Why do IGA programmes need more than software capability?

Why This Matters for Security Teams

IGA platforms are often evaluated as if the product itself were the control. In practice, identity governance only works when policy, workflow, review cadence and exception handling are executed consistently across the estate. That is why teams can have a capable tool and still miss access recertifications, approve orphaned accounts or fail to revoke access after role changes. NHI Mgmt Group notes that only 20% of organisations have formal processes for offboarding and revoking API keys, which shows the gap is usually operational, not theoretical, in the Ultimate Guide to NHIs.

The practical issue is that governance outcomes depend on upstream data quality, downstream enforcement and human follow-through. A platform can generate certification campaigns, but if ownership is unclear, entitlements are stale, or approvers are not trained, the control degrades quickly. The same pattern appears in NIST Cybersecurity Framework 2.0, which treats governance as an operating discipline rather than a software feature. In practice, many security teams encounter failed reviews and delayed offboarding only after an audit finding or access incident has already exposed the weakness.

How It Works in Practice

IGA programmes need more than software capability because delivery depends on the surrounding operating model. A strong platform can model roles, connect to HR and directory sources, and orchestrate certifications, but it cannot by itself define who owns an application, decide how exceptions are handled, or ensure that revocation actually happens. Those responsibilities require service ownership, process design, evidence collection and repeatable cadence.

Effective programmes usually combine four layers:

• Policy definition: role models, approval rules, segregation of duties and lifecycle triggers.

• Data integration: reliable feeds from HR, directories, cloud consoles, SaaS apps and ticketing systems.

• Operational workflow: review campaigns, escalation paths, exception handling and remediation deadlines.

• Control validation: checks that access removals, joiner-mover-leaver actions and privileged changes were actually completed.

This is especially important for non-human identities, where the blast radius is often higher and the lifecycle is less visible. The Ultimate Guide to NHIs highlights how widespread secret sprawl and weak rotation create governance failures that no dashboard can fix on its own. Current guidance suggests treating IGA as part of a wider control system, aligned to NIST Cybersecurity Framework 2.0 functions such as govern, identify and protect, rather than as a standalone entitlement review tool.

Best practice is evolving toward measurable operating ownership: named approvers, defined evidence SLAs, and automated remediation for low-risk changes. These controls tend to break down when asset inventories are incomplete and application owners do not respond, because the platform has no authority to resolve ambiguity on its own.

Common Variations and Edge Cases

Tighter governance often increases process overhead, requiring organisations to balance control assurance against business friction. That tradeoff becomes more visible in hybrid estates, where some apps support SCIM or API-based automation while others still rely on manual review and email approvals. In those environments, the software may be fully capable, but the organisation may not yet have the operating maturity to use it consistently.

There is also no universal standard for how much of IGA should be automated versus manually approved. Mature programmes usually automate low-risk, repeatable events such as group membership cleanup, while preserving human review for privileged access, exceptions and sensitive entitlements. For NHI-related governance, the challenge is compounded because ownership can sit with a platform team, a product team or a DevOps group, and those boundaries are often unclear.

That is why many programmes succeed only when they invest in training, RACI clarity, remediation follow-up and audit-ready evidence, not just feature licensing. The Ultimate Guide to NHIs is useful here because it frames governance as lifecycle control, not a one-time review event. Where organisations still rely on spreadsheets, informal ownership and exception-heavy approvals, even a strong IGA platform will struggle to deliver consistent outcomes.

Related resources from NHI Mgmt Group

• What does the 144:1 NHI-to-human ratio mean for IAM governance programmes?
• Why do software asset management tools matter to IAM and IGA programmes?
• Why do software license management tools matter to IAM and IGA programmes?
• Why do passwordless programmes still need strong help desk controls?