Topic starter
20/01/2026 12:51 pm
TL;DR: IGA implementations often fail because teams start without clear business objectives, underestimate integration complexity, and leave ownership, data quality, and ongoing maintenance unresolved, according to Twine Security. The deeper issue is not tooling alone but governance design: identity programs fail when lifecycle control, stakeholder accountability, and operational realism are treated as afterthoughts.
Editorial analysis by NHI Mgmt Group, based on content published by Twine Security: “6 Common Causes of Failure in IGA Projects”.
By the numbers:
- IT projects tend to run 45% over budget, 7% over time, and deliver 56% less value than predicted, according to a McKinsey study cited by Twine Security.
- IT projects deliver 56% less value than predicted, according to a McKinsey study cited by Twine Security.
Key questions
Q: What breaks when IGA is implemented without clear business objectives?
A: Without clear objectives, IGA becomes a collection of disconnected workflows that satisfy audit activity but do not reduce risk.
Q: Why does poor data quality undermine AI-driven identity governance?
A: AI systems are only as reliable as the data they consume.
Q: Where do IGA projects usually fail in practice?
A: They fail at the handoff points between governance and operations.
Practitioner guidance
- Define business outcomes before configuring controls Tie the programme to a small set of measurable outcomes such as audit reduction, access-risk reduction, or joiner-mover-leaver accuracy before selecting workflows or certification scopes.
- Assign explicit ownership across HR, IT, and business teams Document who owns identity lifecycle decisions, who approves access exceptions, and who maintains the authoritative sources that drive provisioning and recertification.
- Clean identity and entitlement data before expanding automation Resolve duplicate identities, conflicting source records, and unclassified entitlements before relying on automated provisioning or review logic.
Bottom line: IGA projects most often fail because governance design, ownership, and lifecycle clarity are missing before the tool is even configured.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:16 pm
IGA failure is usually an operating-model failure before it is a tool failure. The article shows that organisations underestimate how much identity governance depends on business ownership, lifecycle clarity, and process discipline. When joiner-mover-leaver ownership is unclear, the tooling simply exposes the absence of decision rights. Practitioner conclusion: treat IGA as a governance programme with systems support, not the other way around.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How do organisations know whether their IGA programme is actually working?
A: Look for fewer orphaned accounts, fewer unresolved SoD conflicts, and a lower rate of redundant approvals in certification campaigns. If the programme is healthy, access reviews should produce cleaner entitlement data and fewer exceptions over time, not just higher completion percentages.
👉 Read our full editorial: IGA project failures show why identity governance breaks at scale