Access reviews are among the most widely implemented identity controls and among the least trusted. Reviewers receive long lists of users and entitlements, approve most of them, and return to their work. Auditors see a completed campaign. Very little access is actually removed.
The problem is rarely the tooling. It is the design of the review itself: who is asked, what they are shown, and what happens after they answer.
Ask the person who can actually judge
A manager can usually confirm that someone still works on their team. They are often poorly placed to judge whether that person still needs a specific database role or administrative group. Effective programs separate these questions. Managers attest to employment and role; resource owners attest to access to the systems they are accountable for.
Show context, not just names
A reviewer presented with an entitlement name and a user name has little to go on. The same reviewer shown when the access was granted, when it was last used, and whether it is privileged can make a real decision in seconds. Usage data in particular turns a review from memory into evidence.
Prioritize privilege
Not all access carries the same risk. Privileged roles, access to sensitive data, and accounts that bypass normal authentication controls deserve more frequent and more rigorous review than standard application access. Concentrating reviewer attention where the risk is highest improves both the quality of decisions and the willingness of reviewers to take part.
Close the loop
A review is only a control if its decisions are carried out. Revocations should be applied automatically or tracked to completion, exceptions should have owners and expiry dates, and the results of each campaign should be measured: how much access was removed, how much was unused, and how long remediation took.
Identity as accountability
In a Zero Trust model, identity is the basis for every access decision. That makes identity governance more than administrative housekeeping. Well-designed access reviews give leaders a clear answer to a simple question that is often hard to answer: who can reach our most important systems, and who decided they should?