What breaks when identity assurance is left to departments alone?

When identity assurance is left to departments, what stops being comparable?

What breaks first is not the local process, it is the ability to compare one service against another with any confidence. If departments choose their own checks, evidence formats and review thresholds, the centre cannot tell whether a strong result in one area means the same thing in another. That makes assurance look distributed while actually becoming uneven.

Department-led assurance also tends to drift toward local convenience, which means the control objective gets interpreted differently across teams. One group may treat document review as enough, another may rely on a system flag, and a third may accept manual sign-off with little evidence. The result is a patchwork that is hard to govern, hard to audit and hard to trust.

For a government-wide model, the critical question is whether the assurance standard is defined once and applied consistently, or whether each department is free to improvise. If the latter happens, the centre loses comparability of control design, evidence quality and residual risk, which undermines procurement confidence and makes resilience oversight much weaker than it appears on paper. For identity proofing control baselines, the central standard should align with NIST SP 800-63 Digital Identity Guidelines and be reflected in shared assurance rules rather than local interpretation.

Why fragmented assurance weakens governance and resilience

Fragmentation creates a governance problem because assurance becomes tied to departmental maturity instead of a common standard. The centre may receive reports, but those reports do not mean the same thing if each service defines identity verification, evidence retention or exception handling differently. That is especially damaging where procurement or oversight depends on a clear answer to a simple question: can we trust this service at the same assurance level as the rest?

It also creates resilience risk. When assurance evidence is inconsistent, you cannot easily spot where access decisions are brittle, where exception rates are high or where review processes are failing under load. Weak comparability hides weak practice, and hidden weakness is exactly what makes assurance ineffective during incidents, audits or service transitions.

In practice, central oversight works only when the assurance model is standardised enough to support benchmarking and escalation. That is why a common digital identity framework matters for government services, and why cross-border identity models such as eIDAS 2.0, the EU Digital Identity Framework are useful references for understanding how comparable trust conditions are created at scale.

Where departments are left to define their own evidentiary standard, the centre often ends up validating process artefacts instead of actual assurance quality. That is a false sense of control: the paperwork exists, but the underlying confidence in identity verification and access vetting does not transfer cleanly across organisational boundaries.

What should the centre standardise to avoid assurance drift?

The practical fix is to standardise the assurance model at the level of required outcomes, evidence and exception handling, while allowing departments flexibility only in implementation details. The centre should define what counts as acceptable verification, what evidence must be retained, how exceptions are approved and when a service must be escalated for review. Without that, each department will optimise for speed or convenience in slightly different ways.

The assurance model also needs a common taxonomy for comparing services. If one team records identity checks as a binary pass or fail and another records multiple assurance layers, the centre cannot aggregate risk meaningfully. Shared definitions make it possible to spot outliers, benchmark control strength and decide where remediation should happen first.

For practitioners, the most useful control is a repeatable assurance pattern that is visible across services, not a one-off approval that looks strong in isolation. NHIMG’s Identity Security Programme Guide is useful here because the programme question is really about operating model, RACI and governance, not just individual checks. Where identity assurance includes proofing or onboarding, the evidence standard should also be anchored to a defined proofing baseline such as Identity Proofing and KYC Guide, so departments do not invent their own threshold for trust.

Practitioner Guidance

What to verify: Check whether every department is using the same assurance criteria, the same exception path and the same evidence retention rule. If those three are not aligned, the apparent control coverage is not comparable enough for central oversight.

Decision rule: If a service cannot explain its identity assurance in a way that can be benchmarked against other services, treat it as a governance gap, not merely a local process variation. If the centre cannot compare like with like, it cannot defend procurement decisions or resilience claims.

What practitioners underestimate: The biggest failure is often not a weak individual check, but inconsistent interpretation of a strong check. A control that means one thing in one department and something looser elsewhere does not scale into assurance, it scales into ambiguity.

Practitioner takeaway: Central assurance is about comparability, not micromanagement, and the benchmark is whether the centre can trust the same evidence to mean the same thing everywhere.

Related resources from NHI Mgmt Group

• What breaks when online betting platforms rely on login credentials alone for identity assurance?
• When does a machine identity become a compliance problem?
• Why is it important to integrate identity and data governance?
• When does secret exposure become a broader identity risk?