Access reviews fail because the review only covers what the IGA platform can see, so material entitlements in out-of-scope systems remain unexamined. That leaves orphaned accounts, excessive privileges, and toxic combinations outside certification, which weakens the joiner, mover and leaver process and makes attestation incomplete even when the formal review is signed off.
Why out-of-scope applications break certification accuracy
Access reviews only produce a trustworthy result when the review population matches the real entitlement surface. If key business applications, infrastructure accounts, or delegated access paths sit outside the review boundary, the certifier is signing off on a partial inventory, not on actual access. The process looks complete, but the organisation has not actually validated who can do what.
That gap is usually hidden until an audit, incident, or operational dispute exposes it. The problem is not only missing data, it is that the review model itself becomes structurally biased toward systems the IGA platform already knows how to ingest.
When the certification scope is too narrow, the strongest signal is often not a failed review but a false sense of closure. Orphaned accounts, excessive rights, and conflicting entitlements can persist in the excluded estate while the formal campaign still records approval.
How scope gaps weaken joiner, mover and leaver control
Scope gaps disrupt the control chain behind joiner, mover and leaver because access changes may be created in one system and governed in another. A user can be removed from the HR-driven workflow, yet still retain access in an application that was never onboarded to review, leaving the revocation path incomplete.
This is especially damaging where application-local roles, service-linked access, or indirect entitlements create permissions that do not look obvious in the IGA console. In practice, the review asks the wrong question if it only asks whether the governed directory looks clean.
The result is a certification process that measures administrative coverage rather than actual access risk. Reviewers may approve a low-risk record set while the material privileges remain concentrated in the out-of-scope layer, which is exactly where toxic combinations tend to hide.
Why scope management matters more than the review campaign itself
The underlying issue is entitlement discovery, not reviewer discipline. If the organisation cannot reliably inventory where access is granted, inherited, delegated, or shadowed by application-specific controls, then the review will always be behind the environment it is supposed to govern.
This is why out-of-scope systems should be treated as a governance defect, not a reporting inconvenience. The certification output is only as strong as the weakest entitlement source, and that includes legacy platforms, SaaS tools, local admin paths, and machine-facing access that never enters the review feed.
For that reason, access review design should start with scope completeness, then evidence quality, then reviewer workload. If those three are reversed, the programme optimises for throughput and sign-off speed instead of actual risk reduction.
Risk and Threat Considerations
Unreviewed systems create a persistent exposure layer because access can accumulate outside normal certification, especially where teams assume the IGA platform is the system of record. That makes it easier for dormant, inherited, or overprivileged access to survive long after it should have been removed.
Failure mechanism: A partial scope leaves some entitlements unexamined, so revocation, recertification, and segregation checks never reach the full access estate. The control then fails by omission, not by visible error, which is why the organisation may still pass the review workflow while remaining exposed.
Impact: Orphaned access, excessive privilege, and hidden separation-of-duties conflicts can persist in production systems, increasing the chance of unauthorized activity, audit findings, and delayed containment if an account is misused.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Access reviews depend on complete account and entitlement inventory. |
| Recommendation — Inventory all accounts and entitlements before you certify them. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Incomplete scope leaves accounts and privileges outside normal lifecycle control. |
| AC-6 — Least Privilege | Out-of-scope entitlements preserve excessive access and privilege creep. | |
| Recommendation — Include every application account in periodic review and removal. Remove privileges that are not required for current business need. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access Rights | Certification failure here is fundamentally a failure to govern access rights across all systems. |
| Recommendation — Review and revoke access rights across the full application estate. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Orphaned accounts and missed revocation are the same lifecycle failure at scope boundaries. |
| Recommendation — Ensure offboarding removes access from every connected system. | ||
Practitioner Guidance
What to verify: Confirm that every business-critical application has a named owner, an ingest path into the review process, and a clear rule for how local entitlements are represented. If a system cannot be certified, it should be treated as an explicit exception with compensating monitoring rather than assumed to be low risk.
What to prioritise: Reconcile the access review population against the application inventory, not just the directory. Focus first on the systems that can create privileged, inherited, or indirect access, because those are the places where certification blind spots become material fastest.
Practitioner takeaway: A successful review is not one that is signed off, it is one that actually covers the entitlement sources that matter; if scope is incomplete, the certification result should be treated as partial assurance, not control effectiveness.
Related resources from NHI Mgmt Group
- Guide: Access Reviews and Certification Guide
- Why do identity security programmes often fail when access reviews focus only on applications and not on the data being reached?
- Why do access reviews often fail in large organisations?
- Why do user access reviews fail in mature IAM programmes?
- Why do access reviews often fail to reduce audit findings?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org