A Control Isn’t a Control Because Someone Clicked Approve

A quarterly access review closed at a hundred percent completion. Every line had an approver, a timestamp, and a green status. By its own definition, the control was operating effectively.

Three of the approved accounts belonged to people who had left eleven months earlier.

What the record actually captured

The review captured that someone opened a list and pressed a button. It did not capture whether they recognised the names, whether they had any basis for recognising them, or whether the list they were shown was complete. Those are three different questions, and the process was asking none of them.

• The approver was accountable for the click, not for the judgement behind it.
• The evidence of review and the act of reviewing had quietly separated.
• Completion rate measured participation. Nothing measured scrutiny.

Why it holds

Nobody involved behaved unreasonably. The reviewers were handed a long list, a short window, and no indication of which entries were unusual. Under those conditions approving everything is the rational response, and the design of the task produced the outcome it was always going to produce.

So the useful question is not whether the reviewers were diligent. It is what the review would have had to look like for a departed employee’s account to have been visible as an exception at all.