A user access review is the process by which an organization periodically confirms that every user's access is still appropriate — and that access no longer needed has been removed. In manufacturing, these reviews cover SAP roles, directory groups, plant applications, contractor accounts, and privileged access across a complex multi-system estate.
The challenge is not that manufacturing companies are skipping these reviews. It is that most are running them on spreadsheets — and spreadsheet-based reviews create the appearance of compliance without the substance of it.
In most manufacturing organizations, an IAM or GRC team exports access data from SAP and other systems into a spreadsheet and distributes it to managers and application owners. Reviewers mark each row — approve or revoke. Completed sheets are collected, filed, and the review is closed.
The problem is what the spreadsheet does not contain. The manager sees a list of SAP role names. They do not see that two of those roles, held by the same user, create a vendor master and payment run conflict. They do not see that the user transferred from a plant in Germany four months ago, that one account belongs to a contractor whose engagement ended six weeks ago, or that elevated directory group membership extends the user's effective access well beyond what the SAP roles suggest.
Role names, without context, are not reviewable in any meaningful sense.
The failure is structural, not accidental. It shows up in six recurring patterns.
A completed spreadsheet proves that a list was distributed, rows were marked, and the sheet was filed. It does not prove that reviewers understood what they approved, that conflicts were identified, that revoked access was actually removed, or that the review covered the full user profile.
An auditor is looking for a governed process: a triggered or scheduled campaign, access presented with business context and risk indicators, decisions captured in workflow, revocations tracked to completion with timestamps, exceptions documented with rationale, and the full record retained as exportable evidence. A spreadsheet produces the first item on that list at best.
Manufacturing amplifies every weakness in spreadsheet-based reviews because its identity estate is more complex and more dynamic than in most industries.
Multi-plant operations mean frequent role changes. Employees move between plants, take temporary supervisory roles, and cover for absent colleagues — changing access requirements faster than a quarterly cycle can track.
Contractor populations are large and transient. Non-employee workforces need the same rigor as employees — defined sponsors, time-bound grants, reviews triggered at contract end. Spreadsheets treat them as just more rows.
SAP environments are deep and cross-functional. The real risk lives at the authorization-object level, in combinations spanning procurement, finance, production, quality, and HR. A list of role names cannot surface that depth.
Audit scope has expanded. Auditors now test access governance across SAP, Active Directory, ServiceNow, HR systems, and plant applications — and expect one coherent evidence trail, not disconnected system-by-system artifacts.
The alternative is not more spreadsheets with better formatting. It is a governed process in which reviews are triggered by events — joiner, mover, leaver, plant transfer, contractor expiration — as well as scheduled campaigns. Reviewers see access with business context: what the role does, what risk it carries, whether it conflicts with the user's other access. Revocations are tracked to completion with timestamps. Exceptions are documented with rationale, not silently carried forward. And the entire record lives in a single audit trail that needs no manual reconstruction.
This is what teams operating under SOX ITGC, ISO 27001, or internal risk governance need to demonstrate: not a completed spreadsheet, but a defensible evidence trail.
For the full picture of manufacturing identity governance beyond access reviews — including the evidence gap argument and the seven-step framework — the white paper The Audit Was Never Just SAP covers the complete model. The OpenIAM manufacturing identity governance solution page covers how a unified platform supports this process.
What is a user access review in manufacturing?
A periodic or event-driven process in which managers confirm that each user's access across SAP, plant systems, and directory services is still appropriate for their current role. It should surface SoD conflicts, flag expired accounts, and produce a documented decision for every item in scope.
Why do spreadsheet access reviews fail in manufacturing environments?
They present role names without risk context, run on fixed schedules that miss lifecycle events, review systems in isolation, and produce no structured evidence of remediation. Completed spreadsheets prove only that a list was distributed — not that inappropriate access was identified and removed.
How often should manufacturing companies run access reviews?
On two tracks: scheduled campaigns at least annually (quarterly for high-risk and privileged access), and event-driven reviews triggered by plant transfers, role changes, terminations, and contractor expirations. Schedules alone mean access that becomes inappropriate in January may not be caught until Q3.
How should SAP SoD violations appear in access reviews?
Each item should be flagged with its SoD conflict status — whether the role, combined with the user's other access, creates a violation — and its risk rating. The reviewer's decision then becomes a documented risk judgment, not a blind approval of a role name.
What evidence does an auditor expect from an access review?
The full chain: campaign scope and trigger, reviewer identity and decision for each item, remediation actions for revoked items, timestamps confirming when access was removed, and documented exceptions with rationale. A spreadsheet satisfies none of this without a governed workflow behind it.
How do automated access reviews improve compliance outcomes?
They present access with SoD conflict context, trigger reviews from HR lifecycle events in real time, track remediation to completion with timestamps, cover SAP and non-SAP systems in a single campaign, and retain every decision in an exportable audit trail.