Getting managers involved in access reviews without pushback

A security officer can't assess who should have access to sales tools — that's the sales manager's call. Here's how to make it a natural part of their workflow instead of a yearly headache.

Access reviews don't work without managers. They know who actually uses what. You can only see whether access is switched on or off. So how do you keep it from becoming a drama?

Keep it short

A manager should be done in under 20 minutes per quarter. Show only the rows for their team. Pre-filter with "keep" suggestions so managers only need to look at the exceptions.

Make it business-relevant

Not "IT says you have to do this" — but rather "we've identified 8 accounts in your team that are generating more SaaS costs than necessary. Can you quickly check which ones we can cancel?" Budget is a better motivator than compliance.

Make it easy to do

• 1 link in an email, no login hoops to jump through.
• Keyboard-friendly (k for keep, r for revoke, c for change).
• Bulk actions for similar rows.
• Mobile-first — many managers do this between meetings.

Onboarding

First time: a 15-minute walkthrough per manager. Second time: a short refresher email. Third time: they do it without any help.

Accountability

A post-review report shows which managers completed their part on time — and which didn't. Transparency without naming and shaming works.

See also: review pillar, quarterly cadence.