Quarterly Access Reviews Are Broken: What to Do Instead
Quarterly access reviews pass the audit but leave the risk in place. What replaces them: automatic offboarding, role drift checks and live SoD rules.
Loading...
Quarterly access reviews pass the audit but leave the risk in place. What replaces them: automatic offboarding, role drift checks and live SoD rules.
What AI-driven security solutions really do: alert triage, behavior-based detection, risk ranking and automated response, and how to test the AI claims.
The quarterly access review exists because auditors asked for it, not because it works. Every 90 days your team pulls a spreadsheet and sends it to, say, 200 managers. Then it waits three weeks for answers, chases the 40% who never reply, and certifies that access is appropriate. The auditor checks the box and the risk stays where it was.
I call this ceremonial security. It feels like governance and it produces paperwork, but a contractor you let go can still have VPN access, and a developer promoted six months ago can still write to a production database they no longer need. Your company changes faster than a quarterly cycle can follow, so a better spreadsheet or a faster cycle won't help much.
What helps is getting clear on what access governance has to achieve and then building controls that run all the time instead of once a quarter. You'll need different products for that, and you'll have to talk to your auditors and your board about it in a new way.
See every Access Governance solution we list
The full Access Governance market, filtered by company size, deployment and NIST coverage.
A large company adds or changes access rights every day, as people join, move and leave. So a 90-day window means you're signing off on a snapshot that was already out of date before the review started, and by the time managers click approve, the role behind it may have changed twice.
Asking managers to certify makes it worse. Most managers don't know what a given system permission means, so all they see is a name, a system and a checkbox. They approve, because saying no creates a support ticket they don't want. So you end up with a control that meets the compliance requirement while barely reducing any risk.
Before you redesign the process, be clear about what you're trying to prevent, because access governance covers three different risks. Orphaned accounts belong to employees or contractors who left but still have working credentials. Privilege creep is when current employees pick up new permissions over time and never lose the old ones. And toxic combinations are pairs of rights that break segregation of duties (SoD), such as being able to both create and approve a payment.
You find and fix each of these in a different way, and the quarterly review fails partly because it treats them as one problem a spreadsheet can solve. When someone leaves, for example, their account should be disabled within hours, and a quarterly cycle can't do that.
Orphaned accounts are the easiest of the three to automate. Your HR system knows when someone leaves, and your identity provider knows which accounts are active, so the risk lives in the gap between the two. That gap should close in real time, and the setup for it is simple.
A termination in HR starts a workflow that disables the account in your identity provider, ends the SSO sessions, and queues a review of any service accounts or shared credentials that person knew. None of this is new, and most mature identity governance and administration (IGA) platforms support it, so what usually holds companies back is integration work and willpower rather than technology.
Once it's running, you can tell your auditors that orphaned accounts are handled continuously, with evidence the system produces on its own. That's a stronger control than a quarterly review, and it's easier to defend in an audit because the evidence doesn't depend on managers answering emails.
Privilege creep is harder, because you have to know what access people should have and not only what they do have. That takes role engineering, which is slow, unglamorous work that most security programs push down the list because it never shows up on a dashboard.
You don't need a full role model to start. Pick your highest-risk systems, such as production databases, finance applications, identity infrastructure and cloud management consoles. For each one, define a small number of roles with clear limits, and make those roles the only way to get access.
Once the roles exist, you can check for drift all the time. Any permission that falls outside a defined role gets flagged automatically, which gives you a much smaller and sharper review queue than a full certification. For example, instead of signing off 2,000 permissions a quarter, your analysts might look at 40 flagged items a week.
SoD violations cause the most expensive failures of all access risks. One employee who can both start and approve a wire transfer is a fraud risk that no quarterly review reliably catches, because you can't see the problem in a simple list of permissions. You only see it when you look at combinations of rights across systems.
This is where a purpose-built IGA platform earns its price. It keeps a list of banned combinations and flags a violation the moment the access is granted, so the control fires at provisioning instead of 90 days later.
Your SoD rules don't have to be complete on day one. Start with the combinations your external auditors or your finance team have already called high-risk, automate those, and add more as you learn to trust the detection.
Not everything about the quarterly review is worthless. The fixed rhythm forces conversations that would otherwise never happen, but they happen with the wrong people, about the wrong things, and too often.
So keep a periodic review and change what it asks. Instead of asking managers to certify single permissions, ask application owners to confirm that their role definitions are still right. An owner who knows the system can tell you if the "Finance Analyst" role still makes sense, while a manager can't tell you if one specific database permission is appropriate.
Run that role certification once a year. Pair it with a quarterly review where your identity analysts go through the drift alerts and close what's flagged. Together, that covers the fast-moving risks continuously and the structural questions on a schedule.
If you run access reviews in spreadsheets or a basic ticketing system, you're doing by hand what should be automated. The question is whether you need a full IGA platform or can build the capability from separate products.
Full IGA platforms from vendors like SailPoint, Saviynt or Omada give you provisioning, certification, role management and SoD detection in one place. The cost is real: rollout is a long project, and the licenses aren't cheap. In return, automated certification cuts much of the manual labor of access reviews.
Separate products can work if your environment is simpler. A strong identity provider with good joiner and leaver automation, combined with a SIEM that spots unusual access, covers a large part of the risk. What it usually misses is SoD detection and formal role management, so know what you're giving up before you decide that's enough.
You can compare IGA platforms and other access governance products in the CybersecTools catalog of 9,168 security products and build your shortlist before you talk to vendors.
Your board doesn't care about permission counts or certification completion rates. It cares whether the company is exposed to fraud, a regulatory penalty, or a breach from an insider or a stolen login, so put your access metrics in those terms. These are the ones that work with boards and audit committees:
Each of these tells a risk story your board already understands, because it ties access governance to fraud prevention, compliance and insider threat. For more on this, see the security metrics your board cares about.
Compare Access Governance solutions side by side
Features, integrations, NIST coverage and deployment for every Access Governance solution we list, in one table.
The quarterly access review isn't going away completely. Auditors will keep asking for it, and some kind of periodic check will always make sense. But using it as your main access control leaves real risk unmanaged and eats a lot of your analysts' time.
Moving to automatic offboarding, role drift checks and SoD rules that fire at provisioning isn't a future plan, because today's products can already do it. The companies that have made the move spend less time on access reviews and carry less real risk. Start with the gap that hurts most, build up the evidence, and use it to fund the next step. That's how you get from ceremonial security to security that works.
Check a vendor before you sign
Mandos tracks funding, acquisitions, hiring and news for security companies. Look up any vendor on your shortlist before the renewal.
Most frameworks, including SOC 2, ISO 27001 and PCI DSS, require periodic access reviews but don't require quarterly spreadsheet campaigns. What they require is a control that shows access is appropriate and reviewed. Automated controls with documented evidence often satisfy auditors better than manual quarterly sign-offs, so talk to your auditor before you assume the process is fixed.
For a mid-market company (100 to 999 employees), IGA licenses are priced by user count and modules. Implementation adds a professional services bill on top. Get both in writing before you build the business case.
The case rests on three numbers: what your manual review costs in labor today, the regulatory penalty you face if an access control audit fails, and what a privilege abuse incident would cost in fraud or breach. Put real numbers on all three before you ask for budget.
Start with the risk that hurts most, which is orphaned accounts of people who have left. That's a single integration between your HR system and your identity provider, and you can build it in weeks rather than months. Once it runs with automatic evidence, it replaces the most urgent part of your quarterly review, and you can build from there instead of trying to solve everything at once.
More reminders won't do it. Change what you ask them instead, because managers rubber-stamp permission lists they don't understand. Ask whether a person still needs access to a system at all, which is a question they can answer.
Then add accountability. Make it clear that their sign-off is a business attestation and not an IT formality, and that access incidents will be traced back to the manager who signed.
Present it as a step up in control maturity rather than a process change. You're moving from a control that finds access problems every 90 days to one that finds them as they happen. Show the metrics, meaning mean time to deprovision, orphaned account count and SoD violation rate, because boards respond to risk measured in time and exposure.
Legacy systems that can't integrate are a real limit, and pretending otherwise gives false confidence. For those systems, keep a manual review but scope it tightly. Review only the highest-privilege accounts, review them more often than quarterly, and write the limitation into your risk register. You can defend that position, which you can't say about certifying 2,000 permissions in a system you can't automate.