Topic starter
08/07/2026 6:56 pm
TL;DR: Audit frameworks generally require defensible oversight, separation of duties, and evidence that access decisions are reviewed consistently, but they do not prescribe quarterly certifications or fixed governance cycles, according to OpenIAM. The real test is whether identity governance reduces exposure, not just whether it produces audit-ready documentation.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “What Audit Frameworks Actually Require from Identity Governance”.
Key questions
Q: What should teams do when audit requirements push governance into fixed review cycles?
A: Teams should separate the audit objective from the operating model.
Q: Why do identity governance failures create audit and compliance risk?
A: Because auditors need evidence that access was approved, appropriate, and reviewed, not just technically granted.
Q: What are the signs that a governance programme is optimised for documentation instead of control?
A: Common signs include completion metrics that dominate reporting, attestation timestamps that matter more than entitlement outcomes, and large evidence archives with little tracking of privilege reduction.
Practitioner guidance
- Separate oversight from cadence Define the governance outcome as demonstrable review and approval of access decisions, then choose the cadence that best fits the systems and risk profile involved.
- Measure exposure change after each campaign Track whether certification rounds reduce unnecessary entitlements, high-risk access, and unresolved conflicts.
- Tie segregation of duties to real enforcement Require review workflows to remove, restrict, or escalate conflicting access when SoD issues appear.
Bottom line: Audit frameworks generally demand defensible oversight and separation of duties, but they do not usually prescribe a fixed certification cadence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:19 pm
Audit frameworks require oversight, not a specific governance cadence. The central requirement is that access decisions are monitored, conflicts are controlled, and evidence exists to show those controls operate consistently. A quarterly certification campaign may support that objective, but it is an implementation choice, not a universal mandate. Practitioners should stop treating the schedule as the requirement and start treating oversight as the requirement.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How do organisations know whether access reviews are working?
A: Access reviews are working when they lead to timely removals, reduced exception volume, and role definitions that stop accumulating unused rights. If the same accounts keep reappearing with the same excess access, the review process is only producing paperwork. Evidence of change is the real success signal.
👉 Read our full editorial: Audit frameworks require oversight, not rigid identity governance cycles