Topic starter
14/09/2026 10:09 am
TL;DR: Banks can run mature IGA programmes and still fail completeness audits when connector coverage stops at the edge of mainframes, legacy stores and acquired systems, according to Hydden. The real problem is not certification volume but proving the account list is complete, the revocation executed, and the evidence cannot be altered after the fact.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “Why Access Reviews at Banks Fail an Audit”.
Key questions
Q: What breaks when an IGA platform cannot see every account in a bank estate?
A: The completeness claim breaks first.
Q: Why do completeness gaps create audit risk even when access reviews are on schedule?
A: Because a scheduled review only proves that a decision was made on a given date.
Q: What are the signs that identity governance evidence is too narrow for bank audits?
A: The usual signs are manual account lists, ticket closures standing in for revocation, missing owner fields on privileged accounts, and systems whose identity changes never make it into the record.
Practitioner guidance
- Map the real estate before the audit does Build an independent inventory of every system that can hold financially relevant accounts, then reconcile it against the IGA connector catalog to expose blind spots in mainframes, legacy stores, and acquired platforms.
- Require source-system revocation evidence Treat ticket closure as workflow evidence only and require a confirmation from the system that actually holds the account, especially for privileged, service, and legacy application accounts.
- Separate the record from the control plane Store identity review, ownership, and revocation history in an append-only record that administrators of the governance platform cannot edit or delete.
Bottom line: Banks can have mature certification programmes and still fail audits when connector coverage leaves critical systems outside the governed estate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Connector coverage, not certification volume, is the real completeness control: Mature IGA programmes can still fail because the platform only governs what it can reach. In banks, the missing systems are often the ones that matter most, including mainframes, acquired environments, and SQL-backed identity stores. The practitioner conclusion is that completeness must be measured against the estate, not the certification queue.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
A: They need a single evidence model that ties each account to an owner, records review decisions, and confirms changes in the source system. For legacy and acquired platforms, the governance process must be built around what the system can prove, not around what the IGA workflow would like to assume.
👉 Read our full editorial: Bank IGA maturity still fails when connector coverage is incomplete