What breaks when organisations rely on access reviews to handle movers?

Why This Matters for Security Teams

Access reviews are useful for spotting drift, but they are not a mover control. When an employee changes role, project, or team, entitlement sprawl often begins before the next review cycle. That means the organisation is relying on detection to compensate for missed revocation, which leaves a window where old access still works. NHI Mgmt Group notes that only 20% of organisations have formal processes for offboarding and revoking API keys, a sign that lifecycle control is still weak even where governance exists.

This is why access review programs frequently give a false sense of control. They confirm what is already true, but they do not enforce what should have happened at the moment of movement. The problem is especially visible in hybrid environments where access is spread across SaaS, cloud IAM, local groups, and application-specific permissions. Current guidance from the OWASP Non-Human Identity Top 10 treats weak lifecycle governance as a core identity risk, not a reporting issue. In practice, many security teams discover stale access only after a mover has already accumulated unnecessary permissions across multiple systems.

For broader lifecycle context, the Ultimate Guide to NHIs and the NHI Lifecycle Management Guide both reinforce the same operational point: lifecycle controls must remove or rebind access at the source, not merely record it later.

How It Works in Practice

The practical failure usually starts with identity being treated as a static attribute instead of a lifecycle state. When a mover changes job function, the correct response is to revoke access that no longer matches the new role, then reissue only what is still required. Reviews should validate that the mover workflow worked, not act as the workflow itself. For human users, this typically means tying joiner, mover, and leaver events into HR and IAM triggers. For NHIs, it means lifecycle automation around service accounts, tokens, and API keys so the old context cannot linger.

Good practice usually combines three controls:

• Automated revocation on role change, so stale entitlements are removed immediately.
• Time-bound reapproval for exceptions, so leftover access does not persist indefinitely.
• Evidence-based reviews, so reviewers confirm the access model rather than reconstruct it manually.

This is also where visibility matters. If an organisation cannot reliably inventory what a mover already has, review teams end up approving access they cannot fully assess. That is one reason the 52 NHI Breaches Analysis remains useful: it shows how often failures are not about a single bad decision, but about poor lifecycle enforcement across multiple systems. NHI Mgmt Group also reports that 97% of NHIs carry excessive privileges, which is exactly the kind of condition that mover workflows should shrink, not preserve.

In well-run environments, access reviews are the backstop. They catch missed removals, validate exceptions, and create audit evidence. They do not replace event-driven deprovisioning, and they cannot close the gap between a job change and the next quarterly certifying cycle. These controls tend to break down when access is granted directly in applications outside the central IAM path because revocation cannot be triggered consistently.

Common Variations and Edge Cases

Tighter mover controls often increase operational overhead, requiring organisations to balance speed of job change against the risk of overprovisioning. That tradeoff is real, especially in large enterprises where access is granted by multiple business owners, not just central IAM. The standard answer also changes when the mover is a contractor, a privileged administrator, or a non-human workload with delegated ownership. In those cases, the access review may still be necessary, but it becomes a compliance checkpoint rather than the control that fixes the issue.

There is also no universal standard for how often mover access should be revalidated after automatic revocation. Best practice is evolving, but most guidance points toward immediate revocation plus targeted reapproval for exceptions, rather than waiting for periodic certification. That approach aligns with OWASP Non-Human Identity Top 10 and the NHI lifecycle emphasis in the Ultimate Guide to NHIs.

Edge cases appear when entitlements are inherited through nested groups, shared accounts, or embedded secrets inside automation pipelines. In those environments, reviews can miss the real blast radius because the visible permission is not the only permission in play. The safest interpretation is simple: mover reviews are a control for assurance, not a substitute for deprovisioning.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on point-in-time access reviews for cloud identities?
• What breaks when organisations rely on quarterly access reviews?
• What breaks when organisations rely on periodic access reviews for AI systems?
• What breaks when organisations rely only on periodic access reviews?