Topic starter
11/08/2026 3:21 pm
TL;DR: Periodic access reviews, nightly feeds, and manual exceptions cannot keep pace with constantly changing roles and entitlements, according to Fischer Identity. The control model now has to recompute identity state, enforce policy outcomes, and preserve audit evidence as conditions change, not after the fact.
Editorial analysis by NHI Mgmt Group, based on content published by Fischer Identity: “Continuous Identity Isn’t a Buzzword. It’s the Only Way Governance Keeps Up.”.
Key questions
Q: What breaks when identity programmes rely only on periodic governance reviews?
A: Periodic reviews often miss the state of access between certification cycles.
Q: Why do continuous governance models matter for access risk?
A: They matter because live entitlement data, privileged access signals, and threat context produce better decisions than static snapshots.
Q: What are the signs that an identity governance programme is still batch-based?
A: Common signs include nightly feeds, manual exception handling, delayed leaver action, and access reviews that routinely clean up issues discovered long after the change.
Practitioner guidance
- Validate closed-loop enforcement Confirm that policy decisions automatically trigger provisioning, deprovisioning, entitlement changes, and evidence capture without manual handoffs or batch cleanup.
- Stress-test identity resolution Test matching, correlation, deduplication, and precedence rules across HR, SIS, ERP, directory, and application sources before trusting continuous decisions.
- Measure lag between change and enforcement Track how long it takes for a mover, leaver, or source correction to alter downstream access and audit evidence, then compare that lag to your risk tolerance.
Bottom line: Periodic IGA models struggle because they assume identity state is stable long enough for scheduled reviews to be useful.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:32 pm
Continuous Identity is becoming the governance baseline because identity state is no longer stable enough for snapshot controls. Periodic reviews were built for slower-moving environments where access could be judged at discrete checkpoints. That assumption no longer holds when affiliations, entitlements, and source records shift continuously. For IAM and IGA teams, the practical implication is that governance has to be evaluated by how quickly it responds to change, not by how clean the quarterly certification looks.
A question worth separating out:
Q: How can IAM teams decide whether to prioritise continuous identity state?
A: Prioritise it when your environment has overlapping populations, temporary access, frequent role changes, or non-human identities that do not follow a simple hire-to-retire pattern. Those conditions create drift faster than lifecycle processes can reliably clean up.
👉 Read our full editorial: Continuous identity governance is replacing periodic IGA models