Public sector IT stalls on budget, procurement, and legacy systems

At a glance

What this is: This analysis looks at why public sector IT modernisation stalls, highlighting budget limits, procurement friction, legacy systems and workforce shortages as the main blockers.

Why it matters: It matters because IAM and IT governance programmes in public institutions have to work within slow procurement and compliance constraints, not assume private-sector change speeds.

By the numbers:

• Many public-sector projects in Europe take about 18 months to obtain approval, according to the International Public Procurement Conference 2023 cited by Efecte.
• 71% of public institutions in Germany say lengthy tender processes slow them down, according to Bitkom Research cited by Efecte.
• Only 32% of European authorities use digital end-to-end workflows, according to a 2023 McKinsey study cited by Efecte.

Context

Public sector IT modernisation is not failing because the technology is missing. It is failing because the operating model around procurement, budget allocation, compliance and staffing is too slow to absorb change at the pace digital programmes require.

For identity and access teams, that matters because public institutions often need to govern users, services and workflows through long approval chains, fixed budgets and legacy integrations. The result is that even well-designed access controls and service workflows can be delayed by the organisational machinery surrounding them.

The article argues that automation, compliance tooling and more flexible working models can reduce friction, but the deeper issue is structural: institutions are trying to modernise while still constrained by processes designed for a slower administrative era.

Key questions

Q: How should public-sector teams modernise IAM when procurement takes too long?

A: They should design for delayed implementation by separating control intent from deployment timing. That means standardising requirements early, predefining approval paths, and choosing changes that can survive long procurement cycles without losing relevance. The goal is to avoid governance models that expire before they are implemented.

Q: Why do legacy systems make compliance harder in public administration?

A: Legacy systems fragment records and force manual handoffs, so policy cannot be executed consistently across identities, services and endpoints. Compliance then becomes a reconciliation exercise instead of a continuous control process. The more isolated the data and workflow layers are, the more likely audit evidence and operational reality will diverge.

Q: What are the first signs that a public-sector IT programme is blocked by governance rather than technology?

A: The clearest signs are repeated delays between approval and implementation, manual workarounds that persist after go-live, and controls that are documented but not consistently enforced. When policy changes move more slowly than the operational environment, the bottleneck is governance throughput, not feature availability.

Q: Should public institutions prioritise automation or platform replacement first?

A: They should prioritise the area where manual effort most directly causes policy failure. If the immediate problem is repetitive governance work, automation can stabilise execution quickly. If the deeper problem is fragmented systems and broken handoffs, platform replacement may be necessary first so automation does not simply accelerate a flawed process.

Technical breakdown

Why procurement latency freezes IT change

Public-sector procurement is not just a purchasing process. It is a control layer that determines when technology can be adopted, integrated, and operated at scale. When approval cycles stretch to 18 months, the organisation is already out of sync with the pace of platform refresh, access redesign, and service automation. In practice, this means security and identity controls are often selected against yesterday’s requirements and then left in place long after operating conditions change. The governance problem is not only delay, but lock-in to outdated assumptions about workload, staffing, and service delivery.

Practical implication: treat procurement lead time as part of the control design, not just a commercial hurdle.

How legacy systems distort access and service workflows

Legacy systems and isolated data structures prevent end-to-end process automation because they force manual handoffs between identity, service management, and business operations. In a modern IAM context, that usually means fragmented account administration, inconsistent approval paths, and duplicate records that make lifecycle governance harder to enforce. The article’s point is that these environments do not simply run slowly. They create governance drift, where the formal policy exists but the operational path to execute it is broken by system boundaries. That is why modernisation efforts often improve visible service metrics before they improve identity discipline.

Practical implication: map where legacy integrations force manual identity decisions and remove those bottlenecks first.

Why automation becomes a governance control, not just an efficiency tool

The article positions automation as a response to budget pressure, staffing shortages, and compliance burden, but its deeper significance is governance consistency. In public-sector environments, automation reduces the number of human-dependent steps that can stall onboarding, license administration, ticket routing, and reporting. That matters because the problem is not only cost. It is the inability to execute policy reliably when skilled staff are scarce and process volume is high. Automation therefore acts as a control amplifier, making constrained organisations more able to apply rules consistently across users, endpoints, and services.

Practical implication: prioritise automation where manual handling most often breaks policy execution.

NHI Mgmt Group analysis

Public-sector IT modernisation is constrained by governance throughput, not by technology availability. The article shows that budgets, procurement, and legacy systems form a control environment that cannot absorb change quickly enough. When service delivery, licensing, and workflow governance all depend on long approval chains, the organisation is effectively rate-limited by administration. Practitioners should treat throughput as a governance variable, not an operational afterthought.

Procurement latency creates a hidden identity governance backlog. Approval cycles measured in months mean access models, service workflows, and platform dependencies are often obsolete by the time they are approved. That is not just a buying problem. It means identity controls are deployed into an environment that has already moved on, which weakens consistency across account provisioning, entitlement reviews, and audit evidence. Practitioners should expect drift whenever governance change has to pass through slow acquisition machinery.

Legacy systems are not merely technical debt. They are policy execution debt. When records are fragmented and workflows are isolated, the organisation can no longer apply one access and service model consistently across the estate. The result is a widening gap between what policy says and what the operational stack can actually enforce. Public bodies need to see legacy replacement as a prerequisite for governable identity and service delivery, not a separate transformation stream.

Automation is becoming the only scalable way to preserve compliance under staffing pressure. The article’s workforce gap points to a structural constraint: fewer experienced staff must still maintain the same control obligations. That makes manual governance brittle, especially where reporting, approvals, and provisioning depend on specialist knowledge. The field should stop treating automation as a convenience layer and start treating it as a compliance continuity mechanism.

Process friction debt: The clearest concept in this article is the accumulation of delays across budget, procurement, and legacy integration that prevent policy from turning into action. This is what makes public-sector modernisation feel perpetually unfinished. The practitioner lesson is to measure not only whether a control exists, but how long it takes to execute it from request to enforcement.

What this signals

Public-sector identity and IT governance programmes increasingly need to be designed around organisational latency, not just control design. When procurement, finance and compliance move more slowly than service demand, the practical target becomes reducing the time it takes for policy to become enforceable.

Process friction debt: the article points to a cumulative drag created when budget approval, tendering, legacy integration and staffing shortages all slow the same change request. For practitioners, that means modernisation programmes should be judged by how quickly they can turn an approved control into an operational one, not by the existence of the control on paper.

For practitioners

• Audit procurement-to-deployment latency Measure how long approved identity, service management, and compliance changes take to reach production, then break the delay into budget, tendering, integration and change-control stages.
• Prioritise automation where manual governance fails most often Focus on onboarding, license administration, ticket routing and reporting workflows that repeatedly stall because staff capacity is limited or approvals are too slow.
• Map legacy integration choke points Identify where isolated data structures force manual handoffs between systems, because those points are where access records, service requests and audit evidence usually diverge.
• Align control design to public-sector budget cycles Plan identity and IT governance changes around funding windows and procurement milestones so the programme does not depend on continuous discretionary spend.

Key takeaways

• The article shows that public-sector IT stalls because budget pressure, procurement delay, legacy systems and staffing shortages all slow execution.
• Its evidence includes 18-month approval cycles, 71% of German public institutions reporting procurement drag, and a 360,000-person skills gap.
• For practitioners, the lesson is to treat governance throughput as a design constraint and remove the handoffs that keep policy from becoming operational.

Key terms

• Governance throughput: Governance throughput is the rate at which an organisation can review, approve, and evidence decisions without creating backlog or inconsistency. In AI programmes, low throughput usually means manual review is outpacing control design, which leads to delayed decisions and uneven enforcement.
• Workflow Friction Debt: The cumulative operational risk created when authentication is so cumbersome that users adopt shortcuts, workarounds, and exceptions to keep work moving. In healthcare, this debt shows up as shared credentials, sticky sessions, reset overload, and weaker auditability, all of which erode control quality.
• Legacy integration choke point: A place where older systems or isolated data structures force manual intervention before a request can proceed. These choke points matter because they break end-to-end governance, especially for access, audit evidence, and service delivery workflows.
• Compliance continuity: The ability to keep required controls operating reliably even when staff, budgets, or operating conditions change. In constrained environments, it depends on automation, standardisation, and process design that can survive long approval cycles.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.