What breaks when IAM strategy is split across access, lifecycle, and audits?

Control drift breaks first. When provisioning, recertification, and deprovisioning are handled separately, access can remain active after the business need has changed, while audit evidence records only the process, not the true access state. The result is governance that looks complete on paper but still leaves excessive or stale access in place.

How IAM splits create control drift

When access, lifecycle, and audits are treated as separate workstreams, IAM stops behaving like one control plane. Provisioning may grant the right access at the start, lifecycle teams may later change or remove the need, and audit teams may only verify that a review happened. The gap is not visibility alone, it is coordination failure across the same identity state.

That split is why control drift appears so quickly. Access reviews can report clean results while the underlying entitlement remains in place, especially when changes are not tied back to a joiner-mover-leaver process or a source of truth for ownership and role changes. Identity Security Programme Guide

Why the business impact shows up as stale privilege

The practical failure is that permissions outlive the business reason they were granted. Once provisioning, recertification, and deprovisioning are handled independently, nobody is responsible for proving that access still matches current duties, environment, or employment status. That is how stale access accumulates even when each team believes it has done its part.

In identity programmes, lifecycle discipline matters because access is not static. A mover event can invalidate an old entitlement without automatically creating a new one, and a leaver event can leave behind active tokens, keys, or accounts unless revocation is linked to the same governance path. NHI Lifecycle Management Guide

Joiner-Mover-Leaver (JML) Guide

What audit evidence misses when it is detached from lifecycle

Audit artefacts can become procedural proof instead of operational proof. A completed recertification tells you a review occurred, but not whether the reviewed access was already obsolete, whether the approver understood the current risk, or whether deprovisioning later removed the same entitlement. In that model, governance looks complete while exposure remains real.

This is especially important where the identity being governed is non-human, because service accounts, workload identities, and tokens often persist beyond the business event that created them. If lifecycle and audit are not connected, the review cycle can bless an identity that should already have been rotated, scoped down, or removed. Ultimate Guide to NHIs, Lifecycle Processes for Managing NHIs

Ultimate Guide to NHIs, Regulatory and Audit Perspectives

Risk and Threat Considerations

Once IAM is split across separate teams, the control failure is usually quiet rather than dramatic. Excess privilege, orphaned accounts, and long-lived credentials can remain active after the business need ends, which creates a standing path for misuse, lateral movement, and failed compliance assertions.

Failure mechanism: Provisioning adds access, lifecycle changes or leaves the entitlement unmanaged, and audit confirms process completion without reconciling the current access state. The environment then accumulates stale permissions and active credentials that no longer match business need.

Impact: Attackers and insiders get a larger window to abuse retained access, while defenders lose confidence that reviews, offboarding, and recertification actually reduced exposure.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-6 — Access Control Management	Split IAM creates stale access and weak revocation control.
Recommendation — Centralize account and access control workflows so removals and reviews update the live entitlement state.
NIST CSF 2.0	PR.AA-05 — Identity Management, Authentication, and Access Control	The question is about access governance and lifecycle alignment.
	GV.RM-01 — Risk Management Strategy	Control drift is a governance and residual-risk problem.
Recommendation — Align provisioning, review, and deprovisioning to the current authorized access state. Treat stale access as a measurable risk condition in your identity risk strategy.
NIST SP 800-53 Rev 5	AC-2 — Account Management	Separating lifecycle and audit breaks account state governance.
	AU-6 — Audit Record Review, Analysis, and Reporting	Audit evidence must reflect real access state, not just process completion.
Recommendation — Tie account creation, modification, review, and disablement to one managed workflow. Correlate audit records with live entitlement data before treating reviews as effective.

Practitioner Guidance

What to verify: Treat the identity record, entitlement record, and audit record as one chain. If those three sources do not reconcile for a given account or role, assume the access state is wrong until proven otherwise.

Common mistake: Measuring completion of provisioning, review, and deprovisioning as separate KPIs. That can optimize team performance while hiding the real outcome, which is whether access was removed, reduced, or left behind correctly.

What good looks like: The same workflow that creates access should also define the owner, the review trigger, and the revocation path, so that every entitlement has a clear lifecycle end state and an auditable reason for existence.

Practitioner takeaway: Split IAM is dangerous when each function optimizes its own task, because governance only works when access, change, and removal are checked against the same current state.