How should organisations phase an IGA programme without creating more access drift?

Start with access reviews to establish ownership and visibility, then automate joiner-mover-leaver changes so access follows identity events. After that, move into entitlement-level governance and risk-based controls. The sequencing matters because each phase depends on the previous one being stable enough to support the next.

Why This Matters for Security Teams

Phasing an IGA programme is less about tool rollout and more about preventing a second control gap from opening while the first one is still unstable. If access reviews begin before ownership is clear, the programme creates findings that nobody can action. If automation starts before the joiner-mover-leaver model is trustworthy, it can propagate bad data faster than manual processes ever did.

That sequencing issue is visible in NHI governance too: NHIMG notes that only 5.7% of organisations have full visibility into their service accounts in the Ultimate Guide to NHIs, and that blind spot is exactly how access drift becomes normalised. The same pattern shows up in access governance programmes that attempt entitlement cleanup before identity data, application ownership, and business approvers are stable. Current guidance from the OWASP Non-Human Identity Top 10 reinforces the broader lesson: control design fails when identity lifecycle signals are not reliable enough to drive action.

In practice, many security teams encounter drift only after access reviews have already generated more unresolved exceptions than the organisation can absorb.

How It Works in Practice

A low-drift IGA sequence usually starts with visibility and ownership, then moves into event-based automation, and only then expands into entitlement governance. The reason is simple: each later phase depends on trustworthy identity data from the earlier phase. Without that foundation, governance becomes a reporting exercise rather than a control plane.

In phase one, teams establish account inventories, application ownership, manager or approver mappings, and an authoritative source for identity attributes. That gives access reviews a real target and reduces the number of orphaned decisions. In phase two, joiner-mover-leaver changes are automated so provisioning and deprovisioning happen from identity events rather than ticket handling. In phase three, organisations move to entitlement-level controls, role modelling, and risk-based access decisions. The goal is to reduce standing access through tighter lifecycle control, not to launch a broad recertification campaign with incomplete context.

Practical sequencing often looks like this:

• Fix ownership and data quality before asking approvers to certify access.
• Automate the highest-volume identity events first, especially joiners and leavers.
• Use exception handling sparingly so manual reviews do not become the default control.
• Expand from account-level review to entitlement-level governance only after deprovisioning is reliable.

For teams dealing with API keys, service accounts, and automation identities, the same logic applies. NHIMG’s Key Challenges and Risks section highlights how long-lived secrets and weak offboarding create persistent exposure, while 52 NHI Breaches Analysis shows how identity sprawl turns minor governance gaps into incidents. These controls tend to break down when organisations automate provisioning before resolving ownership conflicts and data-quality defects, because the workflow then scales the drift instead of eliminating it.

Common Variations and Edge Cases

Tighter sequencing often increases short-term operational overhead, requiring organisations to balance speed against the risk of automating the wrong access model. That tradeoff becomes most visible in decentralised environments where applications are owned by different business units, approval chains vary, and identity sources are inconsistent. There is no universal standard for how quickly each phase should move, so current guidance suggests using measurable stability gates rather than fixed calendar milestones.

One common edge case is contractor-heavy environments. These usually need accelerated leaver controls before broad certification work, because expired access is a higher risk than imperfect recertification coverage. Another is shared or technical accounts, where access reviews alone do not solve drift because ownership is ambiguous by design. In those cases, entitlement governance should not start until every account has a named operational owner and a documented purpose.

Programmes also stall when leaders treat recertification as the first and primary control. That approach can produce a large backlog of exceptions, especially if entitlements are poorly catalogued or app owners are unavailable. Best practice is evolving toward risk-based prioritisation, where high-impact systems, privileged roles, and stale accounts are addressed first. The key is to keep each phase narrow enough that the next one inherits stability rather than unresolved cleanup.

Related resources from NHI Mgmt Group

• How should organisations evaluate IGA software for access governance?
• How should organisations modernise IGA without creating more manual work?
• How should organisations automate user access reviews without creating more noise?
• How should organisations phase in passwordless authentication without disrupting access?