Why do strong IAM controls still leave organisations exposed to audit and fraud risk?

Why This Matters for Security Teams

Strong IAM often protects the login boundary while leaving the post-authentication path under-governed. That gap matters in ERP, finance, procurement, and SaaS platforms where a valid session can still trigger approvals, exports, entitlement changes, or payment workflows that create audit and fraud exposure. NIST Cybersecurity Framework 2.0 treats identity as only one part of access governance, not the whole control plane.

NHIMG research on The 52 NHI breaches Report shows how compromised identities become a practical attack path once access is granted. That same pattern applies to human identities when roles are broad, dormant entitlements remain active, or segregation-of-duties conflicts go undetected. The result is that audit teams may see compliant authentication while fraud teams see excessive capability.

The common mistake is assuming MFA, SSO, and periodic access reviews are enough. Those controls reduce account takeover risk, but they do not continuously test whether access is still business-appropriate for the specific transaction. In practice, many security teams encounter fraud risk only after a payment, journal entry, or vendor master change has already been executed, rather than through intentional preventive review.

How It Works in Practice

Effective control needs to shift from “can the user sign in” to “should this user be allowed to perform this action right now.” That means mapping entitlements to business processes, then evaluating access against context such as role, transaction type, location, device trust, approver relationships, and time. Current guidance suggests combining IAM with continuous access governance, policy-as-code, and transaction-level controls rather than relying on static RBAC alone.

For audit and fraud reduction, practitioners usually layer three mechanisms:

• Least privilege with periodic entitlement cleanup to remove dormant or inherited access that no longer matches job function.
• Segregation-of-duties rules that detect conflicting combinations, especially in ERP and finance workflows.
• Just-in-time approval or step-up checks for high-risk actions such as vendor changes, payment releases, or privilege grants.

This is where lifecycle discipline matters. The NHI Lifecycle Management Guide and the Ultimate Guide to NHIs and Regulatory and Audit Perspectives both reinforce the same operational point: access is not a one-time grant, but a lifecycle that should be reviewed, constrained, and retired. For implementation, NIST’s Cybersecurity Framework 2.0 supports the governance side, while transaction monitoring and evidence capture make reviews auditable.

In practice, teams should preserve evidence of who approved access, why it was needed, what changed, and whether the access was actually used. These controls tend to break down in highly customised ERP environments because business logic, workflow exceptions, and delegated approval paths are often too complex to model cleanly.

Common Variations and Edge Cases

Tighter access control often increases approval friction and operational overhead, requiring organisations to balance fraud reduction against process speed. That tradeoff becomes especially visible in shared-service finance teams, mergers, and seasonal operations where one user may legitimately perform multiple functions for a short period.

Best practice is evolving on how far to go beyond RBAC. Some organisations use role mining and SoD matrices; others add risk-based authorisation that adapts to the specific action and business context. There is no universal standard for this yet, but the direction of travel is clear: static roles alone are too blunt for audit-sensitive systems.

Two NHIMG references are especially useful when framing that risk: Top 10 NHI Issues for recurring governance failures, and Ultimate Guide to NHIs and Key Challenges and Risks for lifecycle and privilege pitfalls that also appear in human access models. The same lesson is reflected in the Aembit research cited by NHIMG, which found that 88.5% of organisations say their non-human IAM lags human IAM; maturity gaps often surface first in the places where access must be both broad and precise.

Edge cases include emergency access, shared service accounts, temporary contractor access, and delegated approvals. These are the scenarios where audit trails, compensating controls, and short-lived elevation matter most, because fraud often hides inside exceptions rather than in normal access paths.

Related resources from NHI Mgmt Group

• Why do strong MFA controls still leave organisations exposed to session hijacking?
• Why do MFA controls still leave organisations exposed to ransomware?
• Why do MFA deployments still leave organisations exposed to identity risk?
• Why do network security tools still leave organisations exposed to access risk?