"You have an access review process. You don't have access review controls."

That's what one financial services team heard from their PwC auditor during their SOC 2 examination. They had a beautiful quarterly access review process—96% completion rate, proper documentation, remediated findings within SLA.

Their audit report came back with an unqualified opinion (contrary to the name, that's actually a positive outcome—it means you passed the audit). But it included multiple exceptions.

(Exceptions are specific instances where controls didn't operate as intended—for example, a required quarterly review was missed, or access wasn't revoked within the defined timeframe. Even minor exceptions signal control gaps.)

Here's what the auditor found: Inappropriate access was granted during onboarding. Former employees retained access for weeks after termination. Admin privileges accumulated beyond role requirements.

The auditor's assessment: "Process compliance documented. Control effectiveness is insufficient."

Their quarterly access review process worked perfectly. The outcomes didn't. They had zero controls stopping inappropriate access from being granted, catching violations between reviews, or preventing the same failures from recurring.

Process without controls isn't governance. It's documentation without security improvement.

Process vs. Control: What Your Auditor Actually Means

Your auditor isn't being pedantic. The distinction determines whether your access reviews deliver security value or just documentation.

Most teams think they have identity and access governance. They don't. They have quarterly fire drills.

Here's the confusion: They think executing a process equals having controls. It doesn't.

Process = What you do
Controls = What prevents your process from failing

Your quarterly access review process says "managers certify their team's access." That's activity. But it doesn't prevent the manager from rubber-stamping everything without reading it. It doesn't detect violations between reviews. It doesn't fix the root cause making the same problems appear every quarter.

The process describes the race you're running. Controls are what prevent you from running off a cliff.

Here's the Gap Nobody Talks About

Your process statement:
"Managers review direct reports' access quarterly and certify appropriateness."

Sounds good. Describes what happens. Doesn't control anything.

The manager could approve everything in 30 seconds without reading details. The manager could miss the deadline entirely. The manager could certify access without understanding what the permissions actually do or whether they create security violations.

Your process statement doesn't prevent any of these failures. It just describes the ideal scenario where everyone behaves perfectly.

Control statements that actually prevent failures:

1. "Access provisioning system enforces access control policies preventing users from receiving access beyond role-defined permissions during onboarding."
2. "Automated monitoring flags users who haven't logged into applications for 90+ days, generating alerts for manager review between quarterly access reviews."
3. "Access review findings trigger root cause analysis within 30 days, with documented process improvements required before next quarterly review."

See the difference? Controls specify mechanisms that prevent failures, detect failures, and correct failures. They're testable. Measurable. Demonstrable to auditors.

Process describes the desired state. Controls ensure that state actually happens.

Think of it like highway safety:

Process = The rules of the road. Speed limits exist. Lane markings are painted.
Controls = Guardrails, speed cameras, automatic collision avoidance systems.

You can post all the speed limit signs you want. Without enforcement mechanisms, people will speed. The signs describe desired behavior. They don't prevent dangerous behavior.

Same with access reviews. Your process says "managers should review access quarterly." But without controls, managers rubber-stamp certifications, IT over-provisions during onboarding, and dormant access accumulates for months between reviews.

Controls enforce desired outcomes even when human judgment fails.

Here's what auditors actually evaluate: control effectiveness, not process compliance. Executing a process perfectly without controls means the process worked but outcomes failed. Implementing strong controls means outcomes succeed even when process execution has minor issues.

The Three Types of User Access Review Controls

Mature identity and access governance implements controls across three categories addressing different failure points in the access lifecycle.

Here are all 10 controls and what they do:

Preventive Controls (Stop Problems Before They Start):

Control 1: Access Control Policies - Define role baselines and birthright applications. This becomes the reference point for all other controls.

Control 2: Access Request Approval Workflows - Enforce baselines during provisioning. When someone requests access exceeding their role baseline, approval workflows require business justification and manager authorization.

Control 3: Time-Based Privileged Access - Make elevated access temporary by default. Production access granted for a one-time fix expires in 30 days instead of lasting forever.

Control 4: Automated Offboarding Workflows - Revoke all access when employees leave. HRIS termination triggers automatic revocation across every system—SSO apps, shadow IT, everything.

Detective Controls (Catch What Prevention Missed):

Control 5: Dormant Account Detection - Monitor whether access granted through approval workflows is actually used. If someone requested Salesforce, got approved, but never logged in for 90 days—dormant detection catches it.

Control 6: Orphaned Account Detection - Catch offboarding failures. When automated offboarding misses contractor accounts or service accounts lose their owners, orphaned detection flags them.

Control 7: Excessive Permission Alerts - Compare actual access against role baselines. When users accumulate 20%+ more permissions than baseline through multiple small requests over time, excessive permission alerts surface the pattern.

Corrective Controls (Ensure Improvement):

Control 8: Remediation SLA Enforcement - Ensure findings from detective controls get fixed fast. Privileged access revocations within 24 hours, standard access within 5 days.

Control 9: Findings Root Cause Analysis - Ask why detective controls keep finding the same problems. The analysis strengthens preventive controls based on real failure patterns.

Control 10: Audit Trail Integrity - Document that all other controls operated correctly. When auditors ask for proof, you show logs from approval workflows, detection systems, and remediation actions.

Preventive Controls Stop Problems Before They Occur

Preventive controls block inappropriate access from being granted initially, eliminating issues before access reviews need to discover them.

This is the highest maturity level. Organizations with strong preventive controls find fewer inappropriate access items during reviews because less inappropriate access gets granted. Reviews transition from discovering problems to validating that preventive controls work.

Control 1: Access Control Policies

What it prevents: Ad-hoc over-provisioning where IT grants excessive access "just to be safe."

You've heard it a thousand times: implement least privilege access. Use RBAC. Everyone knows this. Most teams have attempted it.

Want to know the real source of access violations? It's not hackers. It's the helpful IT admin.

Every provisioning team has the same practice: "When in doubt, add more access." Why? Because figuring out what someone actually needs takes time. Granting full access takes 30 seconds.

One provisioning team followed a simple rule: "Give new hires the same access their predecessor had." Over three years, the previous engineer's access had accumulated—basic dev tools, production read access for a bug fix, database credentials for a migration, elevated AWS permissions for an infrastructure project. Each addition made sense at the time. Nobody removed anything.

When the new engineer joined, they inherited everything. Six months later, that engineer had production database credentials they'd never used and didn't know existed.

Access control policies don't just block inappropriate access. They help you document what each role actually requires and give you visibility into gaps between policy and reality.

Compare documented policies against actual access. Where are they matching? Where are they deviating? Why do some roles have 30% more access than baseline? Once you see the gaps, you can fix them—update role definitions, remove unnecessary access, apply stricter policies to prevent future deviations.

How it works:

Define standard access control policies for each job role—whether RBAC, ABAC, or PBAC. New hires receive only role-appropriate access. Document requirements, analyze whether policies match reality, and where deviations occur, investigate root causes and apply stricter policies to prevent recurrence.

Access control policies define what access people should have by default—their birthright applications. But what happens when someone needs access beyond their baseline? That's where approval workflows come in.

Control 2: Access Request Approval Workflows

What it prevents: Informal access grants bypassing authorization.

A healthcare technology company had a problem. Their IT helpdesk had standing practice of granting "temporary access" over Slack to unblock urgent requests, with plans to "formalize it later."

Later never came.

When they finally implemented mandatory approval workflows, they found 23% of active access had no corresponding authorization. The Slack requests existed—"can you add me to the NetSuite vendor group?"—but no business justification, no manager approval, no expiration date. Just IT being helpful.

How it works:

All access requests route through a formal approval workflow requiring manager authorization and business justification before provisioning. IT cannot grant access without documented approval.

Eliminates the "John called and asked for Salesforce access so I added him" pattern. No Slack shortcuts. No verbal requests. No "emergency" exceptions without audit trail.

Approval workflows handle standard access requests, but some of these access carries higher risk—production systems, admin rights, sensitive data. These require special handling: time limits.

Control 3: Time-Based Privileged Access

What it prevents: Accumulation of privileged access granted for one-time need but never removed.

Here's the pattern: Production access gets granted for an urgent fix. Everyone intends to remove it afterward. Nobody does.

One enterprise software company audited their privileged access before implementing automatic expiration. They discovered 64% of privileged accounts were dormant—the one-time fixes happened months ago, but nobody had remembered to revoke the elevated access.

That visibility drove them to implement automatic expiration immediately.

How it works:

Privileged access—admin rights, production access—automatically expires after a defined period (30-90 days). Users must re-request with justification for extension. Standing indefinite privileges prohibited.

Instead of discovering during quarterly reviews that developers accumulated production database credentials they used once six months ago, the access automatically expires before it becomes a finding.

Policies, approvals, and time limits control access while people work at your company. But what happens when they leave? That's where automated offboarding becomes critical.

Control 4: Automated Offboarding Workflows

What it prevents: Departed employees retaining access weeks or months after termination.

One SaaS company found 47 former employees with active accounts during a quarterly review. 32 had been gone for over six months.

The fundamental problem: they relied on managers remembering to notify IT of terminations.

Managers forgot. Or they notified IT but forgot to mention the contractor accounts. Or they mentioned some systems but not others.

Automated offboarding eliminates human dependency. When HRIS marks someone terminated, access revokes automatically across every integrated system within 24 hours.

How it works:

HRIS termination event automatically triggers access revocation workflow across all systems. No human notification required. Access revoked within 24 hours of termination.

Preventive controls stop most inappropriate access at the source—during provisioning and offboarding. But they can't catch everything. Legitimate access granted today becomes inappropriate tomorrow when roles change, projects end, or people simply stop using applications. That's where detective controls take over.

Detective Controls Identify Problems Quickly

Detective controls continuously monitor for access violations, flagging issues between quarterly reviews rather than waiting months to discover problems.

You can't wait 90 days to discover dormant access. Traditional access reviews run quarterly, meaning inappropriate access could exist for up to 90 days before discovery. Detective controls reduce that exposure window dramatically.

Control 5: Dormant Account Detection

What it detects: Users who were granted access but never used it, or users whose job responsibilities changed making access unnecessary.

One B2B company provisioned both Salesforce and HubSpot licenses to their entire sales team during a CRM migration. The migration completed in 60 days. Six months later, they were still paying for both systems.

Dormant account detection flagged the unused HubSpot accounts within 60 days of migration completion instead of waiting for the next quarterly review. Turns out 80% of the sales team had never logged back into HubSpot after switching to Salesforce.

How it works:

Automated monitoring tracks the last login date for every user across all applications. Accounts with no activity for 60+ days flagged for manager review. Accounts with no activity for 90+ days auto-suspended.

Dormant accounts represent access that was granted but never used. But some accounts have a different problem—nobody can even confirm whether the access is appropriate because no one owns the account.

Control 6: Orphaned Account Detection

What it detects: Accounts that can't be properly reviewed during quarterly cycles because ownership is unclear.

One healthcare technology company discovered the pattern during their ISO audit. When auditors asked "who owns this account?" for 40% of active accounts, nobody could answer.

Contractor accounts accumulated indefinitely because contract end dates weren't tracked. Service accounts persisted because original owners left the company. Shared team accounts existed because "everyone uses them."

Orphaned account detection surfaces what standard reviews miss—accounts that technically exist in your systems but have no responsible party who can certify whether that access is still appropriate.

How it works:

Automated identification of accounts without assigned managers, service accounts without documented owners, or contractor accounts past contract end dates.

Dormant accounts show zero usage. Orphaned accounts have unclear ownership. But there's a third pattern: accounts that are actively used but have accumulated far more permissions than appropriate for the role.

Control 7: Excessive Permission Alerts

What it detects: Permission creep where users gradually accumulate elevated access through multiple small grants.

One enterprise software company discovered their recurring finding—"engineers with excessive production access"—came from exactly this pattern. Each individual grant seemed reasonable at the time. The cumulative effect created security gaps.

Users start with appropriate role-based access. Then they request one additional permission for a special project. Six months later, they requested another exception. A year later, they have 40% more privileges than their peers in the same role—and nobody remembers why.

Excessive permission alerts catch this creep while it's happening instead of discovering it during annual reviews.

How it works:

Baseline defined for standard permissions by role. System alerts when users receive permissions exceeding baseline. Tracks users accumulating more privileges than peers in the same role.

Detective controls identify three types of access problems: unused access, unowned access, and excessive access. But identifying problems isn't enough. The findings need to drive action—fast remediation and systematic improvement.

Corrective Controls: Fix Problems and Prevent Recurrence

Corrective controls ensure findings drive lasting improvements rather than just remediating immediate issues.

Control 8: Remediation SLA Enforcement

What it corrects: Delays between access review approval and actual revocation.

Here's the pattern we've seen dozens of times. Access review completes in week one. Findings get approved for remediation in week two. Remediation tickets get created in week three. Actual revocations happen in week six.

The finding was identified, but the inappropriate access persisted for another month. Why? Because nobody enforced remediation timing. IT had other priorities. The tickets sat in the backlog. Managers assumed IT would handle it.

Remediation SLAs with automated escalation collapse that timeline. Approvals flow directly to revocation actions. If SLA exceeds the threshold, escalations trigger automatically to ensure completion.

How it works:

Approved access revocations must be executed within defined SLA (24 hours for privileged, five days for standard). Automated escalation if SLA exceeded. Remediation tracked and reported.

Remediation SLAs ensure findings get fixed fast. But fixing individual findings isn't enough if the same problems keep appearing every quarter. That requires root cause analysis.

Control 9: Findings Root Cause Analysis

What it corrects: Recurring findings across multiple quarters.

One financial services company discovered the same finding recurring across four consecutive quarterly reviews: finance team members accumulating access to confidential compensation data they didn't need.

Each quarter, they revoked the inappropriate access. Each quarter, it reappeared.

Fourth quarter, they finally asked: why does this keep happening?

Root cause analysis revealed their standard practice during annual compensation reviews: temporarily grant all finance team members access to compensation systems, with plans to "remove it after the comp cycle ends." Nobody ever removed it. The temporary access became permanent by default.

Fixing the process—implementing automatic 30-day expiration for compensation system access—eliminated the recurring finding permanently.

That's corrective controls working. Not just fixing symptoms, but preventing recurrence.

How it works:

Access review findings categorized by type (dormant accounts, role changes, excessive permissions). Root causes identified. Process improvements required before the next review cycle.

Remediation SLAs fix findings fast. Root cause analysis prevents recurrence. But none of this matters if you can't prove to auditors that your controls actually work. That's where audit trails become essential.

Control 10: Audit Trail Integrity

What it corrects: Inability to demonstrate control effectiveness during audits.

One team described their audit preparation process: "We manually pull reports and send them to information owners for approval via email. Then we consolidate responses in Excel and hope we didn't miss anyone."

When auditors asked for evidence from 18 months ago, IT teams scrambled to reconstruct what happened from fragmented emails and spreadsheets. Half the evidence was lost.

Tamper-evident audit trails make evidence retrieval simple instead of archaeological. Every decision is captured automatically, retained indefinitely, exportable on demand. No spreadsheets. No missing evidence. No reconstruction.

How it works:

All access review decisions captured with timestamps, reviewer identity, and justification. Audit trails tamper-evident and retained per compliance requirements (seven years for SOX).

How These Controls Work Together

Now that you understand what each control does individually, here's how they interconnect to create a self-reinforcing governance framework.

The Logical Flow

These controls follow the access lifecycle from provisioning through monitoring to revocation:

Define appropriate access (Control 1: Access Control Policies) → Grant access properly (Control 2: Approval Workflows, Control 3: Time-Based Access) → Revoke access when needed (Control 4: Offboarding) → Monitor continuously (Control 5: Dormant Detection, Control 6: Orphaned Detection, Control 7: Excessive Permissions) → Fix problems fast (Control 8: Remediation SLA) → Learn and improve (Control 9: Root Cause Analysis) → Document everything (Control 10: Audit Trails).

Each control addresses a specific failure point. Access control policies (1) prevent over-provisioning during onboarding. Approval workflows (2) prevent informal grants bypassing authorization. Time-based access (3) prevents temporary privileges from becoming permanent. Automated offboarding (4) prevents departed employees from retaining access.

Detective controls catch what preventive controls miss. Dormant detection (5) identifies granted access that's never used. Orphaned detection (6) finds accounts with unclear ownership. Excessive permission alerts (7) catch gradual accumulation of elevated access.

Corrective controls ensure the system improves. Remediation SLA (8) ensures findings get fixed within defined timeframes. Root cause analysis (9) identifies why problems occur repeatedly and implements changes preventing recurrence. Audit trails (10) document that all controls operate correctly.

The Feedback Loop

The controls create reinforcing cycles where each control strengthens others:

Policy → Enforcement → Detection → Improvement → Policy

Access control policies (1) define baselines → Approval workflows (2) enforce baselines during provisioning → Excessive permission alerts (7) detect when users exceed baselines → Root cause analysis (9) identifies why baselines were exceeded → Policies get updated based on real patterns.

Temporary Access → Monitoring → Fast Remediation → Root Cause

Time-based access (3) grants temporary elevated access → Dormant detection (5) monitors whether it's actually used → Remediation SLA (8) ensures unused access gets revoked quickly → Root cause analysis (9) examines why elevated access was granted but never used → Time limits get adjusted for different access types.

Offboarding → Detection → Remediation → Coverage Expansion

Automated offboarding (4) revokes access at termination → Orphaned detection (6) catches accounts offboarding missed → Remediation SLA (8) ensures missed accounts get handled → Root cause analysis (9) identifies which systems offboarding doesn't cover yet → Offboarding workflow expands to additional systems.

Everything → Evidence

Audit trails (10) document every control's operation throughout all cycles, providing evidence that the entire system works.

The system gets tighter each cycle. Year one: quarterly reviews find 200 inappropriate access items. Year two: 80 items. Year three: 20 items. That's controls working—preventive controls reduce what detective controls find, detective controls surface patterns that corrective controls analyze, corrective controls strengthen preventive controls based on real failure patterns.

How Zluri Implements These Controls

Most IGA platforms only work with applications connected through SSO or your identity provider. That's a critical limitation—the average company has 60-70% of applications operating outside SSO as shadow IT.

Zluri's biggest differentiation: we help you implement these controls across ALL applications in your environment, including shadow IT that other platforms can't see. This means access governance that actually covers your real attack surface, not just the applications your IT team officially knows about.

Here's how Zluri implements each control:

Preventive Controls:

Control 1: Access Control Policies - Zluri supports RBAC, PBAC, and ABAC implementations. During onboarding, Zluri automatically provides company-wide and department-specific birthright applications based on role. Additional access requires explicit requests. Access requests exceeding defined baselines can be requested via a self-serve app store like catalog. 

Control 2: Access Request Approval Workflows - Low-risk requests can be automatically provisioned based on pre-approved workflows. Higher-risk requests flow through configured approval chains (manager for standard access, manager plus IT Security for privileged access, manager plus app owner plus finance for financial systems). After approval, Zluri automatically provisions access—eliminating the gap between approval and actual provisioning that creates delays in other systems. All approvals captured with timestamps, justification, and reviewer identity.

Control 3: Time-Based Privileged Access (Just-in-time access and zero standing privileges) - Any access grant in Zluri can be time-limited, but this is particularly powerful for privileged access. Set automatic expiration dates when granting elevated permissions. The system auto-revokes on expiration without manual intervention. Users receive reminders seven days before expiration and can request renewal through approval workflow requiring fresh business justification and manager approval.

Control 4: Automated Offboarding Workflows - This is Zluri's differentiator. While other IGA platforms only handle SSO-connected applications, Zluri also revokes access to shadow IT—applications employees were using that IT didn't officially know about. Zluri integrates with your HRIS (BambooHR, Workday, etc.) to detect termination events in real-time. Termination triggers automated offboarding across ALL systems: SSO apps, shadow IT, granular actions like removing from Slack channels, Google Drive sharing permissions, GitHub repositories. The system tracks completion for every action and alerts if anything fails.

Detective Controls:

Control 5: Dormant Account Detection - Zluri's continuous monitoring tracks last login dates across all connected applications, including shadow IT. The system automatically flags accounts inactive for 30+ days and sends weekly digests to managers. Accounts reaching 90 days without manager confirmation auto-suspend (of course, you can choose the threshold). 

Control 6: Orphaned Account Detection - Zluri automatically identifies orphaned accounts daily—accounts without assigned managers, service accounts without business owners, contractor accounts past contract dates. This works across SSO apps and shadow IT. These accounts escalate to IT Security for ownership assignment or deactivation. The system prevents new orphans by requiring documented owners for service accounts and contract end dates for contractors.

Control 7: Excessive Permission Alerts - Zluri establishes role baselines showing standard permissions for each position across all applications. The system compares each user's permissions to their role baseline and flags users with 20%+ more access than peers. Weekly digests to IT Security show excessive permission holders with grant history and approval details for investigation.

Corrective Controls:

Control 8: Remediation SLA Enforcement - Unlike other tools that leave you with Jira tickets after access reviews, Zluri performs closed-loop remediation for the apps connected. The platform actually downgrades user role or license type or revokes the access based on reviewers decision. 

Control 9: Findings Root Cause Analysis - Zluri helps you with root cause analysis by giving you contextual risk insights across standard and privilege across employees, external users (like contractors, consultants, and partners) and service accounts.

Control 10: Audit Trail Integrity - Zluri logs every access review action to append-only storage: who was reviewed, by whom, when, decision made, justification provided, remediation executed. Logs are tamper-evident—any attempt to modify creates a separate audit entry. Retention policies match regulatory requirements (SOX = 7 years, PCI = 1 year, SOC 2 = report period + 1 year). Auditors can export complete certification reports on demand.

Control Implementation Summary

‍

If you're using a different IGA platform, look for similar features and modules to implement these controls. The key limitation of most platforms is that they only work with IDP/SSO-connected applications, leaving shadow IT ungoverned. The principles remain the same regardless of the tool, but coverage matters—if your controls don't extend to shadow IT, you're governing just 30-40% of your actual application landscape.

Where to Start

"We spent six months perfecting our review workflow—custom notifications, escalation rules, bulk approval interfaces, beautiful reports. We could execute reviews in half the time. But we still found 200+ inappropriate access items every quarter. We'd automated the wrong thing. We'd automated problem discovery instead of problem prevention."

That's what one team told us after realizing they'd optimized the wrong metric.

Access review processes describe activities—who reviews what, when reviews occur, how evidence gets documented. Access review controls are mechanisms that prevent inappropriate access from being granted, detect violations quickly, and ensure findings drive lasting improvements.

The difference matters.

Mature access governance implements all three control types: preventive controls stop inappropriate access before it's granted, detective controls identify violations between quarterly reviews, corrective controls ensure findings address root causes rather than symptoms.

Strong controls across all three categories transform access reviews from discovering problems quarterly to validating that preventive controls work.

Implementation Priority: Start Where It Hurts

The 10 controls group into three functional areas based on what they accomplish:

Controls for Giving Access:

• Control 1: Access Control Policies - Establish role baselines and birthright applications
• Control 2: Access Request Approval Workflows - Grant additional access beyond birthright on request
• Control 3: Time-Based Privileged Access - Grant privileged access only on request, time-limited only

Controls for Revoking Access:

• Control 4: Automated Offboarding - Revoke all access at termination, including shadow IT
• Control 5: Dormant Account Detection - Flag and suspend unused access
• Control 6: Orphaned Account Detection - Identify accounts with no owner
• Control 7: Excessive Permission Alerts - Detect permission creep beyond baseline
• Control 8: Remediation SLA Enforcement - Ensure revocations happen fast

Controls for Continuous Improvement:

• Control 9: Findings Root Cause Analysis - Prevent recurring issues
• Control 10: Audit Trail Integrity - Document everything for auditors

Start with your biggest pain points:

1. Departed employees retain access? Start with Control 4 (Automated Offboarding), then add Control 6 (Orphaned Account Detection) to catch what offboarding misses.
2. Users accumulate access they never use? Start with Control 5 (Dormant Account Detection), then implement Control 1 (Access Control Policies) to prevent over-provisioning during onboarding.
3. Over-provisioning during onboarding? Start with Control 1 (Access Control Policies) to define baselines, then add Control 2 (Access Request Approval Workflows) to enforce them.
4. Approved revocations sit in the backlog? Implement Control 8 (Remediation SLA Enforcement) with automatic escalation.
5. Same findings every quarter? Implement Control 9 (Findings Root Cause Analysis) to address upstream causes, not just symptoms.

Controls require more upfront work than process. You're configuring technical mechanisms, not just workflow. But controls deliver compounding returns—each quarter, findings decrease because fewer failures occur.

Process delivers linear returns—each quarter, you execute the same review slightly more efficiently but find the same volume of problems.

Access reviews supported by strong controls deliver security value. Reviews without controls deliver compliance documentation.

The choice is yours.

See how Zluri implements automated access controls → Book Demo

‍