Skip to content
ENExplore Calculators

Access Review Calculator

Size an access certification campaign: decisions to make, reviewer hours, elapsed days and the annual effort across campaigns.

About Access Review Calculator

Certification effort is a straight product, which is why it grows alarmingly: doubling entitlements per identity doubles the campaign. Auto-approving low-risk decisions by policy and reviewing only exceptions is the only lever that changes the shape of the curve rather than its slope. Reviews that cannot finish inside their window get rubber-stamped in the last two days, which produces a clean audit artefact and no actual reduction in access.

Formulas

Access Review

effort = identities × entitlements per identity × minutes per decision, less whatever policy auto-approves.

identities
Users, contractors and service accounts being certified
entitlements
Roles, group memberships and permissions attached to each identity
minutes per decision
Realistically 1–3 minutes once the reviewer has to think

Campaign duration

elapsed days = hours per reviewer ÷ hours per day each reviewer can actually give.

hours per day
Reviewers have day jobs — 1–2 hours is a realistic ceiling

Worked example

With the default values below, Access Review Calculator returns Reviewer Hours per Campaign of 468.0. Change any input above and every figure here is recalculated in your browser.

Inputs used

Identities in scopeaccepts 1–1,000,000 identities
3,200 identities
Entitlements per identityaccepts 1–1,000 entitlements
9 entitlements
Minutes per approve or revoke decisionaccepts 0.1–60 minutes
1.5 minutes
Decisions auto-approved by policyaccepts 0–100 %
35 %
Reviewers taking partaccepts 1–10,000 reviewers
40 reviewers
Hours per day a reviewer can giveaccepts 0.1–8 hours
1.5 hours
Days allowed for the campaignaccepts 1–365 days
14 days
Campaigns per yearaccepts 1–12 campaigns
4 campaigns

Results

Reviewer Hours per Campaign
468.0 hours
Decisions in Scope
28,800
Decisions Needing a Human
18,720
Hours per Reviewer
11.7 hours
Elapsed Days Needed
7.8 days
Reviewer Hours per Year
1,872 hours
Assessment
Fits inside the campaign window

Step by step

  1. 1Values used
  2. 2Access Review
  3. 3Campaign duration
  4. 4Reviewer Hours per Campaign= 468.0 hours
  5. 5Decisions in Scope= 28,800
  6. 6Decisions Needing a Human= 18,720
  7. 7Hours per Reviewer= 11.7 hours
  8. 8Elapsed Days Needed= 7.8 days
  9. 9Reviewer Hours per Year= 1,872 hours

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or fees or charges into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Access Review calculated?

effort = identities × entitlements per identity × minutes per decision, less whatever policy auto-approves. Certification effort is a straight product, which is why it grows alarmingly: doubling entitlements per identity doubles the campaign. Auto-approving low-risk decisions by policy and reviewing only exceptions is the only lever that changes the shape of the curve rather than its slope.

Why does Access Review matter?

Reviews that cannot finish inside their window get rubber-stamped in the last two days, which produces a clean audit artefact and no actual reduction in access.

What values do I need to enter?

This calculator takes 8 inputs: Identities in scope, Entitlements per identity, Minutes per approve or revoke decision, Decisions auto-approved by policy, Reviewers taking part, Hours per day a reviewer can give, Days allowed for the campaign, Campaigns per year. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

How long does one access decision really take?

Between roughly 30 seconds for a familiar group membership and several minutes when the reviewer has to work out what an entitlement grants. One to three minutes is the planning range, and the average rises sharply when entitlement names are technical rather than business-readable.

How do I cut access review effort?

Reduce what is in scope rather than speeding up reviewers: auto-approve unchanged low-risk entitlements, review by role rather than by individual permission, certify privileged and data-sensitive access more often and everything else less often, and remove orphan and dormant accounts before the campaign starts instead of certifying them.

Related Calculators

Access Review Calculator | Calcrivo