IGA governance gaps cost more than the platform itself

At a glance

What this is: This is a cost-model analysis showing that the real burden in IGA is the portion of the application estate that never enters governance, not the platform licence itself.

Why it matters: It matters because IAM and IGA teams often budget for tooling while underestimating the labour, audit, and productivity costs created by manual access handling outside lifecycle control.

Context

Most enterprise IGA programmes only govern a small slice of the application estate, while the rest is handled through tickets, helpdesk queues, and app-owner exceptions. That creates a governance gap: access exists, but the lifecycle controls that should create reviewability, revocation discipline, and audit evidence never reach those applications.

StackBob models that gap as a financial problem, not just a control problem. The article argues that the budget line for licenses and implementation is often the least expensive part of the programme, while manual provisioning, audit remediation, and delayed access make up the larger ongoing cost.

For IAM and IGA leads, the practical question is not whether the platform works on in-scope systems. It is how much of the enterprise remains outside the governed lifecycle, and what that exclusion costs over time.

Key questions

Q: What breaks when IGA does not cover the full application estate?

A: When IGA does not cover the full application estate, joiner, mover, leaver processes fall back to manual handling, access reviews become inconsistent, and audit evidence fragments across local owners and ticket queues. The result is slower fulfilment, higher remediation effort, and a governance model that looks complete on paper but not in practice.

Q: Why do ungoverned applications create both compliance and productivity costs?

A: Because the same missing control causes two different failures. Auditors lose trustworthy lifecycle evidence, while employees wait longer for access changes that should be routine. In practice, that means the governance gap shows up as remediation labour on one side and lost working time on the other.

Q: How should organisations decide which apps to bring under IGA first?

A: Start with the applications that create the highest manual workload, the most access delays, or the most audit exceptions. Those systems usually produce the fastest financial return because they reduce helpdesk effort, shorten JML cycle times, and cut recurring remediation work at the same time.

Q: When does IGA investment become a cost-reduction decision rather than a control decision?

A: When the ungoverned portion of the estate is large enough that manual work, audit remediation, and delayed access outweigh the incremental cost of extending governance. At that point, the business case is no longer only about risk reduction. It is about removing recurring operating expense from identity operations.

Technical breakdown

Why scoped connectors create an IGA coverage gap

IGA platforms only govern applications they can integrate with, so connector scope becomes a control boundary. If an estate includes legacy tools, SaaS without SCIM, or custom applications without usable APIs, those systems remain outside automated joiner-mover-leaver flows, access certification, and revocation logic. The result is a split governance model: some access is policy-driven, while the rest is handled manually by humans. That is not full lifecycle control, only selective control. The risk is structural because the ungoverned population tends to grow faster than implementation projects can follow.

Practical implication: Measure governance coverage by application and user population, not by platform deployment status.

How manual provisioning turns into operating cost

When access requests for ungoverned applications go through tickets or helpdesk queues, each entitlement change consumes human time. The article’s model ties this to repeated provisioning work across many low-visibility systems, which means the cost compounds in staffing rather than appearing as a single project expense. Manual handling also creates inconsistent approval paths, slower fulfilment, and more back-and-forth between requesters, app owners, and IAM teams. Over time, the organisation pays for the same access control process repeatedly because it never became reusable automation.

Practical implication: Track manual fulfilment hours as an identity operating expense tied to each ungoverned application.

Why audit findings and access delays escalate outside governance

Ungoverned applications tend to produce weaker evidence, slower remediation, and more exceptions during audit cycles. The article links that to both higher probability of findings and longer remediation effort because reviewers lack system-native controls and rely on after-the-fact documentation. The same pattern hurts employees and contractors during JML events: when access cannot be provisioned or revoked automatically, delays create productivity loss and lingering access risk. In practice, audit pain and business friction come from the same root cause, which is unmanaged lifecycle execution.

Practical implication: Prioritise the systems where access delay and finding remediation are both recurring, because they reveal the highest-cost governance gaps.

NHI Mgmt Group analysis

Coverage, not licence count, is the real economic unit in IGA. The article shows that platform spend is only a small fraction of programme cost when the application estate remains mostly outside governance. The important question is how much of the estate can actually participate in lifecycle control, certification, and revocation. Practitioners should evaluate IGA as an enterprise coverage problem, not a procurement line item.

Manual access fulfilment is a governance tax that compounds over time. Every application that cannot be automated forces identity teams, helpdesk staff, and app owners back into ticket-based fulfilment. That work is easy to underestimate because it looks like routine operations rather than programme debt. The implication is that unautomated access paths should be treated as recurring operating cost, not as isolated exceptions.

Ungoverned applications create audit and productivity losses from the same control failure. When access cannot be certified or revoked through the normal lifecycle, auditors see weak evidence and employees see delayed access. Those are different symptoms of the same missing governance layer. The implication for programmes is to prioritise the parts of the estate where control absence shows up in both compliance work and business interruption.

Lifecycle governance has to reach the long tail of applications if IGA is going to pay back. The article’s core argument is not that IGA fails, but that limited connector scope leaves most of the value unrealised. That is especially true in estates with legacy tools, SaaS without SCIM, and bespoke applications. Practitioners should treat expansion into those systems as a cost-reduction programme, not just a security enhancement.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Coverage debt becomes the hidden line item in identity programmes. When only a fraction of the estate is governed, the residual applications create a persistent manual tax that grows with every access request and every audit cycle. Programme leaders should treat that ungoverned tail as a financial liability, not an implementation nuisance.

Governance value is realised only when lifecycle control reaches the long tail. The strategic problem is not whether IGA can automate access for a few connected systems. It is whether the organisation can extend certification, provisioning, and revocation into the applications that currently sit outside the control model. Until that happens, the programme will keep paying for exceptions instead of retiring them.

For practitioners

• Map governed versus ungoverned application coverage Build a current-state inventory that shows which applications participate in automated joiner-mover-leaver, certification, and revocation flows, and which still rely on tickets or app-owner handling.
• Quantify manual fulfilment hours by application Measure helpdesk and IAM labour spent on requests for applications outside lifecycle control, then express it as recurring annual operating cost rather than one-off implementation work.
• Prioritise high-friction applications for governance extension Target the systems that generate the most access delays, audit exceptions, and manual provisioning effort, especially legacy apps and SaaS without SCIM support.
• Separate platform spend from governance debt in business cases Model license and services separately from the cost of ungoverned applications, so the budget discussion reflects ongoing labour, remediation, and productivity loss.
• Use lifecycle metrics to justify scope expansion Track the time to provision, certify, and revoke access for in-scope and out-of-scope applications, then use those deltas to prioritise expansion work.

Key takeaways

• The article argues that the biggest IGA cost is not software licensing but the manual work created by applications that never enter governance.
• Its model shows that audit remediation, provisioning labour, and delayed access dominate total cost when the application estate remains mostly outside lifecycle control.
• For practitioners, the financial case for expanding IGA scope rests on reducing coverage debt, not on buying more platform features.

Key terms

• Governance Gap: A governance gap is the distance between knowing an asset exists and being able to enforce policy on it. In identity programmes, it appears when discovery, review, and enforcement are split across different tools or teams, leaving access partially visible but not truly controlled.
• Application Coverage: Application coverage is the share of an application portfolio that has been tested within a defined period. It helps security leaders see whether testing reaches only a small set of crown jewels or extends across the broader estate, including lower-tier apps and APIs that can still create meaningful risk.
• Manual Provisioning Tail: The group of applications and access paths that remain outside automated IGA flows after the core platform is live. This tail is often the hardest part of the estate to govern, because it relies on people, queues, and memory rather than policy-driven execution.
• Lifecycle Control: Lifecycle control is the set of processes that govern access from onboarding through change and removal. In identity programmes, it ensures that provisioning, review, and offboarding stay aligned as applications and permissions evolve. A connector that cannot support lifecycle control may sync data, but it does not fully govern access.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.