Should organisations rely on IAM alone for identity governance?

Why IAM Is Necessary but Not Sufficient for Governance

IAM is the control plane for granting, denying and federating access, so it is the right place to enforce the initial decision. identity governance asks a different question: does that access remain appropriate over time, across role changes, exceptions, dormant accounts and accumulated entitlements? The difference matters because governance is about proving access is still justified, not just originally approved.

That gap is why organisations pair IAM with governance controls such as access reviews, entitlement ownership and lifecycle enforcement. In practice, the absence of a governance layer is what allows privilege creep, stale access and orphaned accounts to persist even when authentication and authorisation look healthy at the point of login.

For a practical model of that separation, IAM and IGA Basics explains why front-door access decisions and ongoing access governance solve different problems.

What Identity Governance Adds After the Initial Access Decision

Identity governance adds the review and correction loop that IAM by itself does not supply. It covers access certifications, entitlement management, role hygiene, joiner-mover-leaver handling and the evidence needed to show access is still appropriate when business context changes. That is especially important where access is inherited through roles, groups, shared entitlements or indirect application permissions.

Governance also brings accountability. Someone has to own each entitlement, decide whether the access still serves a current business purpose, and remove it when it does not. Without that ownership, organisations usually discover they have access sprawl only after an audit finding, a separation-of-duties conflict or an incident review.

Two common failure modes are role design drift and review fatigue. Role Mining and Role Design Guide shows how unmanaged role growth can hide excess access, while Access Reviews and Certification Guide shows how to make certification campaigns remove access rather than merely rubber-stamp it.

Where the Control Breaks Down in Real Organisations

The practical failure is usually not that IAM is missing, but that it becomes the only control teams trust. Once that happens, dormant accounts, lingering third-party access, stale entitlements and unused elevated privileges can remain in place long after the original business need has expired. The result is governance debt: access that is technically valid but no longer defensible.

This becomes more serious in environments with privileged roles, service accounts, bots or agent-like automation, because those identities can accumulate access quickly and rarely trigger the same human offboarding processes. If entitlement review is too coarse, teams miss the difference between low-risk convenience access and access that can materially change systems or data.

The governance problem is also a lifecycle problem. Joiner-Mover-Leaver (JML) Guide covers the access changes that should happen when people or non-human actors change state, and Segregation of Duties (SoD) Guide shows why approval at grant time is not enough if toxic combinations remain in place later.

Risk and Threat Considerations

When organisations rely on IAM alone, the main risk is access drift: permissions that were once justified but are no longer visible, reviewed or removed. That creates a standing exposure window for overprivilege, misuse, and audit failure, especially where a compromised account or abused entitlement can laterally move through applications or cloud services.

Failure mechanism: IAM validates access at a point in time, but without recurring certification, entitlement ownership and lifecycle correction, excess access persists silently until it is exploited or found in review.

Impact: The organisation inherits broader blast radius, weaker SoD assurance, more difficult incident containment and a higher chance that access records no longer match operational reality.

Practitioner Guidance

What to prioritise: Treat access reviews, entitlement ownership and mover or leaver processing as the control layer that closes the gap after IAM grants access. The highest value work is usually not another login control, but proving who can still do what and why.

What to verify: Each high-risk entitlement should have a named owner, a review cadence and a removal path. If a team cannot explain why a dormant, privileged or shared entitlement still exists, it should be treated as a governance exception, not as an approved control outcome.

Practitioner takeaway: IAM answers “should this identity get in now?”; identity governance answers “should it still be allowed to stay?” and organisations need both if they want access to remain defensible over time.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on reporting alone instead of automated identity governance?
• What breaks when organisations rely on SCIM alone for non-human identity governance?
• Why is it important to integrate identity and data governance?
• What is the difference between human IAM controls and NHI governance?