Why do organisations still end up with privilege creep even with IGA in place?

Why privilege creep survives good IGA tooling

IGA can make access visible, but it does not automatically make removal timely or accurate. privilege creep usually persists when governance is treated as a workflow queue instead of a lifecycle control: access is granted quickly, then recertified too infrequently, with weak ownership for movers, contractors and exception cases.

The practical failure is not usually missing policy, it is the gap between policy and execution. IAM and IGA Basics explains the difference between provisioning, entitlement governance and review, which is where many organisations confuse having a platform with having control.

When that gap exists, old access survives role changes, project exits and informal extensions of duty. That is why privilege creep often grows even in environments that can produce reports, approvals and attestations, because the lifecycle event that should trigger removal is not reliably enforced end to end.

Where the control breaks in the lifecycle

Privilege creep is usually a joiner-mover-leaver problem first and an IGA problem second. The access model may look sound on paper, but if a move is not captured as a formal entitlement change, or if a leaver event does not flow cleanly to every target system, the orphaned access remains in place.

Joiner-Mover-Leaver (JML) Guide is directly relevant because it focuses on removing old-role access and revoking the tokens, keys and agents that people leave behind. That matters in practice because lifecycle failures often happen at the handoff points between HR, line managers, app owners and platform teams.

Another common break point is role design. If roles are too broad, too static or created as one-off exceptions, review campaigns simply rubber-stamp accumulated privilege instead of reducing it. Role Mining and Role Design Guide supports this issue by showing how role explosion and poor role maintenance feed excess access over time.

Why reviews alone do not stop accumulation

Access reviews help only when they are context-rich, timely and tied to actual remediation. In many organisations, reviewers see stale titles, incomplete business context or bloated access lists, so they approve what they do not fully understand. The review happens, but the entitlement stays.

Access Reviews and Certification Guide is useful here because it emphasises removing access, not just recording a review. The practitioner lesson is that certification quality matters more than certification volume, especially when reviewer fatigue or poor application ownership turns the process into a formality.

IGA also struggles when entitlement ownership is diffuse. If nobody is clearly accountable for a role, application, or exception path, then revocation becomes negotiable. That is why strong programmes define who can approve access, who can remove it, and who is responsible when a review uncovers excessive privilege but action is delayed.

Risk and Threat Considerations

Privilege creep is a security exposure because excess access increases the blast radius of mistakes, insider misuse and compromised accounts. It also creates stale permissions that attackers can abuse if a forgotten entitlement, dormant account or overbroad role remains reachable after the business need has passed.

Failure mechanism: Access is granted through normal workflow, but revocation depends on manual follow-up, inconsistent ownership or periodic cleanup that does not keep pace with real job changes and contractor exits.

Impact: Organisations accumulate dormant or overprivileged access, which raises the chance of unauthorized data access, privilege escalation and lateral movement when an account is misused or compromised. OWASP Non-Human Identity Top 10 and ISO/IEC 27001:2022 Information Security Management both reinforce the need for controlled access, review and removal of unused privilege.

Practitioner Guidance

What to verify: Check whether mover and leaver events automatically trigger entitlement removal in all target systems, not only in the central IGA console. If revocation still depends on a ticket, email or manual approval chain, the control is weak even if the review report looks healthy.

What to prioritise: Focus first on access that creates the largest blast radius, such as admin roles, shared accounts, long-lived contractor access and exceptions that have no expiry. Those are the fastest paths from routine privilege creep to material exposure.

Common mistake: Treating periodic access certification as a substitute for lifecycle enforcement. Reviews are necessary, but they do not prevent creep if grants remain easy and removals remain optional or slow.

Practitioner takeaway: Privilege creep is usually an execution failure, not a tooling failure, so the control objective is continuous entitlement hygiene, measurable revocation, and clear ownership for every access change.

Related resources from NHI Mgmt Group

• Why do phishing campaigns still work even when organisations have security tools in place?
• Why do organisations still struggle with sensitive data exposure even when they have DLP controls in place?
• Why do weak or reused passwords still create risk even when organisations have detection tools in place?
• Why do organisations still need step-up verification after strong authentication is in place?