Topic starter
08/07/2026 7:01 pm
TL;DR: Enterprises often misread access review fatigue, privilege sprawl, and audit pressure as IAM platform failure when the real issue is governance design, while true modernization needs usually show up as scale, integration, or end-of-life constraints, according to OpenIAM. The separation matters because replacing infrastructure does not fix broken review models or verification gaps.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “IAM Modernization vs Identity Governance: When to Replace vs Redesign”.
By the numbers:
- A global bank running quarterly certification campaigns across 200+ applications found reviewers approved over 80% of access in bulk without validating risk.
Key questions
Q: What breaks when identity governance is missing from an IAM programme?
A: The main failure is entitlement drift.
Q: When should organisations modernise IAM instead of redesigning governance first?
A: They should modernise when the current platform cannot scale, cannot integrate with SaaS or API-driven services, cannot support modern identity models, or is approaching end of life.
Q: How do teams know whether access review fatigue is a process issue?
A: A strong sign is when reviewers approve large batches of access without meaningful validation because the process gives them too much volume and too little context.
Practitioner guidance
- Redesign review scope around risk Prioritise privileged roles, sensitive data access and cross-system entitlements instead of running blanket quarterly certification on every account.
- Separate governance defects from platform constraints Map each pain point to either enforcement, integration, scale or control-design failure before approving any replacement business case.
- Trigger reviews from events, not only calendars Use role changes, transfers and privilege escalation as review triggers so the process reflects real access movement instead of fixed cycles.
Bottom line: Many IAM replacement projects are really responses to governance design problems, especially when review fatigue and audit pressure drive the decision.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:24 pm
Governance pain is frequently mistaken for platform failure: bulk approvals, review fatigue and audit pressure often point to a broken certification model rather than an obsolete IAM engine. When access decisions are poorly scoped, a new platform simply inherits the same decision logic. The practitioner conclusion is to diagnose the layer before approving replacement spend.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What is the difference between IAM and identity governance?
A: IAM enforces access at runtime, while identity governance decides which access should exist in the first place and whether it remains appropriate. IAM handles authentication and permission checks. Governance handles policy, approvals, certifications, segregation of duties, and revocation. Both are needed, but governance is what makes access defensible to auditors and risk teams.
👉 Read our full editorial: IAM modernization vs identity governance: when to redesign instead