What breaks when identity governance still relies on spreadsheets?

Why This Matters for Security Teams

When identity governance still depends on spreadsheets, the control plane becomes a reporting artifact instead of an enforcement mechanism. Access reviews may look complete on paper while stale entitlements, orphaned accounts, and over-privileged NHI access remain unchanged. That gap is especially dangerous in environments where secrets, API keys, service accounts, and AI-driven workflows move faster than monthly review cycles. NHI Management Group’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives highlights how auditability depends on lifecycle controls, not static lists, and the NIST Cybersecurity Framework 2.0 reinforces that governance must be repeatable, timely, and measurable. Spreadsheet-led reviews usually fail because ownership, approval, and remediation live in separate places, so no single record proves that risk was actually reduced. In practice, many security teams discover this only after an audit exception, a privilege abuse event, or a downstream incident has already exposed the gap.

How It Works in Practice

The operational failure is not the spreadsheet itself, but the false assumption that a spreadsheet can function as a source of truth for identity decisions. In a healthy process, governance should answer four questions at once: who has access, why they have it, who approved it, and whether that access was removed when it was no longer needed. Spreadsheets rarely keep those answers in sync, especially when identities span cloud platforms, SaaS apps, CI/CD systems, and machine accounts. A more defensible workflow ties review to the authoritative system of record and uses the spreadsheet, if one exists at all, only as a temporary tracking view. Better practice is to automate reconciliation between the review artifact and the identity platform, then confirm remediation through logs or policy evidence. For NHIs, that means tracking credentials, token scope, rotation status, and ownership alongside the identity itself. The Ultimate Guide to NHIs and Top 10 NHI Issues both point to the same practical reality: lifecycle control is where governance succeeds or fails. NIST CSF 2.0 also aligns with this approach by emphasizing traceable control execution rather than manual documentation alone. Common implementation steps include:

• Link every access review item to a live identity record, not a copied export.
• Require a remediation owner and due date for every finding before the review closes.
• Automate removal, rotation, or downgrade of access where possible.
• Preserve evidence of approval, execution, and verification in one audit trail.

These controls tend to break down when there are many shadow systems, ad hoc service accounts, or unmanaged API keys because the spreadsheet cannot reliably detect drift between review time and enforcement time.

Common Variations and Edge Cases

Tighter governance often increases operational overhead, requiring organisations to balance audit simplicity against the cost of manual reconciliation. That tradeoff becomes sharper in hybrid estates, where some identities are human, some are NHIs, and some are automation accounts owned by different teams with different renewal cycles. Best practice is evolving, but current guidance suggests that when ownership is unclear, spreadsheet reviews should be treated as a temporary control, not a compensating control. A second edge case is executive reporting. Spreadsheets can create a reassuring summary even when the underlying access graph is messy, which is why confidence in the process can outrun actual control maturity. NHI Management Group’s research on the State of Non-Human Identity Security shows how organisations still struggle with visibility, rotation, and over-privilege, all of which are easy to hide in manual trackers. The operational lesson is simple: if the review outcome cannot trigger and verify change in the source system, it is not governance. In large, fast-changing environments with frequent cloud changes or high volumes of service accounts, spreadsheet-based processes usually collapse under stale data and slow remediation.

Related resources from NHI Mgmt Group

• What breaks when identity governance relies on spreadsheets and email approvals?
• What breaks when SOX controls do not include identity governance?
• Why do inactive SaaS accounts still matter in identity governance?
• What breaks when SaaS governance relies only on CASB visibility?