key questions
Q: Where does an access-request workflow fail when it is used only as a ticketing process?
A: It fails when the organisation cannot reconstruct who requested access, who approved it, what rationale was used and whether the resulting entitlement matched policy.
Q: Why do access approvals need more than a manager’s sign-off?
A: A manager’s sign-off is only useful when it is tied to policy context, risk scoring and segregation-of-duties checks.
Q: How do security teams know whether approved access is still justified?
A: They need to compare the approved entitlement with actual usage, then review access that is unused, excessive or inconsistent with the original business case.
Practitioner guidance
- Formalise request-to-revocation evidence chains Ensure every access request captures requester identity, business justification, approver rationale, entitlement granted and eventual revocation in one traceable record.
- Add risk scoring to approval workflows Use entitlement context, peer access patterns and SoD checks to flag risky requests before provisioning, rather than after audit findings appear.
- Tie approvals to usage validation Compare granted access with real activity so unused or stale entitlements can be reviewed before they become permanent exceptions.
Bottom line: Access requests become weak controls when approvals are detached from policy context, risk scoring and later usage.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 9:12 pm
Access requests have become a control surface, not an admin task: The article reflects a broader shift in IAM governance, where the approval path itself must stand up as evidence. When access requests are treated as workflow noise, organisations lose the ability to prove entitlement rationale, SoD review and offboarding integrity. The practitioner conclusion is that the request record must be designed for audit from the start.
A question worth separating out:
Q: What should auditors look for in an access-request control?
A: They should look for a record that shows the requester, the approver, the business reason, the policy decision and the provisioning outcome in one place. If any of those elements are missing, the organisation is relying on evidence fragments rather than a control that can be independently reconstructed.
👉 Read our full editorial: Access requests as an audit-ready control for IAM governance