Topic starter
27/06/2026 1:01 pm
TL;DR: Nexis says the BearingPoint GRC Study 2025 shows IAM and GRC are converging around identity risk data as regulated organisations respond to supply-chain pressure, DORA requirements, and cyber threats. The governance shift is that access, third-party connections, and toxic combinations now need to be treated as shared risk inputs, not separate IAM evidence.
Editorial analysis by NHI Mgmt Group, based on content published by Nexis: “BearingPoint GRC Study 2025”.
Key questions
Q: How should security teams integrate identity governance into GRC workflows?
A: Security teams should connect access reviews, entitlement changes, and role ownership directly to control records and audit evidence.
Q: Why do third-party access risks become harder to govern in large enterprises?
A: Third-party access becomes harder to govern because the risk sits across contracts, identities, and actual entitlements.
Q: What breaks when IAM and GRC use different identity records?
A: When IAM and GRC use different identity records, certifications, SoD analysis, and risk reporting all drift away from the same truth.
Practitioner guidance
- Map identity data to governance decisions Identify which access, entitlement, and relationship fields are required for risk decisions, SoD analysis, and third-party governance, then make those fields authoritative across IAM and GRC workflows.
- Align third-party access reviews Require every external user, supplier account, and delegated relationship to appear in the same review process used for internal identities, including offboarding and recertification evidence.
- Normalize SoD and toxic combination rules Translate segregation of duties logic into identity-linked policy checks so conflicting access paths are detected before certification, not only during audit sampling.
Bottom line: Identity risk data is moving from a support role into the core governance layer that connects IAM, GRC, and third-party risk.
What's in the full article
Nexis's full article covers the operational detail this post intentionally leaves for the source:
- How Nexis positions NEXIS QSEC within the broader European GRC and IAM convergence
- The BearingPoint study framing around regulatory pressure, language coverage, and modular GRC design
- The integration angle for IAM and IGA data sources in a unified control plane
- The vendor's perspective on enterprise-ready GRC for regulated industries
👉 Read Nexis's analysis of IAM and GRC convergence around identity risk data →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:11 pm
Identity risk data is now operational control data, not just audit evidence. The article points to a market shift where IAM telemetry, third-party access, and risk flags are being consumed by the same governance workflows. That matters because the old model treated IAM as an input to periodic GRC review, while the new model requires live identity signals to shape decisions as access is granted, changed, or revoked. Practitioners should treat identity data as a control surface, not a reporting artifact.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations prioritise identity-driven governance over manual risk review?
A: Organisations should prioritise identity-driven governance when access changes quickly, third parties are numerous, or regulatory reporting must be defensible. In those environments, manual review cannot keep pace with entitlement churn, so identity evidence needs to feed governance continuously rather than only at audit time.
👉 Read our full editorial: IAM and GRC are converging around identity risk data