How should financial institutions move from compliance-first IGA to business-driven governance?

From periodic review to event-driven governance

Business-driven governance starts by tying access to the moments that change entitlement need: onboarding, role change, promotion, transfer, leave, contractor expiry, control exceptions, and account recovery. In that model, governance is not a calendar exercise. It becomes a decision layer that keeps access aligned to current duties, current systems, and current risk.

The practical difference is that compliance-first IGA often treats review completion as the outcome. Business-driven governance treats joiner, mover, and leaver processes as the control point and uses them to remove stale access as soon as the business event occurs. That reduces reliance on retrospective cleanup and makes entitlement drift visible earlier.

What changes in access decisions

In a business-driven model, the question is not simply whether a user once had a valid reason for access. The question is whether the access is still justified by current job function, active usage, segregation of duties, and exposure to sensitive processes. That means access decisions should use more than role membership alone, because roles can lag behind real organisational change.

Practitioners usually get better results when they combine lifecycle events with usage signals and entitlement risk. A dormant privilege that has not been used for months, a role that no longer matches the employee's function, or an approval path that keeps reissuing the same excessive access are all signs that governance is not connected closely enough to business reality. Strong governance depends on a foundation in IAM and IGA basics so that entitlement changes, ownership, and review logic are all linked to the same operating model.

Designing governance around ownership, roles, and recertification

Financial institutions need ownership clarity before they can shift governance from control evidence to business outcomes. Someone must own the role model, the entitlement catalogue, and the decision rules that say when access should be granted, retained, downgraded, or removed. Without that ownership, reviews become a reporting exercise and every exception turns into a manual dispute.

Role design matters because overly broad roles and role explosion both defeat business-driven governance. If a role bundles too many capabilities, review teams cannot make meaningful decisions. If roles are fragmented, reviewers rubber-stamp because the model is too complex to understand. Good practice is to keep recertification focused on access reviews and certification that close the loop, but to use those reviews as a control input rather than the end state.

For financial institutions, segregation of duties should also be part of the same governance conversation. If a business process creates toxic combinations, periodic review alone will not reliably prevent misuse. The control has to be embedded in role design, approval logic, and exception handling, so that the organisation prevents conflicting access instead of merely documenting it after the fact. A well-run role mining and role design program helps keep this aligned with how the business actually operates.

Risk and Threat Considerations

Compliance-first governance creates blind spots when access is technically reviewed but not operationally corrected. The main risks are entitlement creep, excessive privilege persisting after job changes, and delayed revocation when people move or leave. Those gaps become more serious in regulated environments because they can expose trading, payments, client data, or privileged operations to the wrong population.

Failure mechanism: access stays approved because the review process is satisfied, even though the underlying business need has disappeared or changed. That allows stale entitlements, unresolved SoD conflicts, and unused but still-active access paths to accumulate.

Impact: the institution carries unnecessary exposure until the next review cycle or incident, which increases the chance of unauthorized action, audit findings, and avoidable remediation work.

Framework Alignment

Practitioner Guidance

What to prioritise: start with the access paths that change most often and carry the highest business impact, such as joiner-mover-leaver flows, privileged roles, and sensitive operational accounts. These are the places where event-driven governance produces the fastest reduction in stale access.

What to verify: before trusting a governance process, verify that every entitlement has an owner, a review trigger, and a removal path tied to a real business event. If those three elements are missing, the process is still mostly compliance theatre.

Practitioner takeaway: the shift is successful only when governance becomes operationally corrective, not just evidentiary, so the test is whether access changes when the business changes.

Related resources from NHI Mgmt Group

• Should organisations prioritise external exposure or internal credential governance first?
• How should financial institutions use identity governance for DORA and NIS2 compliance?
• How should financial institutions implement cyber governance and evidence collection for NYDFS Part 500 compliance?
• How should financial institutions use blockchain and fintech together to modernise governance, risk, and compliance processes?