They miss accounts that exist outside the HR lifecycle, including privileged, orphaned, and exception-based access. That creates a control gap between personnel data and the real access estate, so reviews, audits, and incident investigations all start from incomplete information.
When HR becomes the only identity source, what the organisation stops seeing
HR data is useful for workforce lifecycle events, but it does not describe the full access estate. The first thing that breaks is visibility: administrators, contractors, shared accounts, service credentials, emergency access, and exception paths can persist even when no HR record explains them. That leaves access reviews and access recertification anchored to an incomplete population.
Once the identity picture is narrowed to employment records, the organisation also loses a reliable way to detect drift between personnel status and actual privilege. Identity data quality and identity fabric matter because authoritative-source design is what lets teams correlate HR events with directory state, entitlement state, and orphan detection.
In practice, the failure is not just missing records, but missing relationships. A person may leave, change roles, or become inactive in HR while a high-risk account remains active in an app, cloud console, or shared admin path. If HR is treated as the whole truth, the organisation confuses personnel truth with access truth.
Why audits, reviews, and investigations become less trustworthy
Audit and governance work start from the assumption that the population under review is complete. When HR is the only source of truth, that assumption breaks and every downstream control inherits the gap. Reviews may certify an account because no HR change appears, even though the account belongs to a contractor, a machine process, or an exception holder outside the standard joiner-mover-leaver flow.
NHI lifecycle management is a useful reference point here because lifecycle visibility, offboarding, and recertification are separate problems from payroll status. If the access estate is not inventoried independently, teams cannot prove that everything with privilege is actually governed.
Investigations also slow down because analysts have to reconstruct the missing layer after the fact. HR can tell you who is employed, but not whether a dormant account, break-glass credential, or delegated admin path was still usable at the time of an incident. That makes root-cause analysis more speculative and evidence collection more manual.
What must exist beyond HR for identity truth to hold
A reliable identity truth model needs at least three views: HR for workforce context, directory and application inventory for active accounts, and entitlement or privilege data for what those accounts can do. Those sources do not have to be identical, but they do have to be reconciled. Otherwise the organisation has a people system, not an access system.
Top 10 NHI Issues captures why this matters when access exists outside the employee lifecycle: orphaned, shared, and overprivileged accounts tend to survive precisely where HR has no natural signal. That is why discovery and ownership are control functions, not optional reporting fields.
HR also fails as the only source because it does not model operational exceptions well. Temporary admin access, emergency elevation, service onboarding, and cross-environment access often have a valid business reason but a different owner and expiry logic. Without a second authoritative source, those exceptions become permanent by default.
Risk and Threat Considerations
When HR is the only identity truth, the risk is stale or hidden access that outlives the business event that should have removed it. That creates a direct exposure path for privilege abuse, account takeover, and weak audit evidence, especially where exception access or non-workforce identities are involved.
Failure mechanism: HR-driven workflows miss accounts that are not created, owned, or revoked through the personnel lifecycle, so access persists after role change, termination, or exception expiry.
Impact: An attacker or insider can exploit the gap to retain unauthorized access, and investigators may not be able to prove who should have had access at the time of use.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Identity truth depends on tracking credentials beyond HR records. |
| AC-2 — Account Management | The question is about accounts that exist outside the HR lifecycle. | |
| AU-6 — Audit Review, Analysis, and Reporting | Incomplete identity truth weakens audit and investigation evidence. | |
| Recommendation — Inventory and rotate credentials independently of personnel status. Maintain account inventory, ownership, and timely deprovisioning. Correlate access events with account and entitlement sources before concluding on access. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | The issue is whether identity sources cover the full access estate. |
| A.5.18 — Access rights | Hidden or orphaned access is an access-rights governance failure. | |
| Recommendation — Define authoritative identity sources and reconcile them to access records. Review and revoke access rights against a complete account inventory. | ||
Practitioner Guidance
What to verify: Confirm that every privileged, shared, contractor, service, and emergency account has an owner and a non-HR source of record for lifecycle decisions. If any account can exist without a matching joiner-mover-leaver event, the HR feed is not sufficient on its own.
What good looks like: HR drives workforce status, but access governance is reconciled against directory, application, and entitlement inventories. The observable state you want is simple: every account that can act has an accountable owner, an expiry or review point, and a detectable path back to a business justification.
Practitioner takeaway: Treat HR as one input to identity truth, not the truth itself; if access cannot be discovered and explained outside HR, you will eventually miss privileged drift, orphaned access, and weak audit evidence.
Related resources from NHI Mgmt Group
- What breaks when organisations use one Azure identity pattern for every workload?
- What breaks when organisations use workforce IAM for customer identity journeys?
- What breaks when identity reviews do not have a single source of truth?
- What breaks when organisations rely on audit trails as their only source of truth?