Because identity controls drift unless teams keep checking whether they work in practice. Recertification, rotation, and offboarding can all exist as documented processes while still failing operationally. Continuous improvement forces teams to compare policy intent with actual completion rates, exception volumes, and remediation speed, which is what reveals whether the programme is really reducing risk.