Topic starter
02/06/2026 6:55 pm
TL;DR: Identity governance and administration tools often handle requests and deprovisioning, but audit still finds spreadsheet exports, weak evidence trails, and rubber-stamped reviews because control decisions are not anchored in business risk, according to SafePaaS. The gap is not provisioning volume but whether IGA behaves as an independent control layer for compliance.
Editorial analysis by NHI Mgmt Group, based on content published by SafePaaS: “Identity Governance and Administration That Supports Compliance and Audit”.
Key questions
Q: What breaks when IGA is not tied to business risk?
A: Approvals become technical housekeeping instead of control decisions.
Q: Why do access reviews still fail even when IGA is deployed?
A: Because many programmes review entitlement lists without enough context to decide whether each entitlement is appropriate.
Q: How do security teams know if business-driven IGA is working?
A: Look for falling revocation latency, fewer orphaned accounts, fewer unused entitlements, and faster completion of access changes after joins, moves, and exits.
Practitioner guidance
- Define access in business-process terms Map privileged roles and entitlements to order-to-cash, record-to-report, procure-to-pay, HR, and production-change processes so approvers can judge control impact, not just technical role names.
- Generate evidence at decision time Capture who approved, what they approved, when they approved it, and which policy context they saw directly inside the governance record so audit does not need separate exports.
- Prioritise high-impact reviews Scope certification campaigns around sensitive processes, segregation-of-duties conflicts, and critical systems instead of certifying every entitlement with the same intensity.
Bottom line: IGA often improves workflow, but audit exposure persists when risk context and evidence are still assembled manually.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/06/2026 7:09 pm
Audit failure here is a control-design problem, not a connector problem. The article shows that many IGA programmes can move access, but still cannot prove governance. That distinction matters because compliance teams do not audit workflow completion, they audit whether access is approved, reviewable, and defensible in business terms. Practitioners should treat evidence quality as part of the control, not a reporting afterthought.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should organisations govern non-human identities alongside IGA?
A: Use IGA for people and add an NHI-specific control plane for service accounts, API keys, tokens, and certificates. The two layers solve different problems. IGA handles human lifecycle workflows, while NHI governance handles discovery, ownership, rotation, expiry, and decommissioning for machine identities.
👉 Read our full editorial: Identity governance and administration still falls short for audit