Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Many organisations treat SailPoint as the system of record for access governance while critical applications, administrative paths, lifecycle events, and audit evidence still sit outside governed workflows, leaving teams dependent on spreadsheets, screenshots, and local reconciliations for SOX and regulatory assurance, according to SafePaaS. That split model means governance is only real where coverage, evidence, and process integrity extend beyond the platform.
NHIMG editorial — based on content published by SafePaaS: a SailPoint governance coverage scorecard for audit and compliance teams
By the numbers:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
Questions worth separating out
Q: How should IAM teams identify where SailPoint governance stops and manual control starts?
A: Start by mapping every critical application, administrative path, and lifecycle change against the governed workflow.
Q: Why do access certifications still feel weak even when reviews are completed on time?
A: Because timeliness does not equal decision quality.
Q: What breaks when security teams rely on screenshots and spreadsheets as audit evidence?
A: Point in time evidence goes stale the moment it is captured.
Practitioner guidance
- Map governed scope against actual access paths Compare certified applications, admin channels, service desk routes, and direct changes against the true high-risk application set.
- Rebuild certification views around entitlements Expose underlying privileges, not just roles, so reviewers can judge business and financial risk.
- Replace screenshot-based audit support with traceable evidence chains Link request, approval, SoD result, provisioning action, remediation, and final sign-off into one auditable trail.
What's in the full article
SafePaaS's full article covers the scoring detail this post intentionally leaves for the source:
- The section-by-section scoring rubric for application coverage, certification quality, audit evidence, process integrity, and business adoption.
- The normalised scoring formula for environments that legitimately need N/A scoring.
- The interpretation bands that turn a score into a practical governance readout for audit and compliance teams.
- The suggested next-step assessment areas for identifying which access paths, evidence gaps, and local workarounds need attention.
👉 Read SafePaaS's SailPoint governance coverage scorecard →
SailPoint coverage gaps: why audit evidence still goes manual?
Explore further
25/08/2026 6:11 pm
Centralised IAM tooling does not equal centralised governance. A platform may be the system of record for some certifications, yet still leave critical applications, administrative channels, and evidence paths outside controlled scope. That means the governance model is split even when the tool appears embedded. The practical conclusion is that programme maturity should be measured by governed coverage, not by platform deployment alone.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, according to the 2025 State of NHIs and Secrets in Cybersecurity.
- 62% of all secrets are duplicated and stored in multiple locations, according to the 2025 State of NHIs and Secrets in Cybersecurity.
A question worth separating out:
Q: Who is accountable when access governance relies on parallel local processes?
A: Accountability shifts to the business and application owners that created the exception, not the central IAM team alone. If a critical system is handled outside the governed workflow, the organisation must assign ownership for the gap, define the evidence it should produce, and track closure through audit.
👉 Read our full editorial: SailPoint governance coverage often stops short of audit reality
