What signs show that an IGA programme is still checkpoint driven?

What “checkpoint driven” looks like in an IGA programme

A checkpoint-driven iga programme behaves like a periodic inspection system rather than a continuously governed one. Access is allowed to drift until a review cycle forces people to notice it, so the programme’s output is mostly findings, exceptions and cleanup work instead of stable, policy-driven access decisions. That usually means the organisation has review events, but not enough upstream automation, ownership clarity or lifecycle control to stop bad access from accumulating.

One practical sign is that the programme measures activity by campaign completion rather than by how little drift exists between campaigns. If most value appears only when access reviews and certification begin, the control plane is probably reacting to stale entitlements instead of preventing them. In a mature model, review cycles confirm exceptions; they do not serve as the main discovery engine for expired or excessive access.

Another sign is that access removal depends on human reviewers noticing issues that should already be machine-detectable. When long certification cycles and heavy reviewer workload dominate, the programme is telling you it is too dependent on periodic checkpointing. That is especially visible where IAM and IGA basics are not reflected in day-to-day provisioning, deprovisioning and entitlement governance, so access decisions age faster than the process that is supposed to govern them.

A third sign is that large volumes of cleanup tickets appear after every campaign. That indicates the programme is uncovering the same classes of problems repeatedly, such as orphaned access, role misalignment, stale entitlements or delayed deprovisioning. When the remediation queue is consistently larger than the control team can absorb, the review process is acting like deferred maintenance instead of a governance loop.

Why the drift keeps reappearing

Checkpoint-driven IGA usually persists because identity lifecycle events are not closing the loop soon enough. If joiners, movers and leavers are not feeding timely changes into the entitlement model, the organisation ends up compensating with periodic certification rather than with controlled lifecycle transitions. That is why joiner-mover-leaver governance matters: it reduces the amount of access that has to be rediscovered later.

Role quality is another common cause. Weak role design, role sprawl and poorly governed exceptions force reviewers to interpret every access item manually, which slows certification and makes cleanup the default outcome. Good role structure should make access obviously correct most of the time, which is why role mining and role design belongs in the conversation whenever a programme keeps finding the same access patterns at each checkpoint.

Checkpoint behaviour also shows up when segregation of duties is enforced only after the fact. If conflicts are repeatedly discovered during review campaigns, the model is acting as a detective control instead of a preventive one. A healthier programme resolves or blocks toxic combinations earlier, as outlined in segregation of duties practice.

What practitioners should do differently

The fastest way to judge whether an IGA programme is still checkpoint driven is to ask where the first reliable signal appears. If the first signal is a certification campaign, the programme is late. If the first signal is provisioning, workflow, ownership or policy enforcement, the programme is becoming operationally continuous. That is also why lifecycle coverage and access governance should be read together rather than treated as separate projects, as lifecycle management is what stops access from becoming review inventory.

What to verify: Check whether new access, moves and removals are being handled before the next review cycle, and whether reviewers are confirming exceptions rather than discovering entire categories of unmanaged access. If campaigns keep producing the same cleanup patterns, the programme needs better upstream controls, not a more intense review calendar.

What to measure: Track the proportion of access changes that are resolved through automated or workflow-driven lifecycle events versus the proportion fixed during certification. Also watch time-to-removal for access that should have expired, because repeated lag there is one of the clearest indicators that the programme is checkpoint driven rather than governed in flow.

Practitioner takeaway: If the programme only becomes accurate during review windows, the real control is the checkpoint itself, not the identity process. Mature IGA reduces how much reviewers must discover, because the system prevents or retires stale access before it becomes a campaign finding.

Related resources from NHI Mgmt Group

• What signs show that an NHI programme is still built around standing access?
• What signs show that a PAM programme is still built for static environments?
• What signs show that an IGA programme is too dependent on custom project work?
• What signs show that an authentication programme is still too easy to relay?