Notifications
Clear all
Topic starter
25/06/2026 1:00 am
TL;DR: Manual tracking of access across ERP, HCM, and CRM systems leaves finance, audit, and security exposed to fraud, Segregation of Duties conflicts, and failed audits, according to Delinea. Application access governance only works when ownership is shared across the business and technical teams that can certify, test, and enforce access decisions.
NHIMG editorial — based on content published by Delinea: Who owns Application Access Governance in an organization?
By the numbers:
- 5% of annual revenue to fraud, al revenue to fraud, with the average case costing $1.7 million.
- 10 to 15 different business applications to manage, ness applications to manage critical functions.
Questions worth separating out
Q: How should organisations assign ownership for application access governance?
A: Ownership should be shared across finance, internal audit, application owners, and IT, with each team responsible for the part of the control it understands best.
Q: What breaks when IT is treated as the sole owner of application access governance?
A: IT can provision access, but it cannot reliably judge whether a role is appropriate for the business process.
Q: How do access reviews and segregation of duties work together in business applications?
A: Segregation of duties identifies conflicting permissions, while access reviews confirm whether those permissions are still needed and whether exceptions remain acceptable.
Practitioner guidance
- Assign business ownership for each critical application Name the finance, audit, or functional leader who can certify access decisions for each ERP, HCM, or CRM platform and document their authority in the governance model.
- Separate SoD policy from provisioning execution Let finance define toxic combinations and remediation rules, while IT executes approved changes and preserves evidence of who changed access and when.
- Automate user access reviews with exception tracking Use continuous review workflows to surface stale roles, inherited permissions, and unresolved exceptions so that review cycles produce action rather than just attestations.
What's in the full article
Delinea's full article covers the operational detail this post intentionally leaves for the source:
- How Fastpath Access Control analyses access risk down to the lowest securable object in business applications
- How Fastpath Access Review automates User Access Reviews and continuous monitoring workflows
- How Fastpath Change Tracking records before-and-after data values for audit evidence
- How Fastpath Access Provisioning replaces email chains and ticketing with approval workflows
👉 Read Delinea's guidance on who owns application access governance →
Application access governance ownership: what teams actually need to own it?
Explore further
25/06/2026 10:09 am
Application access governance fails when ownership is treated as an IT administration problem. The article is right that finance, internal audit, application owners, and IT each hold a different piece of the control objective. Finance understands toxic combinations, audit validates control design, application owners know the real business role, and IT executes provisioning. When one team tries to own the full model, SoD becomes a checkbox exercise instead of a governance control.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to Oasis Security & ESG research.
A question worth separating out:
Q: Who is accountable when excessive access causes fraud or audit failure?
A: Accountability should sit with the business owner of the application, the control owner who defines the SoD policy, and the teams that approve and execute remediation. Regulators and auditors expect clear ownership, not a single technical team trying to absorb every decision. That is why shared governance matters.
👉 Read our full editorial: Application access governance needs shared ownership, not IT alone
