What breaks when access review campaigns are not unified across core business applications?

Why This Matters for Security Teams

Fragmented access review campaigns break more than process discipline. They erode the integrity of entitlement data across ERP, CRM, finance, HR, and collaboration platforms, so reviewers cannot see whether the same identity still has overlapping access in multiple systems. That weakens segregation of duties, delays remediation, and makes audit evidence harder to defend. This is especially damaging for non-human identities, where service accounts and API keys often span business applications and are easy to miss without a unified inventory.

NHIMG research consistently shows that identity sprawl becomes operationally dangerous once access is distributed across disconnected control planes, as reflected in the Ultimate Guide to NHIs and the NHI Lifecycle Management Guide. The problem is not just administrative overhead. It is the loss of a consistent decision record that proves who approved what, when, and for which application boundary. Current guidance from OWASP Non-Human Identity Top 10 reinforces that unmanaged non-human access creates persistent exposure when reviews are not tied to a single authoritative source.

In practice, many security teams discover the drift only after an audit exception, an excessive access finding, or a privilege-related incident has already exposed the gap.

How It Works in Practice

Unified campaigns work best when access certification is treated as one control plane, not a series of application-specific spreadsheets. The practical goal is to collect entitlements, owners, usage data, and business context from each core application into a single review workflow, then route decisions back to each system with a consistent approval record. That approach reduces duplicate reviewer effort and makes it easier to spot patterns such as the same person holding incompatible roles across finance and procurement.

For NHI-heavy environments, the same discipline should apply to service principals, integration accounts, API keys, and automation identities. Reviews should distinguish between human access and machine access, because a dormant account in one application may still be actively used by an integration in another. The 52 NHI Breaches Analysis is a useful reminder that identity failures often cross application boundaries rather than remaining isolated to one system.

Operationally, security teams should align the campaign around a few core steps:

• Build one authoritative entitlement inventory across all in-scope business applications.
• Normalize ownership so every access item has a named reviewer and a business justification.
• Apply the same review logic for human and non-human identities, with separate decision paths where needed.
• Preserve evidence centrally so approvals, removals, and exceptions are traceable end to end.
• Use NIST SP 800-53 Rev 5 Security and Privacy Controls to map review activities to least privilege and access enforcement expectations.

Fragmentation also increases the chance that a stale entitlement survives because one application owner approved removal while another never received the request. The average remediation lag for exposed secrets reported in The State of Secrets in AppSec illustrates how slow coordination can become when control ownership is split across teams. These controls tend to break down in large enterprises with federated business units because local review calendars, inconsistent role definitions, and disconnected evidence stores prevent a single remediation queue.

Common Variations and Edge Cases

Tighter campaign centralisation often increases coordination overhead, requiring organisations to balance reviewer simplicity against application-owner autonomy. That tradeoff is real in federated environments where business units insist on separate cadences, different risk thresholds, or locally scoped approvals.

Current guidance suggests a hybrid model is often more workable: one governing campaign, but with application-specific review views and exception handling. That preserves the single source of truth without forcing every system into an identical operating rhythm. It also helps when some platforms expose rich usage telemetry while others provide only static entitlements. In those cases, the review outcome should reflect the quality of evidence available, rather than pretending each application can be assessed with the same depth.

Edge cases also matter for shared accounts, delegated administration, and automation identities tied to legacy platforms. Those identities may not map cleanly to a named employee, but they still require a reviewer, an owner, and a revocation path. Where business applications lack robust APIs, review campaigns can stall unless teams define export, attest, and revoke procedures upfront. The most reliable programmes anchor their operating model to the Ultimate Guide to NHIs and use access governance patterns that treat machine identities as first-class citizens, not exceptions.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on opaque business applications for access control and data protection?
• What is the difference between SAP access governance in core ERP and access governance across cloud business apps?
• What breaks when access review and compliance controls are not automated?
• What breaks when organisations do not review user access to SaaS data regularly?