Notifications
Clear all
Topic starter
12/06/2026 12:08 am
TL;DR: Compliance-first IGA leaves financial institutions exposed because access reviews are periodic, narrow, and reactive, while SaaS sprawl, contractors, and role changes continuously reshape permissions, according to Zluri. The governance problem is not audit readiness versus security, but whether identity controls can keep pace with real business change.
NHIMG editorial — based on content published by Zluri: Access Management Evolving IGA in Finance: A Business-First Approach
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities , 46% confirmed, 26% suspected.
Questions worth separating out
Q: What breaks when access reviews are only done quarterly in finance?
A: Quarterly reviews leave long gaps in which role changes, contractor exits, and entitlement exceptions can accumulate unchecked.
Q: Why do org-chart based access decisions create risk?
A: Org-chart based decisions treat formal reporting lines as a proxy for actual need, but modern finance work is often project-based, cross-functional, and temporary.
Q: How do security teams know if business-driven IGA is working?
A: Look for falling revocation latency, fewer orphaned accounts, fewer unused entitlements, and faster completion of access changes after joins, moves, and exits.
Practitioner guidance
- Shorten the access review interval Move from quarterly or annual certifications to continuous or event-driven review triggers tied to role changes, contractor offboarding, and privileged entitlement changes.
- Replace org-chart logic with usage-aware decisions Require reviewers to validate whether access is still used for current work, not just whether it aligns with a job title.
- Automate joiner-mover-leaver controls Connect onboarding, transfer, and offboarding workflows so access changes happen when the business event happens.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- A side-by-side comparison of compliance-driven and business-driven IGA operating models for finance teams
- Detailed workflows for access review, access management, and access request handling across the identity lifecycle
- Examples of automated onboarding, offboarding, and transition playbooks that reduce manual provisioning work
- A practical breakdown of how Zluri positions access review, request, and lifecycle automation inside a broader IGA programme
👉 Read Zluri's analysis of business-driven IGA in finance →
Business-driven IGA in finance: what compliance-first teams miss?
Explore further
12/06/2026 9:12 am
Compliance-first IGA is a review mechanism, not a governance model. The article’s core argument is that passing audits does not mean controlling access in real time. Quarterly or annual reviews can only confirm what was true at a prior moment, which leaves organisations exposed to entitlement drift, role changes, and contractor churn between review cycles. The implication is that identity governance has to be measured by how quickly it can absorb business change, not by how clean the last audit looked.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
- Only 20% have formal processes for offboarding and revoking API keys, which helps explain why access can linger after business change, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own access decisions in a business-driven IGA model?
A: Ownership should be shared, but business approvers must be accountable for need-to-have access while IAM and security teams enforce policy and automate the lifecycle. That division keeps the decision grounded in business reality without turning governance into a manual bottleneck.
👉 Read our full editorial: Business-driven IGA in finance: why compliance-first models fall short
