Access Reviews Fail When Managers Don’t Have the Context to Decide

Access reviews are only useful if reviewers can make a meaningful decision.

That may sound obvious, but it is one of the most important practical challenges in access governance. Periodic access certification is designed to confirm whether users still need the access they hold. In SAP environments, that review may involve managers, role owners, business owners, security teams and control owners, depending on how the process is configured.

SAP Access Control’s User Access Review capability is described by SAP as a workflow-based review and approval process in which business managers and role owners perform periodic reviews of user access, with requests generated by the system based on the organisation’s internal control policy. SAP also describes the feature as automating and documenting decentralised user access review by business managers or role owners.

That word “review” matters. The goal is not simply to close a campaign. The goal is to obtain a defensible business confirmation that access is still appropriate.

And that is where many organisations struggle.

Access certification depends on business judgement

Access governance is often discussed in technical language: users, roles, risks, rulesets, violations, mitigations, assignments and systems. Those concepts matter. They are essential to SAP GRC, SAP Access Control and SAP Cloud Identity Access Governance.

But access certification also depends on something that is harder to automate: business judgement.

A manager may know whether a member of their team still performs a particular job. A role owner may understand whether a role is still appropriate for a function. A business owner may recognise whether access aligns with current responsibility, geography, process ownership or segregation of duties expectations.

SAP describes SAP Cloud IAG Access Certification Service as a cloud solution for periodically reviewing and certifying access rights by managers and/or designated reviewers across cloud and on-premise applications and systems. The validation is intended to ensure users have the access needed for their job function, and that access no longer needed is removed.

That makes the reviewer’s contribution central. The system can orchestrate the campaign, route work, record decisions and support auditability. But the quality of the review still depends on whether the reviewer understands what they are being asked to certify.

A manager who sees a list of users and role names may not immediately know whether each assignment is appropriate. A role owner who sees a technical role description may not know whether the named individual still requires the underlying business capability. A reviewer who is unsure may delay, escalate, approve cautiously, or ask someone else to interpret the request.

None of this means the reviewer is careless. More often, they are busy, occasional participants in an access governance process that is not part of their daily work.

Why reviewers struggle

The practical challenge is that access review items are not always easy for non-specialists to interpret.

A reviewer may be presented with a user, a role, a system and a decision to approve or remove access. That information may be technically accurate, but still not sufficient for confident business judgement. The role name may reflect an internal naming convention rather than a recognisable job responsibility. The description may be incomplete, overly technical or written for a security administrator rather than a department manager. The system name may be familiar to IT, but not to a business reviewer.

Long review lists add another problem. Even when each individual item is understandable, the cumulative effort can become substantial. A manager asked to review a small number of access assignments may give the task proper attention. A manager asked to work through a large campaign at a busy point in the quarter may find it much harder to maintain the same level of scrutiny.

There is also the issue of infrequent interaction. Many managers and role owners are not daily users of SAP GRC or SAP Cloud IAG. They may only engage with certification during quarterly, half-yearly or annual review cycles. By the time the next campaign appears, they may not remember the process, the terminology, or the significance of each action.

That uncertainty matters because access certification is not an ordinary approval. A reviewer is not just saying, “I have seen this request.” They are confirming that access remains appropriate, or that it should be removed, rejected, forwarded or otherwise handled according to the governance workflow.

For an occasional reviewer, those choices need to be clear.

Reviewer fatigue turns certification into a tick-box exercise

Reviewer fatigue is not simply a matter of workload. It is the point at which volume, ambiguity and time pressure combine to reduce review quality.

When review campaigns are large, unclear or poorly timed, reviewers may move from judgement mode into completion mode. The question shifts from “Is this access still appropriate?” to “How do I get this task off my list?”

That creates several risks. Some reviewers may approve items because they cannot see an obvious reason not to. Others may escalate too much because they are unsure. Some may delay until chased. Others may add comments that explain their uncertainty but do not resolve the underlying question. Inconsistent responses then create additional work for security, compliance and process owners.

The weakness is not necessarily in the governance platform. SAP Cloud IAG, for example, supports campaign creation, management of active campaigns, reviewer inboxes and audit/campaign logs as part of the Access Certification Service. SAP’s documentation also describes the Access Certification Audit Log as recording audit-relevant actions, including what was done, by whom and when.

The challenge is human engagement.

If the reviewer does not see the task, does not understand the item, or does not feel confident in the decision, the campaign may still complete without delivering the level of assurance the organisation expected.

Better engagement starts with better visibility

Access review tasks compete with everything else a manager has to do: operational issues, customer commitments, internal meetings, budget questions, HR responsibilities and project delivery. If certification tasks sit in a specialist work inbox that the reviewer rarely visits, they can easily be missed until reminders begin.

Visibility is therefore not a cosmetic issue. It is part of control effectiveness.

The reviewer needs to know that action is required. They need to see enough information to understand the decision. They need a convenient route to respond, or to escalate properly if they are not the right person. And the organisation needs to know what has been reviewed, by whom, when and with what outcome.

This is where Microsoft Teams can play a useful role. For many organisations, Teams is now the daily workspace for managers and operational leaders. It is where they receive internal messages, attend meetings, collaborate with colleagues and respond to time-sensitive requests.

Surfacing selected access review tasks in Teams does not change the governance system. It changes the engagement layer around the reviewer.