Automating User Access Reviews Fixes the Half Auditors Do Not Fail You On

Vendor pages for this term sell much the same promise: replace spreadsheets and email chains with automated campaigns, cut review effort dramatically, stay continuously audit-ready.

The effort claim is largely true. The audit claim is where it gets loose — because the stages automation removes are not the stages reviews fail on.

What automating user access reviews actually removes

A certification campaign has six stages. Automation covers two outright, helps with two, and barely touches the other two.

1. 1

   Define the population

   Decide which accounts, in which systems, are in scope — and prove the list is complete against a source of truth.

   Automation: Pulls entitlements from connected systems. It cannot tell you about the system nobody connected.

2. 2

   Map each account to a reviewer

   Every line needs someone accountable who is not the account holder and does not report to them.

   Automation: Resolves managers from the HR feed reliably. Service accounts have no manager, so they need an owner attribute that usually does not exist yet.

3. 3

   Distribute and chase

   Send, remind, escalate, track completion.

   Automation: Solved outright. This is most of the hours and none of the risk.

4. 4

   Decide

   The reviewer judges whether each entitlement is still warranted.

   Automation: Nothing automates judgement. Tools surface context — last login, peer comparison, risk score — which measurably improves it.

5. 5

   Revoke

   Execute the removals the reviewer decided on, in the target system.

   Automation: Closes this properly where it has write access. Where it only reads, a revocation is a ticket, and tickets age.

6. 6

   Evidence

   The immutable record: who reviewed what, when, what changed, and what the population was.

   Automation: Solved outright, and a genuine quality gain over a workbook.

Stages three and six are the ones automation solves completely. They are also, in the campaigns we have reviewed, the ones least likely to have produced a finding on their own. The value is real and it is operational more than evidential.

The findings automation does not close

You are probably automating a cadence nobody asked for

Quarterly access reviews are treated as a given. They are a given in almost no instrument.

Committing to quarterly manufactures exception risk. In a SOC 2 Type 2 examination the practitioner establishes the complete population of occurrences and samples from it — commonly two of four for a quarterly control, one for an annual one. Sampling is not where this bites. Completeness is: a quarter that never ran is a missing occurrence whether or not it falls in the sample. Four campaigns a year is four chances to create one; one is one. Annual reviews that always happen beat quarterly reviews that happen three times.

Two caveats before you lower anything. A prescribed floor still binds — PCI DSS 7.2.4 is six months for user accounts regardless of your policy — and customer contracts and due-diligence questionnaires routinely commit you to quarterly independently of any framework. A cadence already described in a current or prior SOC 2 report is not changed unilaterally either: talk to your service auditor first.

The OSFI claim is worth checking. Vendor material routinely asserts that OSFI B-13 requires quarterly privileged access reviews. B-13 §3.2.7 calls for regular attestation of access and sets no interval. If a Canadian cadence sits in your policy on that basis, the basis is not in the guideline.

What the tool categories actually do

Three distinct categories are sold against this search term, and the mismatch between them is where budget gets wasted.

Compliance automation platforms — Vanta, Drata and peers — run the campaign and produce an evidence pack mapped to a framework. Strongest when your systems are mainstream SaaS with good integrations and the goal is a clean SOC 2 or ISO 27001 report; weakest on bespoke internal applications, which is frequently where the risky entitlements live.

Access graph and SaaS governance tools — Lumos, Zluri, Veza — discover entitlements across a wide application estate and resolve what access actually grants. The strongest answer to the population problem, which is the finding that matters most.

IGA platforms — SailPoint, Saviynt — govern the whole lifecycle: provisioning, roles, segregation of duties, with certification as one part. They solve the largest problem and carry the largest implementation. Buying IGA to fix a review campaign is a common and expensive mismatch; buying a campaign tool when provisioning has no controls is the same mistake reversed.

Your native identity provider may cover more than you think, though not for free. Entra ID access reviews require Entra ID P2 or Entra ID Governance — not the P1 most Microsoft 365 E3 tenants hold — and Okta’s access certification sits in Okta Identity Governance, an add-on to Workforce Identity. Check which tier you hold. For an estate centred on one identity provider the uplift is usually below a dedicated tool, which makes it a proportionate starting point rather than a compromise.

What to fix before you automate

1. 1

   Reconcile the population against a source of truth

   1–2 weeks

   Join every account list to HR for staff and to an owner record for service accounts, and resolve what does not match. The residue — accounts belonging to nobody — is your first finding and your first real remediation. Automating before this automates an incomplete list.

2. 2

   Give service accounts owners

   2–3 weeks

   A named person per account, not a team mailbox. Without this attribute every automated campaign silently excludes the largest population in your environment, because the tool has nobody to route the line to.

3. 3

   Set cadence from the clause, not from habit

   2 days

   Commit to the lowest defensible frequency for the long tail and a higher one for production and privileged access, then write that split into the control description so you are tested against what you intend to do.

4. 4

   Decide which systems get write access

   1 week

   A revocation that becomes a ticket may not happen. Map which target systems the tool can write to, and build an explicit tracked path for the rest before go-live rather than after the first finding.

5. 5

   Then automate, starting with the highest-volume system

   4–8 weeks

   Build the integration that removes the most manual hours first, and track revocation rate and time-per-decision from campaign one. A 100 per cent approval rate is a finding on paper or in a platform, and you want to see it before the auditor does.

When a workbook is still the right answer

The threshold is not headcount. It is the number of systems holding entitlements.

If your access lives in one identity provider, two or three connected SaaS applications and one production database, a scheduled export reconciled into a structured workbook — named reviewer per line, remediation column, completeness check against HR — satisfies what every instrument in the table above asks for.

The manual path stops working when entitlements live in more applications than one person can export and reconcile inside a review window. That is a completeness failure, not an effort failure, and it is the correct trigger to buy. Buying before it, to save hours, buys hours. Buying after it, to fix completeness, buys the control.

Where vaultIAM fits

Access certification is one of the ten categories we score, and the finding we write most often is not that a client lacks a tool. It is that the population was never proven, so the campaign — automated or not — certified an incomplete list very efficiently.

We do the reconciliation first, give the machine accounts owners, and set the cadence against the clause that actually binds you. The automation decision is straightforward after that, because by then you know exactly what you would be automating.

This is not legal advice and vaultIAM is not your auditor. Clause texts were read in Sep ‘26; confirm your own obligations, and any change to a committed review cadence, with your counsel and your service auditor.