Bank IGA maturity still fails when connector coverage is incomplete

At a glance

What this is: This analysis says bank IGA programmes can look mature yet still fail completeness tests because connector coverage does not reach the systems that hold the most consequential accounts.

Why it matters: It matters because identity teams must prove estate-wide coverage, source-system revocation, and tamper-resistant evidence across human, NHI, and privileged access workflows, not just pass certification campaigns.

Context

Banks often judge IGA maturity by the number of applications onboarded and the cadence of certification campaigns, but audit expectations now centre on something narrower and harder to prove: whether the account universe is complete. In practice, the governance platform only knows what its connectors can see, which leaves mainframes, older Unix estates, SQL-backed identity stores, and acquired systems outside the certified picture.

The problem is governance scope, not campaign volume. When access lives in systems that do not log identity changes cleanly, do not integrate with the platform, or cannot confirm revocation at the source, the programme can produce approvals without producing defensible evidence. That gap affects bank identity governance, privileged access management, and workload or service account oversight at the same time.

Key questions

Q: What breaks when an IGA platform cannot see every account in a bank estate?

A: The completeness claim breaks first. A governance platform can only certify the systems it is connected to, so missing mainframes, acquired environments, or SQL-backed identity stores create a blind spot that auditors will test. The result is a partial inventory that looks authoritative but cannot prove it covers all financially relevant access.

Q: Why do completeness gaps create audit risk even when access reviews are on schedule?

A: Because a scheduled review only proves that a decision was made on a given date. It does not prove that the access list was complete across the audit period, nor that revocation executed in the source system. The risk is not review volume but unverified coverage and unconfirmed enforcement.

Q: What are the signs that identity governance evidence is too narrow for bank audits?

A: The usual signs are manual account lists, ticket closures standing in for revocation, missing owner fields on privileged accounts, and systems whose identity changes never make it into the record. When those patterns appear together, the programme can show workflow activity without showing estate-wide control.

Q: How should banks govern service and privileged accounts across legacy systems and acquired platforms?

A: They need a single evidence model that ties each account to an owner, records review decisions, and confirms changes in the source system. For legacy and acquired platforms, the governance process must be built around what the system can prove, not around what the IGA workflow would like to assume.

Technical breakdown

Why connector coverage defines the audit boundary

An IGA platform can only attest to the applications it connects to, which makes connector coverage the real boundary of the control. In banks, the hardest systems to integrate are often the most critical: mainframes with RACF or ACF2, SQL-backed identity stores inside core banking and payments, older Unix estates, and legacy directories left behind by acquisitions. If those systems are missing, the report is complete only within a partial estate. The technical issue is not data quality inside the platform, but visibility outside it.

Practical implication: treat connector inventory as an audit artifact and reconcile it against the full production estate, not against the IGA catalog alone.

Why certification snapshots miss revocation and interim change

A certification campaign captures a single decision moment, not the state of access across the whole audit period. That means temporary privilege, short-lived elevation, or access granted and removed between campaigns may never appear in the review record even though it affected the environment. For regulators and auditors, the more important question is whether revocation executed in the source system and whether the evidence can prove that execution. If the system only records a ticket closure, the control stops at intent rather than outcome.

Practical implication: separate reviewer approval from source-system confirmation so revoked access is evidenced by the target system, not by the workflow ticket.

How tamper-resistant identity evidence changes the record model

The article’s deeper point is that IGA evidence must live outside the systems it describes. If the same administrators who can change entitlements can also edit the governance record, then the proof is no longer independent of the event it documents. Banks now need an append-only record of account presence, ownership, review, and revocation that survives platform administrators, audit windows, and system gaps. This is especially important where there is no native log to forward to SIEM or no reliable trail to reconstruct change history later.

Practical implication: move from workflow-only evidence to an external system of record that preserves immutable identity history.

Threat narrative

Attacker objective: The practical objective is to keep consequential access outside the governance record so entitlement review and revocation cannot be independently proven.

1. Entry occurs through the governance blind spot created when critical systems are not connected to IGA or do not log identity changes in a usable way.
2. Credential or account access is then assessed only through partial inventories, so standing access and temporary elevation can persist without being fully visible to reviewers.
3. Escalation happens when revocation is treated as a ticket closure instead of a confirmed change in the source system, leaving access behind the paperwork.
4. Impact is audit failure and unresolved exposure on the systems that matter most, because the bank cannot prove the list was complete or the revocation executed.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Connector coverage, not certification volume, is the real completeness control: Mature IGA programmes can still fail because the platform only governs what it can reach. In banks, the missing systems are often the ones that matter most, including mainframes, acquired environments, and SQL-backed identity stores. The practitioner conclusion is that completeness must be measured against the estate, not the certification queue.

Access review evidence loses value when revocation is not source-confirmed: A reviewer’s approval is only one half of the control. If the target system does not confirm the entitlement change, the programme can prove intent but not execution. The implication is that review governance must distinguish between decision evidence and outcome evidence.

Immutable identity history is now a control requirement, not an architecture preference: Audit requests increasingly test whether the people who operate the governance tool can also alter the proof it produces. That breaks the assumption that the record can live inside the same control plane as the access decision. Practitioners need an externally held system of record for identity history, or they will keep producing evidence that is technically complete but not trustworthy.

Bank identity governance now spans human, NHI, and privileged access under one evidence model: The same completeness problem appears when a bank tracks employee access, vendor access, service accounts, and emerging AI agent identities. Those actors differ in lifecycle and accountability, but auditors still ask the same questions about inventory, ownership, review, and revocation. The conclusion is that IGA, PAM, and NHI governance are converging on one proof standard.

Bank IGA completeness gap: This is the failure mode the article exposes, where governance is accurate inside its connector perimeter but blind outside it. The practical implication is that maturity scoring must stop rewarding campaign throughput until coverage, source-system revocation, and immutable evidence are all present.

From our research library:

• Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.

What this signals

Connector completeness is now the governance threshold: Bank identity teams cannot treat catalog coverage as an adequate proxy for estate coverage. The practical test is whether the programme can enumerate every account that reaches a financially relevant system, including the systems that were never cleanly integrated into modern IAM or IGA workflows.

Identity records also need to survive the operators of the governance platform. If the same control plane that approves access can alter the proof of approval, auditors will continue to question whether the evidence is independent of the process it documents.

The article also sharpens a broader programme lesson for banks: identity governance, PAM, and NHI oversight are converging around one expectation, namely that ownership, review, and revocation must be provable at the source rather than inferred from the workflow.

For practitioners

• Map the real estate before the audit does Build an independent inventory of every system that can hold financially relevant accounts, then reconcile it against the IGA connector catalog to expose blind spots in mainframes, legacy stores, and acquired platforms.
• Require source-system revocation evidence Treat ticket closure as workflow evidence only and require a confirmation from the system that actually holds the account, especially for privileged, service, and legacy application accounts.
• Separate the record from the control plane Store identity review, ownership, and revocation history in an append-only record that administrators of the governance platform cannot edit or delete.
• Reconcile temporary access between campaigns Compare entitlement snapshots across the full audit period so elevation that starts and ends between certification cycles is still visible to reviewers and auditors.
• Assign named owners to non-human and privileged accounts Ensure every service, generic, and emergency account has an accountable owner, a review date, and a documented path for the evidence to reach the source system.

Key takeaways

• Banks can have mature certification programmes and still fail audits when connector coverage leaves critical systems outside the governed estate.
• The key weakness is not review cadence but the inability to prove complete coverage, confirmed revocation, and independent evidence across legacy and acquired environments.
• Identity teams should measure completeness against the full production estate, then move evidence into an immutable record that source-system administrators cannot change.

Key terms

• Connector coverage: Connector coverage is the extent to which an identity platform can integrate with the systems where real access decisions exist. It matters because governance controls only work when the platform can see entitlements, roles, and conflicts in the applications that actually hold risk.
• Source-System Revocation: The act of disabling or removing access in the system that truly holds the account, rather than only recording a workflow closure. In practice, auditors care whether the entitlement changed at the source, because a closed ticket does not prove the account is gone.
• Append-Only Identity Record: An identity history store that can be added to but not edited or deleted after the fact. This matters when the same administrators who operate the governance platform could otherwise alter the proof, because the record must remain independent of the access decision it documents.
• Completeness Audit: An audit test that asks whether the access list truly covers every account that can reach a relevant system. For banks, this is less about the number of certifications completed and more about whether the underlying inventory includes legacy, acquired, and hard-to-monitor environments.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.