In short
- Reviewers approve in bulk when they cannot tell what an entitlement grants
- A decision is only defensible against a point-in-time snapshot of the access
- Revocation must be tracked to completion, not to decision
- Campaign scope should follow risk, not the calendar
Access certification is one of the most commonly performed and least effective controls in a GRC programme. A spreadsheet goes out, managers approve everything on it, the spreadsheet comes back, and the control is marked effective. The exercise consumed real effort and produced no assurance whatsoever.
Why reviewers approve everything
It is rarely negligence. A line manager receives a list of role names and system identifiers with no indication of what those roles permit. They do not know whether removing one would break the person's ability to work. The safe action, from their position, is to approve.
Fixing this is a content problem before it is a process problem. The reviewer needs, per item: what the entitlement actually permits in business terms, when it was granted, when it was last used, and how it compares to peers in the same role. Given that, review becomes a real decision. Without it, the outcome is predetermined.
Snapshots make decisions defensible
Access changes continuously. If a review decision points at a live record, then by the time anyone examines it, the record has moved on. The reviewer approved something, but there is no way to establish what.
Each review item needs to carry a point-in-time snapshot of the access as it existed when presented. That snapshot is what makes the decision auditable: it establishes precisely what was approved, by whom, on what date, on the basis of what information.
Remediation is where reviews fail
The most common breakdown is not in the review itself but afterwards. A reviewer marks fifteen entitlements for removal. That decision goes to an operations team as an email. Some are actioned, some are not, and nobody reconciles the difference.
A revocation decision has to be tracked as an action with an owner and a completion state, and the campaign should not close until every revocation is either completed or explicitly and visibly overridden. Otherwise the control is decision-making theatre — the review happened, the access remained.
Practical improvements, in order of impact
- Add plain-language descriptions of what each entitlement permits — this alone changes approval behaviour
- Include last-used data so dormant access becomes visible without analysis
- Snapshot the access presented, and bind the decision to the snapshot
- Track revocations to completion and hold the campaign open until they are done
- Escalate incomplete reviews to the reviewer's manager on a defined schedule
- Use secondary reviewers and delegation so absence does not stall a campaign
- Report on approval rate per reviewer — a reviewer approving one hundred per cent of items every cycle is a signal, not a success
Done properly, access review is one of the few controls that produces genuinely useful security outcomes as well as audit evidence. Done as a spreadsheet exercise, it produces neither.
Related practices
