Should identity governance review sit inside business-led procurement for IDV?

Why Business-Led Procurement Alone Is Too Narrow for IDV

Identity verification decisions do not stop at commercial fit, because the real risk sits in who is trusted, under what evidence, and with what review threshold. When procurement is business-led without identity governance input, teams tend to optimise for speed, price, and local convenience while missing inconsistent assurance levels, weak exception handling, and uneven acceptance of fraud exposure.

The practical issue is not whether the business can choose a vendor, but whether the organisation can prove that each chosen IDV route meets a common control bar. Without that, one department may accept biometric checks, another may rely on lighter evidence, and a third may approve exceptions informally. That creates fragmented trust standards and makes fraud controls harder to defend.

What Identity Governance Should Own Before Adoption

Identity governance should sit upstream of adoption decisions and define the control logic procurement must satisfy. That includes approval for risk acceptance, minimum assurance thresholds, acceptable exception paths, data handling expectations, and the review points needed before any customer or identity workflow goes live.

This is also where governance keeps the organisation honest about scope. An IDV tool may be purchased for onboarding, recovery, or age assurance, but each use case can require a different assurance level, retention posture, and escalation path. Treating all of them as one procurement decision usually hides the control gaps that later become audit or fraud issues.

For a broader governance view of lifecycle, review, and ownership, NHI management teams often start with IAM and IGA Basics, then narrow the decision to the specific assurance and review model the use case needs.

Why Inconsistent IDV Procurement Becomes a Fraud and Control Problem

When different teams buy different IDV services independently, attackers and fraud rings look for the softest route. The issue is not only weak verification, but also inconsistency: the easiest department to bypass becomes the organisation's weak point, even if other teams use stronger controls.

That is why exceptions matter so much. A temporary override, manual workaround, or vendor-specific tolerance can create a permanent control gap if no one owns follow-up. Consistency, traceability, and revocation discipline matter more than the branding of the verification product.

Identity teams often pair that lesson with structured access governance such as Access Reviews and Certification Guide and with Segregation of Duties (SoD) Guide when approval, exception, and remediation responsibilities need clearer separation.

Governance Patterns That Help Procurement and IDV Stay Aligned

Business and procurement still have an important role, but they should work inside governance guardrails rather than around them. The useful pattern is a shared decision model: business teams define the use case and operating constraints, procurement manages commercial evaluation, and identity governance signs off on risk thresholds, control evidence, and exception conditions.

That model works best when the organisation standardises a small set of approved assurance patterns instead of allowing every team to negotiate its own version. It also helps to keep vendor selection separate from policy approval, so a preferred supplier cannot quietly become a preferred control standard.

For teams evaluating platforms and operating models, the most useful internal navigation is often IGA Buyer's Guide, because it ties vendor choice back to lifecycle, review, and governance requirements rather than feature checklists alone.

Practitioner Guidance

What to prioritise: Put the governance decision before the commercial decision whenever IDV affects trust, onboarding, recovery, or fraud exposure. If the use case can create account creation, access grant, or step-up trust, it needs a defined assurance threshold before procurement closes.

Decision rule: If a department wants to adopt a different IDV control set, require a documented risk acceptance and an explicit exception expiry, not an informal local agreement. If it cannot be reviewed or revoked centrally, it is not a durable control choice.

What good looks like: The organisation has one approved assurance baseline, a small number of named exception paths, and clear ownership for periodic review. Procurement can move quickly, but only inside a control model that identity governance can defend.

Practitioner takeaway: Speed is acceptable only when governance has already defined the trust boundary; otherwise procurement becomes the mechanism by which inconsistency is introduced at scale.

Related resources from NHI Mgmt Group

• Why is it important to integrate identity and data governance?
• Who should own governance when autonomous agents sit inside business workflows?
• Who is accountable when business-critical apps sit outside the identity governance framework?
• Should preference centers sit inside identity governance or privacy operations?