When should finance teams prioritise access governance over new authentication methods?

Why access governance should come before authentication upgrades

Authentication answers who is presenting a credential, but finance risk often sits in who still has access, why they have it, and whether that access should still exist. If shared accounts, stale entitlements, or unclear ownership are already present, a stronger sign-in method can improve proof of login without fixing the underlying access model.

That distinction matters most in finance because entitlements tend to accumulate around payment runs, reconciliations, journal approvals, treasury tools, and vendor platforms. If the access catalogue is inaccurate, new authentication can even make weak governance look healthier than it is.

access governance gives you the control plane: inventory, ownership, review, approval, revocation, and segregation of duties. Authentication is still important, but it is usually the second move when the problem is not sign-in strength but access lifetime, entitlement sprawl, or account sharing.

What good access governance fixes that authentication cannot

Good governance removes standing access that should not exist, not just risky logins. It also forces decisions about role design, entitlement scope, and account responsibility, which is why it is the right first priority when teams cannot explain why a user, contractor, or service account has a permission.

The practical signal is simple: if you cannot name the owner, business justification, and expiry condition for an entitlement, then adding MFA, passkeys, or SSO does not reduce the business risk enough. The access path may become harder to abuse, but the excess privilege remains.

Finance teams also need governance when different systems create different trust assumptions. A treasury workstation, a shared admin account, and a vendor support login may all authenticate well while still violating least privilege, segregation of duties, or review discipline. Governance is what aligns those access decisions across systems.

For a broader control model, the IAM and IGA Basics guide is a useful reference for separating authentication from authorization and lifecycle control, while the Access Reviews and Certification Guide shows how to turn that separation into review and recertification practice.

When to defer new authentication and clean up access first

Prioritise access governance first when the environment shows entitlement drift, dormant accounts, or role ownership gaps. Those are signs that the main exposure is not weak login assurance but unmanaged access accumulation.

That includes cases where finance teams rely on shared mailboxes, generic admin accounts, or inherited permissions from old projects and acquisitions. It also includes situations where access recertification is missing or purely ceremonial, because that usually means nobody is actively removing entitlements that no longer match current duties.

Once governance is stable, authentication upgrades become much more effective because they are protecting a cleaner access estate. If you fix the sign-in method first, you may still leave excess access in place for months or years, which preserves the blast radius even when authentication is strong.

Resources such as the Joiner-Mover-Leaver (JML) Guide and the Segregation of Duties (SoD) Guide are especially relevant when the main problem is who can keep access, change access, or approve their own work.

Risk and Threat Considerations

In finance, weak access governance creates direct exposure to fraud, unauthorized payment activity, and hidden privilege accumulation. Stronger authentication can reduce credential abuse, but it does not stop misuse by people or processes that already hold unnecessary access.

Failure mechanism: Stale entitlements, shared accounts, and weak ownership allow an attacker or insider to operate inside legitimate access paths, while authentication improvements leave the underlying privilege structure intact.

Impact: The result can be unauthorized approval, payment diversion, segregation-of-duties failure, delayed detection, and wider blast radius if a legitimate account is compromised.

Practitioner Guidance

What to prioritise: Start with the access set that can move money or approve exceptions, not with the broadest sign-in population. In finance, the highest-value cleanup is usually privileged or high-impact business access that has no clear owner or expiry.

Decision rule: If an entitlement cannot be justified, attributed, and recertified, treat it as a governance defect and remove or narrow it before you invest in new authentication rollouts. If the access model is already clean, then authentication improvements can be sequenced as a meaningful second layer.

What to verify: Confirm that access reviews produce actual removals, that shared accounts are being phased out, and that SoD conflicts are detectable rather than accepted by default. Good authentication is valuable, but only after the organisation can show who truly needs each permission.

Practitioner takeaway: In finance, authentication hardens the front door, but access governance reduces the number of keys, the number of owners, and the number of ways a legitimate credential can still cause loss.

Related resources from NHI Mgmt Group

• When should organisations prioritise lifecycle governance over new access features?
• When should security teams prioritise biometric authentication over PIN-only access for workforce logins?
• When should teams prioritise data access governance over entitlement cleanup?
• When should teams prioritise database access governance over platform convenience?