What breaks when identity programmes only track reviews and tickets?

When the programme measures activity instead of exposure

The problem is not that reviews and tickets are useless, it is that they are process outputs, not risk outcomes. A programme can close thousands of tickets and still leave the same privileged paths intact if it never checks whether access was actually reduced, constrained, or made harder to abuse. That is why the board can be shown motion without being shown control.

Once identity work is treated as evidence only at the workflow layer, teams optimise for closure speed, not for a smaller blast radius. The result is often a clean audit trail around unchanged administrative reach, stale entitlements, or duplicated access across systems that were never validated as removed.

Identity programmes that need to prove more than paperwork usually have to connect review activity to lifecycle control, including offboarding, privilege reduction, and ownership of access decisions. NHIMG’s Identity Security Programme Guide frames that operating model around scope, governance, and measurable outcomes rather than isolated review events.

What is actually left unchanged when you only count tickets

Ticket volume does not tell you whether access was already over-provisioned, whether a reviewer approved from habit, or whether a lower-risk role still carries hidden lateral reach. In practice, the dangerous residue is often administrative reach that survives in a second platform, a stale account that remains active after the ticket closes, or a shared control path no reviewer saw because the evidence was incomplete.

That is why programme design has to follow the identity lifecycle, not just the review cadence. If access is provisioned, changed, and withdrawn without reliable discovery and ownership, then the review process becomes a record of human intervention rather than a guarantee that privilege actually shrank. NHIMG’s NHI Lifecycle Management Guide is useful here because it ties provisioning, rotation, and offboarding to visibility and recertification.

A second issue is that closure metrics tend to flatten different risk types into the same “done” state. A routine low-risk recertification and a high-risk administrative entitlement both produce closed tickets, but only one materially changes exposure if the underlying privilege is unchanged. That is why outcome-focused identity governance asks what was removed, what was constrained, and what still exists after the workflow finishes.

What strong identity governance has to prove instead

Strong programmes validate state, not just intent. They should be able to show that standing privilege has been reduced, that stale or orphaned access has been removed, and that administrative routes have been narrowed in the systems where they matter. If the only durable evidence is a signed ticket, the programme may be auditable but not necessarily safer.

The practical test is whether the result is observable outside the ticketing tool. Can you verify that the account was disabled, the role was removed, the entitlement disappeared, or the privileged path no longer works? If not, you have governance activity without assurance. NHIMG’s Top 10 NHI Issues and the Regulatory and Audit Perspectives section both reinforce that access evidence has to stand up beyond the paperwork layer.

For mature programmes, the main question shifts from “Were reviews completed?” to “What exposure measurably declined?” That means measuring remaining privileged reach, residual dormant access, and whether entitlement sprawl has been reduced across the full environment. Without that, the programme can satisfy workflow controls while leaving the attack surface effectively unchanged.

Risk and Threat Considerations

When reviews and tickets are treated as the end state, the main risk is false assurance: controls appear healthy while exploitable access remains in place. Attackers and internal abusers benefit from exactly that gap, because a completed review can hide an account that was never removed, a privilege that was never narrowed, or an administrative route that still works across platforms.

Failure mechanism: The control measures human process completion instead of live access state, so stale privilege, excessive permissions, and cross-platform administrative reach remain exploitable even after closure.

Impact: The organisation may understate exposure to auditors, management, and the board, while still retaining the access paths that enable lateral movement, privilege abuse, or delayed containment.

Practitioner Guidance

What to verify: Require proof that a completed review changed the environment state, not just the ticket record. The useful evidence is a post-action access check, role diff, entitlement removal, or deprovisioning result that can be re-verified independently.

What to prioritise: Start with privileges that create broad administrative reach, shared access paths, and long-lived or inactive access. Those are the places where a “reviewed” ticket is least likely to mean “reduced risk.”

Common mistake: Treating closure rate as the success metric. A fast programme that does not shrink access can look operationally efficient while leaving the same exposure in place.

Practitioner takeaway: The programme is only credible when it can show that access state changed, because governance evidence without state change is documentation, not risk reduction.

Related resources from NHI Mgmt Group

• What breaks when identity programmes rely only on periodic governance reviews?
• What breaks when identity programmes only track permissions and not actual usage?
• How should security teams run access reviews for non-human identities?
• When does a machine identity become a compliance problem?