Compliance and emergency access risks expose identity governance gaps

At a glance

What this is: This SailPoint research snapshots compliance and emergency access pressure, showing that SoD is widely required but frequently broken by manual exception handling and weak revocation discipline.

Why it matters: It matters because IAM, IGA, and PAM teams cannot treat emergency access as a temporary paperwork exercise when access governance and audit evidence are failing in the same workflow.

By the numbers:

• 92% of organisations surveyed require some form of separation of duties.
• 43% of organisations reported that they have failed requirements for separation of duties at some point.
• 60% of companies have had to provide emergency access at some point.

Context

Separation of duties, or segregation of duties, is a governance control that splits risky actions so no single identity can complete an irreversible task alone. In this article, the primary identity problem is not whether organisations accept the control in principle, but whether they can enforce it when business pressure creates exceptions.

The governance gap widens in emergency access scenarios because exception handling often bypasses normal review, documentation, and revocation discipline. For IAM, IGA, and PAM teams, the issue is lifecycle control over privileged access, not just policy definition.

SailPoint’s survey framing shows a familiar pattern: compliance language exists, but operational processes still break under manual handling, delayed offboarding, and weak evidence trails. That is a process failure in identity governance, not a mere reporting inconvenience.

Key questions

Q: What breaks when emergency access is granted without SoD controls?

A: When emergency access bypasses separation of duties, a single identity can complete sensitive actions that should have required split control. The result is not just policy violation but a weaker audit trail, more difficult accountability, and a higher chance that temporary privilege becomes persistent access.

Q: Why do organisations struggle to prove SoD compliance after exceptions?

A: Because manual exception handling often leaves no reliable record of why access was granted, who approved it, and when it ended. Without those records, compliance teams cannot distinguish a legitimate emergency from a governance failure, and audit findings become hard to defend.

Q: How do teams know whether emergency access is actually controlled?

A: Emergency access is controlled only when every session is approved, time-bounded, logged, and reviewed against the exact business purpose. If any one of those elements is missing, the process creates privileged exposure rather than governed exception handling. The test is whether the team can reconstruct both scope and justification after the fact.

Q: When should organisations prioritise automated data risk scoring over manual review workflows?

A: Organisations should prioritise automated scoring when data volumes, cloud sprawl, and regulatory obligations make manual review too slow to keep pace. Automated assessment helps security teams triage risk based on sensitivity, exposure, and policy context, which is especially useful when multiple compliance regimes apply at once. The practical value is faster decision-making and better allocation of limited remediation resources.

Technical breakdown

Why separation of duties breaks down in practice

Separation of duties works by splitting high-risk work into distinct steps or roles so no single identity can complete the full action path alone. The article shows that this control often fails when organisations rely on manual approvals, informal workarounds, or exception paths that are never brought back under normal governance. In identity terms, the policy exists, but the enforcement layer is too weak to stop a user from crossing a sensitive boundary when the process becomes urgent. That is why SoD is as much an operational control as a policy statement.

Practical implication: model SoD controls around the actual transaction flow, not the org chart.

Emergency access creates temporary privilege with permanent risk

Emergency access is supposed to be time-bound, auditable, and tightly scoped. The article shows the opposite failure mode: access is granted during an incident or staffing gap, then lingers long enough to create new violations, audit gaps, and inappropriate access. That is especially dangerous in PAM and IGA programmes because emergency use cases tend to be treated as exceptions rather than governed identity events. Once exception status becomes the norm, the control loses its ability to constrain blast radius.

Practical implication: treat emergency access as a governed lifecycle event with explicit expiry and evidence capture.

Why audit evidence matters as much as the access decision

The article links SoD failure to an inability to explain why non-compliance occurred and to a lack of documentation for auditing purposes. That matters because identity governance is not just about stopping access, it is about proving who had access, why they had it, and when it ended. Without traceable evidence, security teams cannot distinguish a legitimate emergency from uncontrolled privilege expansion. In regulated environments, the missing artifact is often the problem, because it prevents retrospective accountability even when the initial access was justified.

Practical implication: require audit-ready records for every emergency access grant, approval, and revocation.

Threat narrative

Attacker objective: The objective is to bypass normal governance boundaries long enough to perform sensitive actions without timely review or reliable audit evidence.

1. Entry occurs through an operational exception, usually when a required team member is unavailable and another identity must step in under urgency.
2. Credential or privilege access is expanded through emergency access, creating a temporary path around normal segregation of duties controls.
3. Escalation happens when that access is not revoked on time or is used without proper review, turning a short-term exception into sustained over-privilege.
4. Impact appears as audit issues, documentation gaps, and new SoD violations that expose sensitive actions to misuse or non-repudiation failures.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Emergency access is a governance event, not an ad hoc favour: The article shows that organisations still treat urgent access as an operational workaround rather than a fully governed identity state. That breaks the basic identity governance assumption that elevated access can be granted, observed, and removed through a controlled lifecycle. The implication is that emergency access belongs in the same governance model as privileged access, not outside it.

SoD failures expose process weakness more than policy weakness: The headline issue is not that organisations reject separation of duties, because most already require it. The problem is that manual procedures, unclear ownership, and exception handling make the control brittle in real operations. That means the governance gap sits in enforcement and evidence, not in the written rule.

Auditability is the real control boundary: If an emergency access grant cannot be explained, documented, and revoked on time, the identity programme has already lost control of the exception. This article makes clear that delayed revocation and missing records are not secondary symptoms; they are the mechanism by which temporary access becomes persistent risk. Practitioners should treat traceability as part of the control itself.

Privilege lifecycle, not access approval, is where resilience is won: The article points to a familiar IAM and PAM blind spot: teams focus on getting access approved quickly, but do not govern what happens next. When the access path is temporary, the decisive question is whether the lifecycle ends cleanly and visibly. That shifts the programme from ticket handling to privileged lifecycle governance.

Unified identity security only works when exceptions are designed in: The article’s findings support a broader field position that unified identity security is not just about centralisation, but about exception management at scale. If emergency access, SoD checks, and audit evidence remain separate manual processes, the programme stays fragmented even if the toolset looks unified. The practitioner takeaway is to govern exceptions as first-class identity events.

What this signals

Emergency access governance is really privilege lifecycle governance: The practical lesson is that exception handling must be designed as an identity lifecycle, not a ticket-based shortcut. If access can be granted quickly but not reliably removed, the programme has only solved the first half of the problem.

Manual compliance processes are especially fragile when urgency is high and ownership shifts between teams. The better operating model is one where approval, expiry, and evidence are enforced as a single control chain rather than three disconnected tasks.

For practitioners

• Define emergency access as a governed privilege state Map emergency access into the same approval, expiry, and evidence workflow used for privileged access so exceptions do not bypass governance.
• Automate SoD checks before granting access Run separation of duties analysis at the point of request and block or flag conflicts before the identity receives elevated access.
• Require timely revocation for every exception Set explicit revocation triggers and ownership for emergency access so temporary access cannot remain active after the incident or staffing gap ends.
• Make audit evidence part of the access workflow Capture the reason, approver, duration, and revocation record for every emergency grant so audit teams can reconstruct the full decision path.

Key takeaways

• The article shows that SoD is widely required, but real-world enforcement still breaks down when teams rely on manual exception handling.
• Emergency access becomes a governance problem when revocation is delayed and documentation is incomplete, because the temporary exception turns into ongoing privilege risk.
• The strongest control response is to govern emergency access as a full lifecycle event with expiry, audit evidence, and SoD checking built into the workflow.

Key terms

• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
• Emergency Access: Emergency access is elevated access granted for urgent operational or recovery needs, often under tighter monitoring and time limits. In ERP systems, it must be attributed, approved, and reviewed because it can bypass normal role boundaries and create hidden privilege concentration.
• Audit Evidence: Audit evidence is the record set used to prove that access was authorised, limited, and revoked according to policy. For modern identity programmes, evidence must come from runtime logs, approval events, and lifecycle records rather than from manual spreadsheets assembled after the fact.
• Credential Revocation: Credential revocation is the process of disabling a secret, token, or key so it can no longer authenticate or authorize action. It is the operational half of detection, because exposed credentials remain dangerous until they are invalidated and replaced across every dependent system.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.