Should organisations simplify IGA before they improve joiner-mover-leaver processes?

Why simplifying IGA first usually creates avoidable rework

Simplification is attractive because it promises fewer approvals, fewer exceptions, and cleaner automation. But if the underlying joiner-mover-leaver model is inconsistent, a simplification exercise can just make the inconsistency easier to see. In practice, organisations need enough process stability to tell the difference between a bad workflow and a bad control design.

The real issue is not the number of steps, it is whether the steps are anchored to an identity governance foundation that defines ownership, authoritative sources, and access decision rules clearly enough to support automation and review.

When those basics are missing, simplification often removes friction without removing risk. That can leave birthright access, role assignment, exception handling, and offboarding logic exposed in ways that are harder to audit later, especially where different teams believe they own the same access decision.

What has to be stabilised before the workflow can be simplified

First stabilise the decision points that make joiner-mover-leaver reliable: who is the source of truth for hire, transfer, and termination events; which system owns entitlement decisions; and which review rule applies when the request does not fit the standard path. Without that, “simpler” often means “less controlled.”

This is where a practical Joiner-Mover-Leaver guide matters, because it ties process design to provisioning, deprovisioning, and the removal of stale access rather than treating JML as a pure workflow exercise. A useful simplification is one that reduces handoffs after the control logic is already dependable.

Once ownership and authoritative inputs are stable, simplification can focus on eliminating duplicate approvals, collapsing redundant steps, and reducing role noise. At that point, the aim is to make the workflow easier to operate without weakening the control decisions that prevent access creep, orphaned access, and late leaver revocation.

How to tell whether simplification is helping or hiding a control gap

The test is whether the simplified flow still produces consistent outcomes across joiners, movers, and leavers. If the same change request is handled differently by HR, IAM, and the business team, the workflow is not yet ready to be simplified. The same applies when role assignments are not aligned with a clear entitlement model or when manual exceptions dominate the process.

Access review quality is also a strong indicator. If a simplified process increases the number of reviews that cannot be answered with evidence, the design is too shallow. A strong baseline is one where changes can be traced from event to approval to implementation to removal, with a clear owner for each transition.

For organisations that want a structured simplification path, it helps to align the process with an access review and certification approach so that reviews reinforce lifecycle control instead of becoming a separate administrative ritual. A simplification that speeds up the wrong decisions is a net loss.

Risk and Threat Considerations

Weak JML design creates a broad exposure surface because join, move, and leave events are exactly where access should tighten, not drift. If simplification happens before ownership and review rules are stable, the most common failure is lingering access after role change or departure, which can preserve privileges that no longer have a business basis.

Failure mechanism: inconsistent ownership, incomplete authoritative data, or overcompressed approval paths cause access changes to be missed, delayed, or applied unevenly across systems.

Impact: organisations can accumulate access creep, orphaned accounts, and delayed revocation, which increases the blast radius of later misuse and makes remediation harder to prove.

Practitioner Guidance

What to prioritise: stabilise the event source, ownership model, and review rule set before you redesign for simplicity. If those three are not explicit, any workflow cleanup will mostly improve speed, not control quality.

What to verify: every joiner, mover, and leaver path should have a named owner, a clear authoritative source, and an auditable removal point. If you cannot trace where access is approved and where it is revoked, the process is not ready for simplification.

Practitioner takeaway: simplify after the control model is dependable, because simplification is only valuable when it reduces operational friction without flattening the decisions that keep access accurate.

Related resources from NHI Mgmt Group

• How should organisations manage joiner-mover-leaver processes across employees and contractors?
• How should security teams automate joiner-mover-leaver processes in IGA programmes?
• Why do joiner, mover, and leaver processes become a security problem in larger organisations?
• What should organisations do when developer accounts fall outside normal joiner mover leaver processes?