The Access Review Problem Manufacturing Auditors Are Not Telling You About
Every manufacturing company running under SOX, ISO 27001, or internal risk governance requirements has a formal access review program. Managers receive lists of users and roles. They review them, sign off, and return the completed sheets. The tick box is ticked. The audit cycle closes.
The problem is that most of these access reviews manufacturing compliance teams run are producing compliance theater — the appearance of a control without the substance of one. And auditors are beginning to look more closely.
What a real access review is supposed to do
The purpose of access reviews manufacturing organizations conduct is not to confirm that a list of users exists. It is to confirm that every user's access is still appropriate for their current role — and to produce documented evidence that inappropriate access was identified, acted on, and removed. The user access review manufacturing compliance teams run is the cornerstone of manufacturing access certification programs — and it is failing at scale.
That means reviewers need to see more than role names. They need to see whether a user's combination of roles creates a Segregation of Duties conflict. They need to see whether the user transferred plants six months ago and their access was never updated. They need to see whether the account belongs to a contractor whose engagement ended before the review cycle opened. They need to see the full access profile — SAP roles, directory group memberships, plant application permissions — in a single view.
A spreadsheet cannot show any of that. It shows role names. And role names, without context, are not reviewable in any meaningful sense.
The reviewer problem is a design problem
Access review failures manufacturing compliance teams encounter consistently trace back to the same root cause: reviewers are being asked to make decisions without the information needed to make them well.
A production manager reviewing a list of SAP role identifiers — technical strings like "MM_BUYER_SENIOR" or "FI_AP_CLERK" — cannot determine from the name alone whether the combination creates fraud risk. Most managers do what any rational person would do when asked to approve something they do not understand: they approve it. Not because they are careless, but because the review process has given them no basis for doing otherwise.
This is the rubber-stamp problem, and it is endemic to spreadsheet access reviews manufacturing environments rely on. The SAP access review spreadsheet is the most common artifact manufacturing IAM teams produce — and the least useful one for proving that a meaningful review took place. The solution is not to train managers harder. It is to design reviews that present access with the context that makes a meaningful decision possible — the business function of the role, the SoD conflicts it creates with other access the user holds, the user's current HR status, and the lifecycle history behind the access.
Why manufacturing makes this harder
Access reviews manufacturing organizations in other industries run are already difficult. Manufacturing amplifies every weakness.
Multi-plant operations mean users change roles, move between facilities, and take on temporary responsibilities constantly. A quarterly review cycle catches a fraction of these changes. The access that becomes inappropriate in January may not be reviewed until Q3 — six months of exposure that a well-designed review program would catch in real time through event-triggered reviews connected to HR lifecycle events.
Contractor populations are large, transient, and frequently mismanaged. Manufacturing plants operate with significant non-employee workforces whose access grants often outlast their engagements. Spreadsheet reviews treat contractors as rows in a list, with no mechanism for triggered review at contract end or automatic expiration when no sponsor confirms the access is still needed.
SAP environments in manufacturing are deep and cross-functional. The risk does not live at the role level — it lives at the authorization-object level, in cross-functional combinations that span procurement, finance, production, and quality management. A spreadsheet that lists role names cannot surface this risk. A reviewer who cannot see it cannot act on it.
And manufacturing audit scope has expanded. Auditors now test access governance across SAP, Active Directory, ServiceNow, HR systems, and plant applications. Access reviews manufacturing compliance programs produce need to cover all of these in a single evidence trail. Spreadsheet reviews run system by system, producing disconnected artifacts that require manual reconstruction when an examiner asks for the full picture.
What audit-ready access reviews actually require
The alternative is not a better spreadsheet. It is a governed access review process manufacturing compliance programs can actually defend — built around four principles that spreadsheets cannot support.
Context at the point of decision. Reviewers see access presented with the information needed to evaluate it — what the role does, what conflict it creates, what the user's current HR status is, and whether the access has been reviewed before.
Event-driven triggers. Automated access reviews manufacturing organizations implement catch risk in real time. Access reviews manufacturing compliance programs run on schedules miss lifecycle events. The right program triggers reviews when something changes — a plant transfer, a role change, a termination, a contractor expiration — not just when the calendar says it is time.
Remediation tracking. When a reviewer marks access for revocation, the system tracks that action to completion. A timestamp confirms when access was removed. An auditor who asks whether access was revoked has a record, not a verbal assurance.
Unified audit evidence. Every decision — approve, revoke, accept risk, document compensating control — is retained in a single governed record. Manufacturing compliance access reviews that produce this kind of trail give compliance teams something they can stand behind. Access recertification manufacturing programs built on this model satisfy the examiner's question — not just the tick box. User access certification SAP manufacturing teams need to run must produce this chain of evidence or it will not hold up when tested.
Manufacturing companies that build access reviews around these principles produce something a spreadsheet-based program never can: a defensible record that an auditor can examine and a compliance team can stand behind.
The access review problem in manufacturing is not that companies are skipping reviews. It is that most reviews are not designed to find what they are supposed to find — and are not producing the evidence that proves what was done when they did.
For a detailed breakdown of why access review failures manufacturing teams experience are structural rather than accidental — and what a meaningful access review process looks like in practice — the full analysis is here: Why Spreadsheet Access Reviews Fail Manufacturing Teams.
https://www.openiam.com/blog/s....preadsheet-access-re
