TL;DR: Many IGA initiatives fail for avoidable reasons, including weak business sponsorship, unclear objectives, broken workflow automation, poor user experience, fragmented identity data, and missing maintenance, according to Soffid. Gartner estimates 50% of these implementations are in critical condition, underscoring that governance failure is usually operational, not technical.
At a glance
What this is: This is an analysis of six common reasons IGA implementations stall, with the central finding that most failures are caused by strategy, process, data, and adoption gaps rather than the platform itself.
Why it matters: It matters because IGA is the control layer that supports access reviews, least privilege, compliance evidence, and eventual governance across human, NHI, and agentic identity lifecycles.
By the numbers:
- 50% of implementations of this type are in critical condition, according to Gartner.
Context
Identity governance and administration fails when organisations treat it as a technology rollout instead of an operating model. In practice, the programme is meant to connect policy, workflow, approvals, recertification, and audit evidence across the identities that matter to the business.
This article argues that the most common failure modes are avoidable and operational: weak sponsorship, unclear goals, poor workflow design, weak user experience, bad identity data, and no post-launch maintenance. That is a familiar IGA pattern, and it usually shows up long before the first audit finding.
The governance issue is bigger than IGA tooling alone because the same discipline later has to extend into NHI, PAM, and broader IAM controls. If the operating model is fragile at launch, it will be weaker when the identity estate grows more complex.
Key questions
Q: What breaks when IGA is treated as an IT-only project?
A: Access governance loses the business context needed to sustain reviews, approvals, and lifecycle changes. IT can run the workflow, but without security, HR, and app-owner accountability, the programme turns into a queue of manual exceptions and stalled decisions rather than a governance model.
Q: Why does automating access workflows often make IGA problems worse?
A: Because automation amplifies whatever process already exists. If approvals, roles, or recertification steps are broken or unclear, automation increases speed and volume without improving control quality, which can make exceptions and confusion harder to manage.
Q: What are the signs that identity data is undermining IGA governance?
A: Look for inconsistent user records, duplicate or stale entitlements, mismatched approver chains, and audit reports that require manual reconciliation. Those are signals that the governance layer does not have a reliable identity source to certify against.
Q: When does IGA stop being effective after rollout?
A: It stops being effective when no one owns ongoing policy updates, role maintenance, and exception review. A programme can launch well and still lose control quality if it is not measured and maintained as a living governance process.
Technical breakdown
Why IGA stalls when business ownership is missing
IGA is not just a security workflow layer. It is a governance system that depends on business ownership, process owners, HR, compliance, and application teams to define who approves access, who certifies it, and who is accountable when access changes. When the programme is owned only by IT, it tends to optimise ticket handling instead of business control. That creates low adoption, poor exception handling, and weak alignment with real operational needs. In practice, the programme becomes a technical wrapper around decisions the business never truly accepted.
Practical implication: build governance ownership outside the security team before automating approvals or certifications.
Why broken workflows get worse when automated
Automation does not fix a bad access model. If approval chains, role definitions, or recertification logic are already broken, workflow automation simply accelerates the same defects at scale. The article also points to the risk of trying to cover too many applications too early, because integration and customisation effort can overwhelm delivery. From an identity governance perspective, this is a lifecycle problem: joiner-mover-leaver logic, certifications, and exceptions all depend on process quality before tool efficiency matters. The technical error is assuming orchestration creates control. It does not.
Practical implication: redesign the access process first, then automate only the parts that remain stable and repeatable.
How identity data quality shapes access control and auditability
IGA depends on authoritative identity data. If records are outdated, incomplete, or fragmented across systems, the governance layer cannot reliably tell who has access, who should have access, or what needs review. That undermines access control, recertification, reporting, and audit evidence at the same time. In technical terms, bad data breaks the mapping between identity, entitlement, and approval state. When the data model is inconsistent, the controls above it become noisy and incomplete. That is why data cleansing and consolidation are not side tasks; they are foundational to making governance work at all.
Practical implication: validate identity sources and entitlement data before expecting certifications or reports to be trustworthy.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
IGA fails when governance is treated as an IT delivery problem: The article shows that access governance breaks down when business owners are absent from the decision model. That is not a tooling weakness, it is a control ownership failure. Compliance, HR, and process owners must shape access rules because governance without accountable business participation becomes a workflow with no real authority.
Broken process design is the real automation debt: Automating approvals and recertifications before simplifying the process just scales friction and exception handling. The strategic mistake is believing technology can repair unclear value, mixed objectives, or unreadable workflows. In NHI and human identity programmes alike, automation only strengthens the control model that already exists, so immature design becomes permanent technical debt.
Identity data quality is the hidden control plane: Outdated or fragmented identity data weakens access control, audit evidence, and lifecycle governance at the same time. That makes data hygiene a prerequisite for effective certification and role management, not an administrative clean-up task. Practitioners should treat identity data as part of governance architecture, because poor data turns every downstream control into guesswork.
Governance without maintenance is temporary: The article’s strongest warning is that launch success does not equal operating success. Without metrics, policy updates, role review, and exception management, even a well-designed IGA programme drifts into irrelevance. The practical lesson is that identity governance is never a one-time project; it is a continuously maintained control system.
Long-term IGA value comes from control consistency, not feature coverage: The article links IGA to Zero Trust and regulatory evidence, which is the right direction, but only when the governance model is stable enough to sustain least privilege and access visibility. That makes implementation discipline more important than broad application coverage. Practitioners should judge success by whether governance remains accurate after rollout, not by how much was automated in phase one.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
- Read next: Access Reviews and Certification Guide
What this signals
Identity governance fails fastest when operational ownership is vague: The article reinforces a wider IAM lesson that access control degrades when business, HR, and compliance teams are not part of the governance model. For practitioners, that means the first scaling problem is usually ownership, not technology.
Maintenance is not a post-project activity: IGA controls decay when role definitions, policies, and exceptions are not actively reviewed. That same pattern will matter even more as governance expands across human access, service accounts, and eventually autonomous actors.
Data quality is the control multiplier: If the identity record is wrong, every downstream certification, approval, and audit report becomes weaker. Clean sources and authoritative entitlements are what turn IGA from a reporting exercise into a control system.
For practitioners
- Define business ownership for access decisions Name the process owners, approvers, and governance stakeholders before deployment so approvals reflect actual business accountability rather than IT convenience.
- Redesign access workflows before automating them Map current approval and certification paths, remove unnecessary handoffs, and only then automate the stable parts of the workflow.
- Cleanse identity and entitlement data early Establish authoritative sources for users, roles, groups, and entitlements so recertification and audit reporting are based on current records.
- Set success metrics and maintenance ownership Track adoption, certification completion, exception volume, and policy update cadence so the programme does not decay after go-live.
Key takeaways
- IGA programmes fail for repeatable reasons, and the article shows that weak sponsorship, unclear objectives, poor process design, bad data, and no maintenance are the common ones.
- The article cites Gartner’s estimate that 50% of implementations are in critical condition, which underlines how often the problem is operational rather than technical.
- The practical lesson is to treat identity governance as an operating model with ongoing ownership, measurement, and data quality discipline, not as a one-time deployment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is centered on access governance, certifications, and entitlement control. |
| Recommendation — Use PR.AA-05 to align approvals, certifications, and entitlement governance to actual business access needs. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | IGA implementation failures often start with weak account and access lifecycle governance. |
| Recommendation — Apply AC-2 to govern access lifecycle ownership, approvals, and ongoing account maintenance. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article highlights account governance, access review discipline, and maintenance as persistent control gaps. |
| Recommendation — Use CIS-5 to standardise account management, review cadence, and stale access removal. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The maintenance and lifecycle themes directly map to non-human identity offboarding discipline. |
| Recommendation — Apply NHI-01 to remove stale identities and governance exceptions before they persist beyond their intended use. | ||
Key terms
- Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
- Access Recertification: Access recertification is the periodic review of user or account permissions to confirm that access is still justified. It is useful, but it is not enough on its own because it reacts after entitlements already exist, which is why lifecycle governance must reduce the volume of exceptions before review time.
- Identity data quality: The freshness, completeness, consistency, and accuracy of the identity and entitlement data that IAM systems rely on. When identity data quality is weak, even well-designed access models produce unreliable outcomes because the control logic is only as good as its inputs.
- Lifecycle Governance: Lifecycle governance is the set of controls that cover creation, assignment, review, rotation, and retirement of identities and credentials. For NHIs, it is the difference between a temporary automation asset and a persistent access risk. Strong lifecycle governance keeps ownership and expiry tied to actual business use.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org