Quarterly access reviews take two weeks of manager time and everyone approves everything. How do you make this a real control?

Recognise what it currently is

A review where everything is approved is not producing a decision; it is producing a record of a decision-shaped activity. Two weeks of manager time is being spent to generate evidence that will satisfy an auditor and change nothing.

The cause is usually that managers are shown permission names they cannot interpret, in volumes they cannot assess, with no consequence for approving.

Reduce what needs reviewing

Most of the burden is standing access that could be removed structurally:

Just-in-time elevation for privileged access — requested, approved, time-boxed, logged. Nothing standing to review.

Access derived from role and team membership, so joining a team grants and leaving revokes automatically. That removes the largest category of stale access, which is people who moved internally.

Automatic expiry on anything granted as an exception.

After those, the remaining standing access worth a human decision is a fraction of what it was.

Make what remains reviewable

Present what the permission allows in business terms, not the role name. "Can approve payments up to £50,000" is decidable; "FIN_APPR_L2" is not.

Show last used. Access not exercised in ninety days is the strongest candidate for removal and the easiest decision a manager can make.

Highlight toxic combinations — permissions that are fine individually and dangerous together — because those are invisible in a role-by-role list and are what the review is genuinely for.

Default to revocation on no response, rather than to approval.

Then run it continuously

Detect and alert on the conditions that matter — a new toxic combination, access granted outside the standard path, privileged access held beyond its window — rather than sampling them quarterly. Detection latency falls from three months to minutes, and the quarterly event becomes a confirmation rather than an investigation.

What to tell the auditor

The control is stronger, not weaker: continuous evaluation over the whole population rather than a quarterly review of a list nobody could assess. Bring the evidence of both the automated checks and the exception handling.