Why do on-demand access reviews reduce identity risk better than quarterly recertification?

Why event-tied reviews outperform fixed-cycle recertification

On-demand reviews work because identity risk changes when the business or technical event changes, not when the calendar says it should. A mover, leaver, role change, emergency elevation, or suspicious access pattern can make yesterday’s approval obsolete today. Event-tied certification keeps the decision aligned to current context, so reviewers judge the access that exists now, not a stale snapshot.

This is especially important for organisations that want access reviews and certification to function as a control rather than a paperwork exercise. Quarterly recertification tends to compress too many unrelated changes into one campaign, which encourages bulk approval, missed exceptions, and weak accountability for who actually owns the access decision.

Where quarterly recertification tends to fail

Quarterly cycles create avoidable drift. Access can stay in place long after the original need has ended, especially when people change teams, leave projects, or receive temporary privilege that never gets removed. The longer the interval, the more likely the reviewer is looking at an entitlement that no longer matches the operational reality.

That drift is why lifecycle controls matter alongside certification. Joiner-Mover-Leaver governance and identity lifecycle management reduce the amount of stale access that reaches a review cycle in the first place. When lifecycle events are handled late, the recertification process becomes the backstop for problems that should already have been removed.

Quarterly review also makes it easier for risk to hide in plain sight. Shared access, standing privilege, and dormant entitlements are more likely to survive when reviewers are asked to validate large lists without a recent trigger. For teams that need broader context on those failure patterns, IAM and IGA basics provides the foundation for how access governance should connect provisioning, reviews, and entitlement ownership.

What on-demand review changes in practice

Event-driven review narrows the decision to the access change that matters. Instead of asking whether an entitlement was ever reasonable in some past state, the reviewer can ask whether it is still justified after the specific event that altered exposure. That improves accuracy for movers, temporary administrators, anomalous access, and cases where an application, role, or workflow changed the person’s effective permissions.

It also improves remediation speed. If a privileged assignment is tied to a ticket, incident, or workflow change, the review can remove access while the reason for the access is still visible to the owner and the approver. In practice, that makes the control more usable than a batch campaign because it reduces reviewer fatigue and makes exception handling more specific.

For organisations that need to manage the decision boundary more tightly, the same principle appears in privileged access management: access should be reviewed when it is most likely to create meaningful exposure, not after the risk has already decayed into an old audit record.

Risk and Threat Considerations

Long review intervals increase the window in which excessive privilege, dormant access, or compromised accounts can remain active without challenge. That is not just an administrative weakness, it creates a real opportunity for privilege creep, abuse after role change, and delayed detection of access that no longer matches the business need.

Failure mechanism: The review happens after the relevant event has been forgotten, so reviewers approve access based on stale context or incomplete ownership, allowing unnecessary permissions to persist.

Impact: Excess access survives longer, blast radius grows, and compromised or misused identities have more time to operate before the organisation corrects the entitlement.

Practitioner Guidance

What to prioritise: Trigger reviews from events that actually change risk, such as mover actions, role elevation, privilege grants, contractor extensions, and anomalous usage. If the review trigger cannot be tied to a concrete change, it is probably too abstract to improve decision quality.

What to verify: Confirm that the approver sees the reason for access, the current owner, and the expiry or removal path in the same workflow. A review is only valuable if the reviewer can tell whether the entitlement is still needed at the moment they approve it.

Common mistake: Treating on-demand review as a lighter version of quarterly recertification. The point is not simply to review more often, it is to review at the moment when the entitlement’s legitimacy is most testable.

Practitioner takeaway: The strongest access review control is the one that is closest to the risk change, because timeliness improves judgement more than campaign size ever will.

Related resources from NHI Mgmt Group

• Why do access reviews often fail to reduce identity risk?
• Why do periodic access reviews fail to reduce identity risk in real environments?
• Why do quarterly access reviews miss identity risk?
• How should security teams run access reviews for non-human identities?