Notifications
Clear all
Topic starter
14/09/2026 10:09 am
TL;DR: Banks can run mature IGA programmes and still fail completeness audits when connector coverage stops at the edge of mainframes, legacy stores and acquired systems, according to Hydden. The real problem is not certification volume but proving the account list is complete, the revocation executed, and the evidence cannot be altered after the fact.
NHIMG editorial — based on content published by Hydden: Banks Have the Most Mature IGA Programs in Any Industry, and They Still Can't Produce a Complete Account List
Questions worth separating out
Q: What breaks when an IGA platform has no discovery layer for unconnected applications?
A: Without discovery, governance only covers the apps already in the system of record.
Q: Why do regulators care about revocation confirmation instead of just approval records?
A: Because an approval shows intent, not execution.
Q: How should banks prove their access reviews are actually working?
A: They should test whether the review process produces a complete account list, durable change history and source-system confirmation for revocations across the full audit period.
Practitioner guidance
- Map every unconnected system in scope Identify mainframes, legacy Unix estates, SQL-backed identity stores, acquired platforms and any system that does not feed the governance connector catalog.
- Separate approval records from execution evidence Retain reviewer, timestamp and rationale alongside a source-system confirmation that the revocation or disablement actually executed.
- Create an append-only identity system of record Store identity change events in a record that cannot be edited or deleted by the administrators whose actions it contains.
What's in the full article
Hydden's full blog post covers the operational detail this post intentionally leaves for the source:
- How the identity system of record reconstructs account history from systems that never wrote usable logs
- How source-system revocation confirmation differs from ticket closure in audit evidence
- How the record links accounts to people or workloads across mainframes, SQL-backed stores and acquired environments
- How the bank-facing evidence model supports SOX, NYDFS, DORA and PCI review requests in different formats
👉 Read Hydden's analysis of why bank IGA programmes still fail completeness audits →
IGA completeness gaps in banks: what identity teams are missing?
Explore further
14/09/2026 10:10 am
Connector completeness is the real control boundary in bank IGA. A mature certification programme does not equal full estate visibility when the platform only covers connected applications. In banking, the systems that escape connector coverage are often the ones regulators care about most, which means the governance boundary is set by architecture rather than policy. Practitioners should treat coverage gaps as a control failure, not as a reporting inconvenience.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- A separate finding in the same report shows that only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, which reinforces how quickly incomplete identity visibility becomes a governance problem.
A question worth separating out:
Q: How can identity teams govern legacy accounts and AI agent accounts under the same model?
A: Use one inventory, one ownership model and one evidence record for both. The difference is that AI agent credentials may be short-lived and harder to observe, so the governance process must rely on authoritative system events rather than periodic snapshots alone.
👉 Read our full editorial: Bank IGA maturity still fails when connector coverage is incomplete
