Business application estates are growing, creating more places for risk to hide. Sixty-eight percent of organizations say more critical applications are in scope for access governance or SOX compliance than two years ago, and 60% say the number of critical applications in use but outside that scope has also increased.
Those out-of-scope applications expose the organization to unmanaged risk.
As a number of critical line-of-business applications increase for companies, application access governance (AAG) must keep pace with more users, permissions and connections between systems. Finance, IT, audit and compliance leaders need to analyze access risk across a growing number of ERP, CRM, and HCM applications, and demonstrate that controls remain effective as people change roles and AI tools and AI agents become part of critical business processes.
In Delinea’s 2026 Application Access Governance Report, finance and finance technology leaders reported confidence that their access controls would hold up to an audit. The findings tell a different story.
When surveyed, 95% of respondents say they are confident their access controls for business applications would withstand external audit scrutiny today. Yet 26% say the same or similar access findings have recurred in consecutive years, and 25% say findings have remained open for three or more years.
Strengthening application access governance takes time and resources. The growth in scope of business applications is translating into heavier workloads for teams responsible for governance. Sixty-eight percent of respondents reported greater effort to complete user access reviews (UARs) and 58% reported longer remediation times for access-related audit findings.
That additional work resulted in substantial expenditures to remediate risk. In the US, 46% of respondents spent $251,000 or more in the past 12 months remediating access-related audit findings. In the UK, 42% spent £201,000 or more.
| What to examine: Are the same access-related findings recurring year after year, and can you show why prior remediation didn’t hold? What would it take to close an audit finding permanently rather than reopening it at the next audit? |
Of organizations surveyed, 88% reported they already use AI tools or AI agents within critical business applications.
What is more surprising, 35% of respondents said they have deployed AI agents that perform actions that go beyond read-only analysis and recommendations. That distinction matters when it comes to critical business processes like payroll and procurement. An AI agent that can execute a transaction, change a record or alter permissions needs extra guardrails around what access it holds and which decisions require human approval.
Oversight hasn’t kept up. Fewer than half of organizations using AI in critical business applications have full, centrally tracked visibility into AI agent deployment, access, permissions, ownership and approval. Fewer than half consistently apply common governance controls across all their AI tools and agents.
This gap is causing observable problems. Eighty-four percent of organizations using AI in critical applications report at least one in the past year. Respondents reported the following AI-related issues, in order of prevalence:
| What to examine: Which AI agent actions require approval, which permissions are restricted, is each action authorized and can every consequential action be traced to an accountable owner? |
As organizations expand their portfolio of business applications, and adopt AI agents within business applications, foundational access controls become even more important. Yet the survey found that 52% of respondents do not continuously monitor and remediate excess access.
Automation helps teams make access risk management continuous, and it is becoming common across access governance activities. Access controls like segregation of duties (SoD) risk analysis and UARs have been around for quite some time, yet for many organizations manual work remains part of the control equation. When asked to what extent common access governance activities were automated, nearly two-thirds of respondents said each activity was mostly or fully automated. Only about one-quarter reported full automation.
Manual work leaves the door open for risk to show up in everyday operations. 91% of respondents reported at least one access-related condition. Respondents reported the following access-related issues, in order of prevalence:
| What to examine: Do role changes, departures and emergency-access expiry reliably trigger access removal? Can you demonstrate that rejected or unnecessary access was removed, including when an audit has already identified it? |
Read more insights and review six best practices in the 2026 Application Access Governance Report: “Secure Now or Pay Later.”