Topic starter
27/06/2026 12:59 pm
TL;DR: Nexis finds that IAM access control degrades as roles, exceptions, and entitlement data drift over time, turning reviews into compliance work instead of risk reduction. The real control problem is sustained data governance, not the initial design of the model.
Editorial analysis by NHI Mgmt Group, based on content published by Nexis: “Data Quality in Identity and Access Management: From Research to Practice”.
Key questions
Q: How should organisations stop IAM reviews from becoming compliance theatre?
A: Treat access reviews as decision-quality controls, not campaign metrics.
Q: Why does IAM data drift create real security risk?
A: Because access decisions are only as accurate as the underlying identity, entitlement, and policy data.
Q: What are the signs that an IAM matching process is failing?
A: Common warning signs include duplicate accounts for the same individual, conflicting attributes across source systems, delayed onboarding, and access that lingers after a role change or exit.
Practitioner guidance
- Audit entitlement data quality as a governance control Measure accuracy, redundancy, complexity, conflicts, and maintainability in the role and entitlement model, then track how each dimension changes over time rather than only at design review.
- Use transaction logs to validate access state Compare access changes, approvals, and entitlement assignments against transaction logs so that review evidence reflects actual process history instead of a static spreadsheet view.
- Separate review completion from review quality Define quality signals for access reviews, such as anomalous approval patterns or repeated excessive access, so the control measures risk reduction instead of campaign closure.
Bottom line: IAM control quality erodes when role, entitlement, and policy data drift faster than governance processes can correct it.
What's in the full report
Nexis's full article covers the operational detail this post intentionally leaves for the source:
- The research methodology used to evaluate IAM data quality across assessment, improvement, and access review scenarios
- The quality dimensions the research consolidated, including accuracy, redundancy, complexity, conflicts, and maintainability
- The role of transaction logs in identifying inconsistent or suspicious authorizations at scale
- The empirical findings from the financial services provider and the semantic abstractions used for SoD policies
👉 Read Nexis's analysis of IAM data quality and access control drift →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:07 pm
IAM data quality is the control, not just the input: Once identity attributes, role definitions, and entitlement mappings drift, the access model itself becomes unreliable. That is why organisations can have a mature IAM platform and still produce weak access decisions. The discipline has to shift from initial design quality to sustained data governance, because the real failure is organisational decay, not feature shortage.
A question worth separating out:
Q: How should teams govern provisioning across human and non-human identities?
A: Treat provisioning as a lifecycle control, not a one-time setup task. The same governance logic should apply to employees, contractors, service accounts, and tokens, with clear triggers for creation, change, review, and removal. The objective is to keep access aligned to current need and to prove that revocation actually happens.
👉 Read our full editorial: IAM data quality is becoming the real access control problem