The usual signs are manual account lists, ticket closures standing in for revocation, missing owner fields on privileged accounts, and systems whose identity changes never make it into the record. When those patterns appear together, the programme can show workflow activity without showing estate-wide control.
When audit evidence is too narrow to prove control of the identity estate
Identity governance evidence becomes too narrow when it only proves that a workflow happened, not that the underlying account, entitlement, or privilege was actually corrected across the estate. In bank audits, that gap shows up when the evidence trail is dominated by manual extracts, closure tickets, and local screenshots instead of record-level proof that access, ownership, and revocation were consistent everywhere.
A narrow evidence set usually means the control is optimised for inspection, not for assurance. Auditors may accept a completed process step, but they will still question whether the organisation can demonstrate complete coverage over privileged users, service accounts, joiner-mover-leaver events, and systems that sit outside the main IGA workflow.
What the evidence pattern looks like in practice
The first signal is mismatch between the evidence type and the control objective. If the file set contains account lists but no authoritative source reconciliation, ticket closure but no revocation confirmation, or attestations but no ownership metadata, the programme is probably showing activity rather than state. That is especially visible when exceptions are handled case by case instead of through a controlled identity governance baseline.
A second signal is that the same gaps recur across different systems. When one platform has clean records but adjacent platforms do not, the issue is not a one-off documentation problem, it is usually a discovery, inventory, or connector problem. A useful comparison point is identity visibility and intelligence, because it highlights whether the estate can be seen consistently before it is governed consistently.
A third signal is that the evidence package cannot answer simple audit questions without manual reconstruction. If reviewers have to infer who owned an account, when access was removed, or whether a mover event changed privileges, the underlying governance record is too thin. Banks tend to feel this most acutely in privileged access, where missing owner fields and stale entitlements make the control look procedural rather than definitive. Guidance on access reviews and certification is useful here because review activity only matters when it drives a confirmed state change.
Why bank auditors treat this as a control weakness
In banking, identity evidence is expected to support both regulatory discipline and operational traceability. If the evidence only proves that a team closed tickets on time, it does not prove that access risk was reduced, that privileged access was owned, or that deprovisioning happened everywhere it should have. That is why audit teams often push beyond the workflow layer and ask whether the evidence can survive a sample test on a real user, a real account, or a real system path.
Broad programmes also fail when they rely too heavily on manual reconciliation. Manual lists are easy to produce, but they age quickly and rarely capture orphaned, shared, or locally managed identities. Bank auditors usually read that as a sign that the evidence model is narrower than the actual attack surface, particularly if the programme cannot show how stale access is removed and how exceptions are tracked to completion. The lifecycle angle in lifecycle management guidance is relevant because governance has to follow the full identity lifecycle, not just the review date.
This is also where ownership matters. If privileged accounts do not have named owners, then recertification can still happen while accountability remains unclear. That creates a gap between compliance activity and control accountability, which is exactly what bank auditors look for when they ask whether the evidence demonstrates estate-wide control or only local process completion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Bank audit evidence often hinges on proof that credentials were revoked or changed. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Audit teams need evidence that identity events were reviewed and investigated, not just closed. | |
| Recommendation — Retain revocation and rotation evidence that ties each access change to a specific credential lifecycle event. Preserve review evidence that shows identity exceptions were analysed to closure. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | The question is about whether governance evidence proves access was controlled across the estate. |
| A.5.18 — Access rights | Missing owner fields and stale accounts are direct evidence of weak access-rights governance. | |
| Recommendation — Map evidence to access control decisions and verify they reflect current state in target systems. Maintain dated access-rights evidence that shows granting, review and removal were completed. | ||
| CIS Controls v8 | CIS-5 — Account Management | The signs described are account-management failures, especially around revocation and ownership. |
| Recommendation — Use account inventories and removal records that prove accounts were not just reviewed, but actually fixed. | ||
Practitioner Guidance
What to verify: Check whether each audit sample can be traced from request or event, to approval, to revocation or entitlement change, to the live state in the target system. If any step depends on manual inference, the evidence set is too narrow for high-confidence audit use.
What practitioners underestimate: Ticket closure is not the same as control effectiveness. The strongest evidence is not the largest report pack, it is the smallest set of records that proves the account state changed in the authoritative system and that the change was visible to governance.
Practitioner takeaway: For bank audits, the test is whether evidence can prove control over the estate, not whether it can prove that a review process ran on schedule.
Related resources from NHI Mgmt Group
- What are the signs that CLM is too narrow for modern identity governance?
- Why do identity governance programmes fail when integrations are too narrow?
- What are the signs that an identity governance programme is too slow for current enterprise needs?
- What are the signs that identity governance is too fragmented to support modern cloud and remote work environments?