Why do movers create more access risk than joiners or leavers?

Why movers are the highest-friction point in the identity lifecycle

Movers are riskier because they are not a clean start or a clean exit. A mover event has to remove access tied to the old role and grant access tied to the new one, often across multiple systems and approval paths. That dual action is where entitlement drift, stale access, and role creep show up most clearly, especially when changes are handled manually or out of sequence.

In practice, joiners are usually evaluated against a known baseline and leavers are judged by whether access was fully removed. Movers are harder because the organisation must decide what should stay, what should go, and what needs a temporary overlap. That makes movers the best test of whether access control is actually role-aware rather than just account-aware. NHIMG’s Joiner-Mover-Leaver (JML) Guide and IAM and IGA Basics both reinforce that lifecycle handling and entitlement governance have to work together, not as separate workflows.

When movers are not re-evaluated promptly, access accumulates. The person keeps old permissions, receives new ones, and often retains standing privileges that no longer match their current duties. That is why movers are a strong indicator of whether a role model, request process, and review cadence are keeping pace with the organisation’s actual operating model. NHIMG’s NHI Lifecycle Management Guide is a useful parallel for how lifecycle discipline reduces access drift when identities, credentials, and ownership change over time.

Why movers create more exposure than the other two JML events

Joiners mostly need the right starting access, while leavers mostly need access removed. Movers combine both problems in one transaction, so a single failure can leave behind unnecessary access and create a new path that was never meant to coexist with the old one. That overlap increases blast radius because the user may temporarily have privileges from two job states at once.

This is also where audit evidence gets messy. If the old role is not revoked cleanly, reviewers may see a technically approved change but miss that the user still holds entitlements from a prior function. In fast-moving organisations, movers can also expose weak role design because the business role changes faster than the entitlement model can express it. The result is not only more access than intended, but also weaker proof that the access granted was actually justified.

NHIMG’s Insider Threat and Identity Guide and SCIM and Automated Provisioning Guide are relevant here because mover risk increases when entitlement changes depend on slow reviews, brittle integrations, or incomplete deprovisioning logic.

What good mover handling looks like in practice

A well-run mover process treats the role change as a bounded entitlement transition, not a simple update to a profile record. The organisation should know which access is inherited, which is removed, which requires approval, and which must be time-limited during transition. Without that clarity, teams tend to preserve old access “just in case”, and that is how access creep becomes normalised.

Automated checks help, but only if they are paired with authoritative role ownership and review. The important control question is whether the new role is the source of truth for what access remains valid after the move. If the answer is unclear, the process will drift toward accumulation instead of replacement. For that reason, movers are usually the best place to test access recertification quality, role engineering quality, and deprovisioning discipline at the same time.

For practitioners managing both people and machine-like identities, NHIMG’s Workforce Identity Security Guide and Top 10 NHI Issues help frame the same principle: lifecycle changes are the moment when access hygiene either holds or starts to decay.

Practitioner Guidance

What to prioritise: Treat mover events as high-risk entitlement transitions, not routine profile edits. The first thing to validate is whether old access is explicitly removed before or alongside new access, especially for privileged or cross-environment permissions.

What to verify: Check that role change evidence shows both sides of the transaction, removal and granting. If your audit trail only proves the new access was added, you do not have assurance that the previous access was retired.

Common mistake: Teams often automate joiners and leavers well enough, then assume movers will “mostly work” through the same workflow. Movers need tighter exception handling because they are the point where access accumulation is most likely to hide.

Decision rule: If a mover keeps any access outside the new role’s minimum set, treat it as an exception that needs explicit expiry or reapproval. If the overlap is not time-boxed, it is usually just residual privilege wearing a temporary label.

Practitioner takeaway: The real mover risk is not the role change itself, it is unmanaged overlap. If your process cannot prove clean removal plus justified regranting, it is producing entitlement debt.

Related resources from NHI Mgmt Group

• Why do movers create more identity governance risk than joiners and leavers?
• Why do role changes and department transfers create more access risk than joiners and leavers?
• How should identity teams prioritize joiners, movers, and leavers when they are trying to reduce real access risk?
• How should security teams govern NHI access across joiners, movers, and leavers?