Look for high approval rates, delayed revocation, repeated reviewer confusion, and evidence that findings are being documented but not removed. When the process produces clean records but weak entitlement cleanup, it is functioning as paperwork rather than governance.
Why access reviews start looking like theatre
Access reviews drift into theatre when the workflow still produces approvals, comments, and evidence packets, but those outputs no longer change who can actually do what. The signal is not that the review exists, it is that the review no longer drives entitlement decisions, so the process optimises for traceability instead of reduction in access.
That usually happens when reviewers are asked to approve long, low-context lists, when decisions are based on role names rather than actual entitlement risk, or when remediation sits outside the review workflow and quietly accumulates backlog. At that point, the review becomes a control costume, not a control outcome.
In practice, the warning signs are repetitive approval patterns, weak challenge rates, and evidence that the same excess access survives campaign after campaign. If the organisation can show completion but cannot show meaningful cleanup, the process has stopped governing access and started documenting it.
What the broken workflow looks like in day-to-day evidence
Look first at the shape of the decisions, not the volume of completed campaigns. High approval rates across unrelated teams, identical reviewer choices every cycle, and very few exceptions are strong clues that reviewers are not assessing current need. Access Reviews and Certification Guide is useful here because the failure mode is often a weak campaign design, not a single bad reviewer.
Next, compare review records with actual entitlement state after the campaign closes. If findings are documented but revocation is delayed, partial, or never confirmed, the organisation is preserving evidence of scrutiny without enforcing the result. That gap is especially visible when managers sign off on access they do not understand, or when ownership is unclear and nobody is accountable for removing access.
Finally, check whether the review is still connected to lifecycle hygiene. Reviews should surface stale access, dormant entitlements, and privileges that no longer match the job or system role. IAM and IGA Basics frames this correctly: access reviews are one governance control inside a broader identity lifecycle, not a standalone compliance event.
How to tell governance from paperwork
A real review changes entitlement state, reduces risk, and leaves a measurable cleanup trail. Paperwork leaves a completed campaign and not much else. The clearest distinction is whether review findings consistently trigger revocation, role correction, or escalation for ambiguous ownership.
It also helps to separate access review from role design. If the same entitlements keep appearing in every campaign, the organisation may be compensating for poor role structure with repeated manual approval. Role Mining and Role Design Guide matters because recurring review noise often means the underlying access model is too coarse, too bloated, or too poorly maintained to review efficiently.
When access decisions involve privileged, shared, or machine-oriented accounts, the review must show more than a named approver. Privileged Access Management Guide is relevant because privileged access needs stronger evidence of justification, shorter review cycles, and tighter closure, otherwise the campaign simply rubber-stamps elevated access.
Risk and Threat Considerations
When access reviews become theatre, the organisation loses a key control over excessive privilege, dormant access, and unauthorized persistence. The risk is not only audit weakness, but real exposure that accumulates when people keep access they no longer need and no one removes it.
Failure mechanism: Reviewers approve without context, remediation is delayed or hand-waved, and entitlement changes do not feed back into the access model. Over time, the review process validates the appearance of governance while leaving excessive access intact.
Impact: Stale or overbroad access can support insider misuse, account takeover follow-on activity, and privilege creep across applications and shared platforms. It also weakens audit defensibility because evidence of review no longer aligns with evidence of control effectiveness.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Access reviews directly support account and entitlement lifecycle control. |
| AC-6 — Least Privilege | The question is about excess access surviving review cycles. | |
| AU-2 — Event Logging | Audit theatre often leaves records without effective remediation evidence. | |
| Recommendation — Tie reviews to account removal, role correction, and timely deprovisioning. Use review outcomes to reduce standing privilege and unnecessary entitlement. Retain review and remediation records that prove access changes were executed. | ||
| CIS Controls v8 | 5 — Account Management | CIS account management covers lifecycle review of accounts and access. |
| Recommendation — Validate that access reviews trigger timely account and entitlement cleanup. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | The issue is whether access rights are reviewed and actually removed when no longer needed. |
| Recommendation — Review access rights on schedule and confirm revocation is completed. | ||
Practitioner Guidance
What to verify: Test whether every review cycle produces confirmed removals, not just approvals. If you cannot trace a sample of findings to closed remediation, the campaign is not proving governance.
Common mistake: Treating approval completion as the control objective. The control objective is access reduction, so a clean audit trail with weak cleanup should be treated as a control failure, not a successful campaign.
What good looks like: Reviewers see enough context to challenge access, unresolved exceptions are escalated quickly, and post-campaign reporting shows measurable reduction in excess entitlement, not merely percentage completion.
Practitioner takeaway: Access reviews are credible only when they change access state; if the process mostly changes spreadsheets and status reports, it is theatre, not governance.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 8, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org