What breaks when boards rely on spreadsheet based access reviews instead of automated controls for Provision 29?

Why Spreadsheet Reviews Fail as Board Evidence

Spreadsheet based access reviews create a point in time record, but Provision 29 style oversight depends on evidence that access was governed, checked, and corrected as part of a controlled process. Boards are not just asking whether someone looked at entitlements once; they need confidence that exceptions were tracked, approvals were attributable, and remediation was not left to informal follow-up. Manual spreadsheets make those assurances fragile because they are easy to copy, edit, circulate, and lose context. In practice, many organisations discover the weakness only after they are asked to reconstruct who approved what, when the exception was closed, and whether conflicting access was actually removed.

For a board, that gap matters because the control claim becomes difficult to defend if the supporting record can be altered without traceability. NIST’s control guidance on NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it emphasises that access governance depends on repeatable, auditable control operation rather than ad hoc tracking.

What Automated Controls Add Beyond a Spreadsheet

Automated access review controls do more than replace manual effort. They create a governed workflow where identities, entitlements, approvers, exceptions, and remediation events are linked in a consistent sequence. That linkage matters because access review is not only a question of who signed off, but whether the review covered the right population, whether conflicting access was visible in time, and whether follow-up action was actually completed. A spreadsheet can record a decision; an automated control can also record the path that produced it.

In practical terms, automation strengthens four areas:

• Traceability: each review, decision, and closure step can be tied to a timestamped record.
• Consistency: the same criteria can be applied across teams, systems, and review cycles.
• Exception handling: approvals, expiries, and overrides can be tracked rather than buried in email threads.
• Assurance: control owners can show that the process operated continuously, not only at quarter end.

That does not mean automation is perfect. It still depends on clean entitlement data, correct role definitions, and well governed exceptions. If the source of truth is incomplete or review scopes are wrong, the workflow can create a neat audit trail around a bad input set. OWASP’s OWASP Non-Human Identity Top 10 is especially relevant when spreadsheet reviews are being used to track service accounts, API keys, or other non-human access paths, because those assets tend to be numerous, fast changing, and easy to miss in manual processes.

Automation also changes the control conversation with auditors and executives. Instead of asking whether the spreadsheet was updated, they can ask whether the review engine enforced completion, preserved evidence, and escalated overdue remediation. That is a materially stronger control story for boards that must rely on internal control assertions.

Where the Spreadsheet Model Breaks Down in Real Governance

Tighter access review discipline often increases operational overhead, requiring organisations to balance simplicity against evidential strength.

The spreadsheet model breaks down in edge cases that matter most to governance. Temporary exceptions can linger because the file shows a note but not an enforced expiry. Shared mailboxes, delegated admin rights, and non-human credentials can be missed because the reviewer focuses on named users rather than effective access. Reconciliation also becomes unreliable when multiple spreadsheets exist for different business units, each with its own format and review cadence.

Where there is consensus, the main weakness is evidential, not procedural: a spreadsheet can support a review activity, but it is weak as control evidence when the organisation must prove completeness, timeliness, and closure. Where practice is less settled, some teams still use spreadsheets as a transitional register for low-risk populations. That can be acceptable only if the organisation can prove change control, version integrity, and independent follow-up. Without those safeguards, the spreadsheet stops being a review tool and becomes a record of human memory. The control fails most visibly when a board asks for proof that exceptions were handled on time and the only answer is a file with manually updated cells.

Risk and Threat Considerations

The material risk is not just administrative inefficiency. Spreadsheet based access reviews can leave excessive access, conflicting access, and unremediated exceptions in place longer than intended, which increases exposure to misuse, fraud, and audit challenge. The same weakness applies when boards rely on the spreadsheet as evidence that a control operated effectively across the review period.

Failure mechanism: Manual review files depend on human accuracy, version discipline, and follow-up outside the tool. That creates gaps in completeness, weak segregation between reviewer and subject, and poor detection of stale or duplicated access. If the file is edited, copied, or reissued without strong change tracking, the organisation can no longer prove what was reviewed, what was accepted, and what was actually removed.

Impact: Unauthorised or excessive access can persist, remediation can be delayed, and control attestations can become difficult to defend. In a board setting, that weakens confidence in internal control statements and can turn a routine access review into a governance and disclosure problem.

Practitioner Guidance

What to verify: Boards should ask whether the review process can produce an immutable record of scope, reviewer, decision, exception, and closure for every access item, not just a signed spreadsheet. If the answer relies on manual follow-up, the control is evidence-light even if the review itself happened.

Common mistake: Treating a completed spreadsheet as equivalent to a completed control. The spreadsheet is only persuasive when it is backed by enforced workflow, consistent entitlement data, and time stamped remediation evidence.

What good looks like: The control owner can show a complete chain from entitlement listing to reviewer action to removal or justified exception, with overdue items escalated automatically and exceptions reviewed against a defined expiry. That is the level of evidence a board can defend under scrutiny.

Practitioner takeaway: If a board cannot reconstruct control operation from the system of record without manual interpretation, the review process is likely functioning as administration, not as defensible governance.

Related resources from NHI Mgmt Group

• What breaks when access reviews rely on memory instead of ownership data?
• What breaks when user access reviews stay spreadsheet-based?
• What breaks when identity teams rely on one-off access reviews instead of scheduled reporting?
• What breaks when organisations rely only on access-based controls to catch insider threats?