What breaks when organisations manage disconnected apps with spreadsheets and ticket-based workflows?

Why This Matters for Security Teams

Spreadsheet-driven access management looks manageable until the environment grows beyond a few applications. At that point, disconnected records, delayed approvals, and manual reconciliation stop being administrative annoyances and become security defects. The core problem is not just speed; it is that ticket queues and spreadsheets do not preserve a trustworthy, real-time view of who has access, why it was granted, and when it should be removed.

That gap matters most for non-human identities, where access often outlives the team that created it. NHI Mgmt Group notes that only 5.7% of organisations have full visibility into their service accounts in the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs, which explains why governance drifts so quickly when records live in separate files and ticket trails. The issue also shows up in broader identity programs, where the NIST Cybersecurity Framework 2.0 expects repeatable, measurable access control outcomes rather than ad hoc administration. In practice, many security teams discover stale access only after an audit request, a failed offboarding, or an incident review exposes the gap.

How It Works in Practice

Manual workflows break down because identity governance depends on synchronized lifecycle events. A joiner event should trigger access assignment, a mover event should adjust scope, and a leaver event should revoke access quickly and completely. Spreadsheets can record those events, but they cannot enforce them. Tickets can document intent, but they rarely provide the closed-loop assurance needed to confirm that the change actually happened across every application, directory, vault, and API endpoint.

For disconnected apps, the failure pattern is usually the same: each team maintains its own copy of access truth, then reconciles later. That creates lag, duplicate records, and blind spots. For NHIs, the risk is sharper because credentials may be embedded in code, automation, or CI/CD workflows. The Top 10 NHI Issues highlights how frequently organisations lose control of those identities, and the NHI Lifecycle Management Guide reinforces the need for discovery, ownership, rotation, and offboarding as linked controls, not separate tasks.

Operationally, stronger programs replace spreadsheet-only administration with authoritative sources, workflow automation, and periodic reconciliation. A practical model is to map each application to an owner, define a system of record for access decisions, and require evidence of completion for provisioning and revocation. Where service accounts are involved, teams should also track secret location, rotation status, and last-use date, because static records tend to miss dormant access that still remains valid. These controls tend to break down when apps lack APIs or when ownership is split across business units because there is no dependable way to verify completion at scale.

Common Variations and Edge Cases

Tighter access control often increases operational overhead, so organisations must balance governance strength against the friction of change management. That tradeoff becomes visible in merger activity, legacy platform estates, and application portfolios where some systems support automation while others require manual intervention.

Current guidance suggests the answer is not to eliminate tickets entirely, but to limit them to exception handling and attach them to a stronger control plane. For example, spreadsheets may still be useful as a temporary inventory during a cleanup effort, but they are too fragile to serve as the source of truth. In hybrid environments, teams often need compensating controls such as scheduled recertification, owner attestations, and reconciliation reports. For NHI-heavy environments, the Ultimate Guide to NHIs — Regulatory and Audit Perspectives is a useful reminder that auditors look for evidence of repeatability, not informal assurances, especially when access revocation depends on humans noticing a change.

The practical edge case is local autonomy. Some organisations cannot centralise everything immediately because business units depend on niche tools or external integrations. In those cases, best practice is evolving toward minimum standards for inventory accuracy, owner assignment, and revocation timing, even if the execution path differs by application. That reduces audit friction without pretending every system can be automated on day one.

Related resources from NHI Mgmt Group

• What breaks when organisations launch AI systems without formal risk assessment and approval workflows?
• What breaks when organisations rely on policies and application bans to control unmanageable apps?
• What breaks when enterprise apps add AI-driven workflows without integrating identity and permissions early?
• What breaks when organisations cannot continuously inventory non-human access across apps and repositories?