u/Speific-Dresirvs1207

quarterly access reviews still make sense for privileged and sensitive access. but the giant spreadsheet campaign for every saas account is turning into a ritual where 40 mng click approve so we can all admire another audit screenshot.

for context we have access spread across saas, custom apps, service accounts and a pile of oauth grants nobody remembers approving. im looking at continuous discovery and smaller event driven reviews instead, with quarterly cert for the higher risk stuff.

has anyone actually moved away from the quarterly everything model without making grc miserable....,, (pls no vendor pitches)

For context, I'm trying to keep quarterly access reviews from turning into a three week archaeology project for our SOX apps. The decision comes down to reviewer effort, entitlement coverage, revocation proof, and whether the evidence is ready before the auditor emails "quick question."

I compared spreadsheet based reviews with a continuous identity governance approach across 14 SaaS and custom apps. Spreadsheets are fine when the environment is small and every app owner answers on time, which is a lovely fantasy. Continuous governance looks better when access changes often and you need timestamps, approvals, exceptions, and proof that revocations happened in the target system. Neither fixes stale ownership data, because apparently nobody owns the app nobody remembers creating.

My current recommendation is continuous evidence for high risk apps and a smaller manual process elsewhere. What would you add?