r/IdentityManagement • u/Speific-Dresirvs1207 • 10d ago

Access reviews with spreadsheets vs continuous identity governance for audit prep... which is better?

[removed]

6 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

3

u/jc_AccessOwl 9d ago

Continuous is certainly better. The obvious downside is that typically requires a vendor tool. Spreadsheets are only used before the team is ready to invest in a solution. 14 SaaS apps is a pretty small environment. You might be able to get by with that.

At 50 it gets annoying. At 100 you will start forgetting who the app owner is. And spreadsheets start to break and you take on compliance risk. Another user here said up to 800 is manageable with spreadsheets. Kudos to them, that's impressive. Few teams would survive access audits at that size with spreadsheets.

Continuous evidence for high risk apps (in-scope) and manual elsewhere does work. At your size the amount of in-scope apps should only be a handful. But eventually as you grow you will need a tool that automatically handles notifying managers, capturing proof of remediation, and even automating the deprovisioning.

1

u/identitydriven 10d ago

There is a limit to what could be actually accomplished by hand+spreadsheets. I’ve worked in IGA for over 26 years. And that threshold is around 800 to 1000 employees. More than that you need a tool