Because the same person can be fully certified in one system and still retain active access in the other. When identity records do not converge, offboarding and recertification produce incomplete evidence, and security teams cannot answer a single question about total access without manual reconciliation.
Why Split IAM and Badge Records Create a Governance Blind Spot
When workforce identity and physical access live in different systems, governance becomes a reconciliation problem rather than a single control. A person can pass recertification in one system while still holding active access in the other, which means offboarding, access review, and audit evidence no longer describe the same reality. That mismatch is what creates the gap.
In practice, the issue is not that either system is broken on its own. The problem is that each system can remain internally consistent while the combined access picture is incomplete. If a security team cannot see identity, roles, and badge entitlements together, it cannot reliably answer basic questions like who still has access, where they can go, or whether removal actually took effect.
That is why convergence matters for identity security programmes: governance depends on one authoritative view of access, not two loosely related inventories. When the records do not converge, the organisation inherits duplicate ownership, duplicate approvals, and duplicate failure points.
What Fails During Offboarding and Recertification
Offboarding becomes fragile when HR, IAM, and badge administration do not share the same source of truth. One team may revoke logical access while another retains badge access, or a badge may be disabled while applications remain reachable. The result is partial deprovisioning that looks successful in reporting but leaves residual access behind.
Recertification suffers in the same way. A manager can attest to system access without seeing that the same individual still has facility access, or a facilities team can review badge status without seeing privileged application access. That breaks accountability because certification evidence is split across systems and no single reviewer owns the full access outcome.
The lifecycle problem is broader than offboarding. Lifecycle management guidance is explicit that provisioning, rotation, access review, and deprovisioning must be linked to ownership and visibility. When those steps are separated between systems, governance becomes dependent on manual detective work instead of control design.
The practical failure mode is stale access that survives normal administrative workflows. If one system does not trigger the other, a departed employee, contractor, or transferred worker can keep an active badge long after logical access was removed, or keep application access after physical access was closed. Either outcome weakens the assurance that deprovisioning actually completed.
How to Close the Access Picture Before It Becomes an Audit Problem
A useful governance model starts by treating physical and logical access as one entitlement story, even if different teams operate the systems. Security, IAM, HR, and facilities need a shared reconciliation point that shows current identity status, active access paths, and outstanding exceptions. Without that joined-up view, recertification is only a partial control.
Strong programmes also define which system is authoritative for lifecycle events and how exceptions are recorded. If badge termination, HR termination, and IAM deprovisioning do not have aligned triggers and timestamps, then evidence quality will stay weak no matter how often reviews occur. The control objective is to prove that access removal propagated everywhere it should.
For access governance, lifecycle processes for managing identities are a useful analogue: discovery, ownership, review, and decommissioning only work when the whole lifecycle is visible. The same logic applies here, because governance fails when one access plane is reviewed in isolation from the other.
Risk and Threat Considerations
Separate systems expand the chance of residual access, especially when terminations, contractor exits, or role changes are handled under time pressure. They also create a blind spot for insiders and attackers who benefit from one access channel staying active after the other is removed.
Failure mechanism: control decisions are made in disconnected systems, so revocation, recertification, and exception handling do not produce a complete access picture. Manual reconciliation becomes the backstop, and manual processes are where missed records, timing gaps, and ownership confusion usually appear.
Impact: the organisation can understate real access exposure, fail to prove complete offboarding, and miss an access path that should have been closed. That raises both security risk and audit risk, because the evidence no longer supports a reliable statement about who can access what.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Unified lifecycle control is needed to remove all access paths during offboarding. |
| AC-6 — Least Privilege | Split access systems often leave excess physical or logical access behind. | |
| IA-5 — Authenticator Management | Access credentials and badges both require controlled issuance, rotation, and revocation. | |
| Recommendation — Centralise account lifecycle actions so revocation reaches every active access path. Review and remove unnecessary access across both badge and IAM systems. Track and retire authenticators and credentials under one lifecycle process. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Identity records must be consistent across systems to support governance and reviews. |
| A.5.18 — Access rights | Access rights must be reviewed and withdrawn consistently across physical and logical access. | |
| Recommendation — Maintain one authoritative identity record across connected access systems. Reconcile and revoke all access rights during joiner, mover, and leaver events. | ||
Practitioner Guidance
What to verify: confirm that termination and access review processes can show the full path from identity status to every active physical and logical entitlement. If the evidence cannot reconcile badge state with application state for the same person, the control is not complete enough for governance purposes.
Decision rule: if a person can still enter a site after their system access is removed, or still log in after their badge is disabled, treat that as a deprovisioning failure rather than a minor administrative mismatch. The exception should be escalated until both access planes are aligned and the lagging record is explained.
Practitioner takeaway: governance gaps emerge when teams certify systems instead of certifying people. The right control objective is not separate hygiene in each platform, but a defensible, joined-up answer to whether any access remains anywhere.