What breaks when access changes are handled manually during M&A?

Why manual access changes slow M&A integration

During mergers and acquisitions, access often has to change faster than org charts, application ownership, and manager reporting lines can be reconciled. Manual handling turns that moving target into a queue. Each request needs human interpretation, approvals, and follow-up, so the process slows exactly when the business is trying to stabilise operations and give people access to the systems they need.

That delay is not just an inconvenience. It creates a mismatch between business reality and system reality, where new teams exist on paper but still cannot work effectively in the tools they have just inherited. In practice, the slower the access change process, the more friction builds up across onboarding, system consolidation, and day-one productivity after close.

Where manual processing breaks consistency and accountability

Manual access changes rarely fail in one dramatic way. They fail through variation, because different approvers interpret the same role differently, different service-desk agents apply different standards, and different teams update entitlements at different speeds. The result is uneven access across similar users, duplicated effort, and a growing gap between what the business thinks was granted and what was actually applied.

Accountability also gets diluted when the process depends on tickets, emails, spreadsheets, and ad hoc decisions. If nobody owns the full lifecycle from request to revocation, it becomes difficult to prove who approved what, when the change happened, and whether the old access was removed after the new one was added. That is especially important in NHI Mgmt Group’s Ultimate Guide to NHIs, which covers lifecycle, governance, and offboarding patterns that become more brittle when access is managed by hand.

Manual processing also scales poorly when inherited application estates include service accounts, API keys, and shared operational credentials. The same post-close churn that affects human users often leaves machine-facing access untouched, which is where outdated permissions can persist longest. For a deeper view of the access and lifecycle failure modes that typically appear in these environments, see Ultimate Guide to NHIs, Key Challenges and Risks.

What practitioners should prioritise during M&A access transition

When access changes are manual, the main question is not whether the process is slower. It is whether the delay is creating business downtime or leaving permissions in a state that nobody can reliably audit. Practitioners should prioritise the systems that control revenue, customer support, finance, and privileged operations first, then treat low-value, low-risk access as a later cleanup exercise.

What to verify: Confirm that every access change has a clear owner, a timestamped approval path, and a matching revocation step for the old entitlement. If the organisation cannot show that sequence on demand, the process is already too opaque to trust during an acquisition.

Common mistake: Treating the goal as “move requests faster” instead of “reduce the number of handoffs and exceptions.” Speed without standardisation simply makes bad access decisions happen faster, while the real control objective is to reduce variation and make entitlement changes repeatable.

Where access is being merged across platforms, the strongest external reference point is CIS Controls v8, especially the account management and access control themes that support disciplined entitlement changes, and NIST SP 800-207 Zero Trust Architecture, which reinforces continuous policy decisions instead of static trust inherited from legacy structures. For organisations that want a more identity-specific reference, OWASP Non-Human Identity Top 10 is a useful companion for the machine-credential side of the same lifecycle problem.

Risk and Threat Considerations

Manual access handling during M&A increases the chance that excess privilege survives longer than it should, especially when inherited entitlements are copied forward instead of revalidated. That creates a larger attack surface, weaker visibility into who can reach what, and more opportunity for an old account, token, or service credential to remain usable after the organisation has changed around it.

Failure mechanism: Access changes are processed slower than organisational change, so obsolete privileges persist, approvals become stale, and revocation gets deferred behind higher-priority integration work.

Impact: The business can end up with unnecessary standing access, confused ownership, and a wider window for misuse, whether the issue is accidental overprovisioning or deliberate abuse of leftover permissions.

Practitioner Guidance

Decision rule: If the access change affects privileged functions, customer data, finance, or production systems, do not rely on manual ticket handling alone. Require a verified owner, a defined revocation point, and an auditable record that the old access was removed before the change is closed.

What to measure: Track request turnaround time, failed or reopened access tickets, and the percentage of post-merger entitlements that still need reconciliation after the first cutover window. Those signals tell you whether the process is stabilising or just accumulating unresolved access debt.

Practitioner takeaway: In M&A, manual access handling is risky because delay and inconsistency compound each other, so the control objective is to make access changes both fast enough for integration and strict enough to keep stale privilege from surviving the transition.

Related resources from NHI Mgmt Group

• What breaks when badge and access changes are handled manually in enterprise environments?
• What breaks when vendor access reviews are handled manually at scale?
• What breaks when database access is handled manually?
• What breaks when access onboarding and termination are handled manually for SOC 2?