Notifications
Clear all
Topic starter
08/07/2026 6:55 pm
TL;DR: Mid-sized companies are still relying on scripts, spreadsheets, and manager approvals to run access reviews, leaving audit evidence fragmented and risky, according to OpenIAM. Manual workforce IAM does not just slow compliance cycles, it preserves standing access, hides excessive privileges, and turns every audit into a governance stress test.
NHIMG editorial — based on content published by OpenIAM: Workforce Identity & Access Management for Mid-Sized Companies
By the numbers:
- 80%+ of breaches involving insiders exploit inactive accounts or excessive privileges.
- The average breach costs $4.45 million.
- Audit prep time can be reduced by up to 70% when evidence is centralised and generated automatically.
Questions worth separating out
Q: How should organisations modernise workforce access reviews without creating more audit overhead?
A: Start by centralising entitlement data, then automate review workflows around role changes, elevated access, and leaver events.
Q: Why do manual access reviews fail to control privilege creep in mid-sized companies?
A: Manual reviews fail because they are too slow, too fragmented, and too dependent on human memory.
Q: What do teams get wrong about segregation of duties in workforce IAM?
A: They treat segregation of duties as a policy checkbox rather than an active control.
Practitioner guidance
- Replace spreadsheet certifications with a single entitlement source of truth Consolidate access data from HR, finance, SaaS, cloud, and on-prem systems before review cycles begin.
- Trigger reviews on role and privilege changes Use event-driven certifications for department moves, access elevations, and leaver events so governance occurs when risk changes.
- Enforce least privilege and SoD at every access decision Apply policy checks when access is requested, when roles change, and when exceptions are approved.
What's in the full article
OpenIAM's full article covers the operational detail this post intentionally leaves for the source:
- A workflow view of how access reviews move from data collection to approval to revocation in mid-sized environments.
- Examples of auditor-ready reporting formats for SOC 2, GDPR, HIPAA, and PCI DSS evidence packs.
- Detailed descriptions of event-driven certifications and change-highlight workflows for managers.
- Specific segregation of duties and risk-scoring features used to flag high-risk entitlements.
👉 Read OpenIAM's analysis of workforce IAM compliance for mid-sized companies →
Workforce IAM for compliance: what mid-sized teams need to fix?
Explore further
08/07/2026 7:17 pm
Manual workforce IAM is a control failure, not a resource constraint. The article shows that spreadsheets, manager bottlenecks, and audit fire drills are not just inefficient. They create a governance condition where access decisions are delayed, incomplete, and difficult to verify. In practice, that means the organisation is trying to prove least privilege after the fact, when the evidence trail is already fragmented. For practitioners, the lesson is that manual certification is itself a risk surface, not a neutral process.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when access remains active after an employee leaves or changes role?
A: Accountability sits with the identity governance process owner, because leaver and mover events should trigger timely revocation or re-certification. If access survives the lifecycle change, the organisation has a governance failure, not just an administrative delay. That failure affects audit posture, insider risk, and operational trust.
👉 Read our full editorial: Workforce IAM compliance gaps are the hidden risk for mid-sized firms
