What do organisations get wrong when they rely on old-fashioned identity governance processes in a cloud and digital transformation environment?

Why Old Identity Governance Breaks Down in Cloud Transformation

Old-style identity governance assumes a slower world: stable applications, fixed entitlement catalogs, and review cycles that can wait for people to approve exceptions by hand. In cloud and digital transformation programmes, that model becomes a bottleneck because access changes are continuous, infrastructure is elastic, and business teams expect fast delivery. When governance cannot keep pace, organisations start accepting stale access, delayed offboarding, and incomplete visibility as normal operating conditions.

The deeper problem is that manual process design often treats governance as a checkpoint at the end of delivery instead of an operating control embedded into the workflow. That works poorly when identities, roles, and resource relationships change daily across SaaS, cloud platforms, APIs, and automation pipelines. The result is not just administrative friction but weaker assurance that access decisions still match business need. Current guidance from the NIST Cybersecurity Framework 2.0 supports a more adaptive governance posture, because static review alone does not provide enough resilience for fast-changing environments.

In practice, teams usually notice the failure only after review queues back up, access exceptions multiply, and nobody can confidently explain who still has access to what.

How Modern Governance Actually Has to Work

In cloud environments, identity governance has to follow the pace of change rather than the calendar of a quarterly review. That means provisioning, certification, and revocation need to be connected to authoritative sources such as HR, workload orchestration, and cloud policy, so that access reflects current role, environment, and risk state. It also means governance must account for non-human identities, because service accounts, workload credentials, and automation permissions often outlast the human roles that created them.

Old-fashioned governance usually breaks because it relies on broad role buckets and manual attestations that do not capture how access is actually used. A better model narrows the scope of standing access, automates low-risk decisions, and sends only ambiguous or high-impact cases to humans. That keeps reviewers focused on exceptions instead of forcing them to re-approve routine entitlements at scale.

One useful way to think about this is that governance in a cloud programme is less about periodic inspection and more about continuous control of identity drift. If access can be granted through self-service, infrastructure-as-code, or API-driven automation, then revocation and recertification must be equally automated or the control degrades quickly. NHIMG research on the Ultimate Guide to NHIs is especially relevant here because it shows how unmanaged machine access, stale secrets, and weak lifecycle control become systemic problems when environments scale.

• Use workflow to route common requests automatically and reserve manual approval for exceptions that truly need judgment.
• Attach entitlements to current business context, not to a static job title that may no longer reflect the user’s work.
• Track privileged and non-human access separately, because their lifecycle, ownership, and review cadence are not the same.
• Measure how quickly access is removed after role change, termination, or system decommissioning, not just how many reviews were completed.

These controls tend to break down when cloud permissions, SaaS roles, and automation credentials are governed by different teams with different sources of truth.

Common Failure Patterns in Cloud and Digital Transformation

Tighter governance often increases coordination overhead, so organisations have to balance control quality against delivery speed. The common mistake is to modernise the user interface while leaving the operating model unchanged, which means a faster cloud estate still depends on slow approval chains and fragmented ownership. Another frequent failure is treating access reviews as proof of control, even when reviewers are only confirming stale records that no longer reflect actual use.

Best practice is evolving toward identity governance that is event-driven, not purely calendar-driven. That matters when employees move between product teams, contractors churn rapidly, or cloud resources are created and destroyed by automation. It also matters when organisations assume that human-centric governance is enough, because service accounts and API keys can accumulate privilege invisibly unless they are inventoried, owned, and reviewed as first-class assets.

Where organisations get this wrong, they usually overestimate how much risk a manual process can absorb and underestimate how much trust cloud platforms place in identities once they exist. NHIMG’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is useful for understanding why lifecycle discipline matters when credentials and access paths persist beyond their intended use.

Practitioner takeaway: the goal is not to preserve familiar approval habits, but to make governance adaptive enough that access changes remain accurate, timely, and attributable as the environment keeps moving.

Related resources from NHI Mgmt Group

• What do organisations get wrong when they try to run access reviews across cloud and on-premises systems?
• How should organisations approach identity governance when they want both open source control and digital sovereignty?
• What do teams get wrong when they rely on alerts alone for identity security remediation?
• What do organisations get wrong about account discovery when they rely on PAM or IGA alone?