Identity governance and administration still falls short for audit

At a glance

What this is: This article argues that IGA often covers requests, approvals, and deprovisioning, but still fails audit because evidence, risk context, and decision ownership are scattered across tools.

Why it matters: That matters because IAM and IGA programmes are judged by control outcomes, not workflow coverage, and audit-ready governance must prove who approved access, why, and under what policy.

Context

Identity governance and administration is the control layer that decides who gets access, under what conditions, and for how long. In many enterprises, the tooling exists, but the governance outcome still depends on exports, side reports, and manual reconciliation when audit asks for proof.

The article’s central point is that workflow alone does not satisfy SOX or ITGC expectations. If access reviews are rushed, evidence is scattered, and business risk is not visible at decision time, the platform behaves like a provisioning hub rather than an independent control layer.

Key questions

Q: What breaks when IGA is not tied to business risk?

A: Approvals become technical housekeeping instead of control decisions. Without process context, reviewers cannot tell whether access creates segregation-of-duties conflicts, supports sensitive transactions, or violates policy. The result is low-quality certification, inconsistent revocation decisions, and audit findings that question the strength of the control environment rather than the volume of activity.

Q: Why do access reviews still fail even when IGA is deployed?

A: Because many programmes review entitlement lists without enough context to decide whether each entitlement is appropriate. Managers see names and roles, not the business process or risk exposure behind them, so reviews either become rubber stamps or overcorrection. Audit then finds incomplete evidence and weak certification discipline.

Q: How do security teams know if business-driven IGA is working?

A: Look for falling revocation latency, fewer orphaned accounts, fewer unused entitlements, and faster completion of access changes after joins, moves, and exits. If review outcomes improve but stale access still persists between cycles, the programme is only documenting risk instead of reducing it.

Q: How should organisations govern non-human identities alongside IGA?

A: Use IGA for people and add an NHI-specific control plane for service accounts, API keys, tokens, and certificates. The two layers solve different problems. IGA handles human lifecycle workflows, while NHI governance handles discovery, ownership, rotation, expiry, and decommissioning for machine identities.

Technical breakdown

Why workflow-only IGA breaks down under audit

IGA workflows can route requests and deprovision accounts, but audit needs something stricter: a control layer that can explain access decisions in business terms. When approvers only see user IDs and technical roles, they cannot judge segregation-of-duties risk, transaction authority, or whether a role maps to a sensitive business process. The result is a gap between administrative automation and control assurance. That gap becomes visible when auditors ask for policy, approval context, and evidence in one place. Practical implication: design IGA around decision quality, not just request throughput.

Practical implication: separate process automation from control evidence so approvals reflect risk, not just ticket closure.

How evidence fragmentation weakens compliance outcomes

When approval history lives in IGA, execution data lives in ERP or SaaS logs, and exception context lives in email or ITSM, auditors get a stitched-together story instead of a controlled record. That fragmentation undermines the claim that the identity platform is the system of record for access governance. It also makes reviews slower, because teams must reconstruct who approved what, when, and under which policy. Practical implication: centralise evidence generation so review artefacts are created at decision time, not assembled after the fact.

Practical implication: generate time-stamped evidence at the point of approval and retain it with the access decision.

Why risk-aware access reviews matter more than volume

Periodic reviews that treat every entitlement equally create noise. High-risk access gets buried under low-risk line items, so managers either rubber-stamp the list or revoke access without understanding business impact. The technical problem is not access review frequency by itself, but review scoping and context. Risk-aware governance prioritises critical processes, sensitive entitlements, and conflicting access patterns so reviewers can focus on what actually changes control exposure. Practical implication: move from blanket certification to risk-ranked recertification backed by business context.

Practical implication: scope recertification by business criticality and separation-of-duties risk instead of by raw entitlement count.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Audit failure here is a control-design problem, not a connector problem. The article shows that many IGA programmes can move access, but still cannot prove governance. That distinction matters because compliance teams do not audit workflow completion, they audit whether access is approved, reviewable, and defensible in business terms. Practitioners should treat evidence quality as part of the control, not a reporting afterthought.

Risk context is the missing layer between provisioning and assurance. When approvers cannot see process sensitivity, transaction authority, or segregation-of-duties exposure, the governance decision collapses into organisational convenience. That is why rubber-stamped reviews keep recurring even where IGA is deployed. The practitioner takeaway is to anchor access decisions in business risk instead of role labels alone.

Independent evidence generation is the named concept this article exposes. The real control gap is not that approvals do not happen, but that they are not captured as audit-grade artefacts at the time of decision. When evidence must be reconstructed from ERP, ITSM, and email, the control layer is no longer independent. Practitioners should regard auditability as a design requirement for IGA, not a downstream integration problem.

IGA maturity should be measured by decision quality, not workflow coverage. A platform that handles joiners, movers, and leavers but cannot prioritise high-impact access or preserve decision context is operationally useful yet control-poor. That is the wrong optimisation target for SOX, ITGC, and similar assurance regimes. The implication is clear: the governance layer must own policy, context, and proof, or audit will keep finding the gaps.

Non-human identities should be governed with the same audit discipline as human access. The article briefly notes that service accounts, bots, and AI agents also need lifecycle oversight, and that is the right boundary to draw. If an identity can affect business processes, it needs ownership, review, and evidence even when no person logs in interactively. Practitioners should extend IGA control expectations across every identity class that can change financial or operational outcomes.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Independent evidence generation is the control boundary that many IGA programmes still have not crossed. If audit evidence must be reconstructed from multiple systems, the programme is optimising administration while leaving assurance partially manual. The governance layer has to create the proof at the moment of decision, not after the fact.

Access review quality matters more than review cadence when high-risk entitlements are buried in bulk recertification campaigns. A programme can be very active and still be weak if reviewers do not see business context, segregation-of-duties exposure, and process sensitivity.

The same governance expectation should extend to service accounts, bots, and AI agents whenever they can influence financial or operational outcomes. If an identity can change a business process, it needs ownership, evidence, and lifecycle control, regardless of whether a human signs in interactively.

For practitioners

• Define access in business-process terms Map privileged roles and entitlements to order-to-cash, record-to-report, procure-to-pay, HR, and production-change processes so approvers can judge control impact, not just technical role names.
• Generate evidence at decision time Capture who approved, what they approved, when they approved it, and which policy context they saw directly inside the governance record so audit does not need separate exports.
• Prioritise high-impact reviews Scope certification campaigns around sensitive processes, segregation-of-duties conflicts, and critical systems instead of certifying every entitlement with the same intensity.
• Track non-human identities in lifecycle governance Assign owners, review cycles, and offboarding triggers to service accounts, bots, and AI agents so machine access does not sit outside the same governance discipline as human access.
• Test whether audit can self-serve evidence Ask internal audit to retrieve a complete approval trail for one high-risk access case without help from ERP or SaaS administrators and treat any manual stitching as a control weakness.

Key takeaways

• IGA often improves workflow, but audit exposure persists when risk context and evidence are still assembled manually.
• The recurring failure mode is not missing provisioning, but weak proof that access decisions were defensible at the time they were made.
• A stronger control model makes the governance layer responsible for policy, context, and evidence, not just requests and deprovisioning.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
• Audit-Ready Evidence: Audit-ready evidence is access proof that can be retrieved directly from the control system without manual reconstruction. It should show who approved access, what policy they used, when the decision occurred, and whether any exceptions or compensating controls were applied.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.