How should organisations stop IAM reviews from becoming compliance theatre?

How to make access reviews decision-quality instead of box-ticking

Access reviews fail when they ask reviewers to rubber-stamp long entitlement lists without enough context to judge risk. The right test is not whether a certification closed, but whether the reviewer had enough signal to remove inappropriate access, challenge stale ownership, and force a real decision on exceptions.

That means the review package has to surface business ownership, last-used access, entitlement age, privilege level, prior approvals, and known risk indicators in one place. If reviewers need to leave the workflow to understand what the access is for, the process is already drifting toward compliance theatre.

A useful review design also separates routine recertification from exception handling. Standard access should move quickly, while unusual, inherited, dormant, or high-impact access should demand explicit justification and escalation. That keeps the control focused on decisions that actually change exposure.

Why campaign metrics hide access risk

Counting completed certifications can look strong while leaving the underlying access model untouched. High completion rates tell you that people clicked through the workflow, not that the organisation removed excess privilege, corrected ownership gaps, or reduced repeat exceptions.

The deeper problem is that campaign-style metrics reward speed and volume over judgement. When reviewers are measured on throughput, they are more likely to approve what they do not understand, defer difficult cases, or rely on habit. That creates a false sense of control because the process is visible, but the entitlement risk remains.

Access reviews become more credible when they are tied to outcomes such as revoked unnecessary access, reduced stale entitlements, fewer recurring exceptions, and faster closure on unresolved ownership. In other words, the metric should reflect whether the review changed the access posture, not whether the workflow finished.

Practitioners should also watch for recertification fatigue. When the same access keeps reappearing with no decision context, reviewers stop treating the workflow as meaningful. At that point the review has become a reporting exercise rather than a governance control.

What a practical review model should include

The review should present the minimum context needed for a sound decision. That usually includes who owns the business process, why the access exists, whether it has been used recently, whether it is privileged, whether it spans environments or systems, and whether the entitlement has already been flagged before.

Good review design also distinguishes ownership from technical administration. A reviewer can only make a trustworthy decision when there is a clearly accountable business owner, not just a system owner or service desk queue. Where ownership is unclear, the review should not default to approval; it should trigger remediation of the record first.

The workflow should make it easy to remove access, not just approve it. If revocation is slow or manually complex, reviewers will rationalise keeping questionable access in place. The control works best when the decision and the enforcement step are tightly linked, so a rejection actually reduces exposure.

For broader identity governance context, NHIMG’s Ultimate Guide to NHIs, Lifecycle Processes for Managing NHIs shows why lifecycle visibility, ownership and deprovisioning discipline matter when access must be governed continuously. The same logic applies to workforce reviews: if the control cannot drive a lifecycle change, it is only documenting a decision.

Risk and Threat Considerations

When access reviews are shallow, the main risk is persistence of excessive privilege, dormant access, and unowned entitlements that no one feels accountable for removing. Over time, that creates a larger blast radius for misuse, accidental exposure, and insider or external abuse of privileged paths.

Failure mechanism: Reviewers approve access without enough context, the organisation treats completion as evidence of control, and inappropriate access survives repeated cycles because the workflow does not force a meaningful decision or cleanup.

Impact: Excess access becomes normalised, repeat exceptions accumulate, and the organisation loses both preventative value and audit credibility because the review no longer changes who can do what.

Practitioner Guidance

What to prioritise: Start with the entitlements that are most likely to create material exposure, privileged roles, dormant access, cross-environment access, inherited access, and access tied to unclear ownership. Those are the cases where reviewer judgement matters most and where weak workflows do the most damage.

What to verify: Confirm that every review item has enough business context for a yes, no, or escalate decision, and that rejected access is actually removed within the same control cycle. If the revocation path is slow, the review is not yet a reliable control.

What practitioners underestimate: The biggest failure is not a missed certification, but a certification process that teaches people to approve without deciding. A good access review is measured by reduced inappropriate access and fewer repeated exceptions, not by how many records were processed.

Practitioner takeaway: Treat access reviews as enforcement moments, not governance theatre, and design them so the easiest outcome is a defensible decision that changes actual access.

Related resources from NHI Mgmt Group

• How should organisations stop auto-sync from turning desktops into repositories of credentials?
• How should organisations stop access reviews from becoming a spreadsheet exercise?
• How should security teams govern non-human identities for compliance?
• How should security teams run access reviews for non-human identities?