Why do unmanaged privileges and dormant accounts create compliance risk in banking systems?

Why unmanaged privileges and dormant accounts become a banking control problem

When access is not actively reviewed, privilege tends to outlive the business need that justified it. In banking, that matters because entitlements often reach core payments, customer records, treasury workflows, and reconciliation systems. Dormant accounts and unmanaged privileges are therefore not just hygiene issues, they are evidence that control ownership, recertification, and revocation are failing in ways auditors can test.

That failure shows up in two directions. First, old access paths can still be used even when the original user no longer needs them. Second, the organisation may no longer be able to prove who can reach what, which makes it harder to demonstrate least privilege, segregation of duties, and timely removal of access after role change or departure.

For financial institutions, the compliance consequence is often less about a single bad login and more about control drift. A dormant account that still has effective rights over customer data or payment functions creates a gap between policy and reality, which is exactly the kind of mismatch regulators and internal audit look for.

• Ultimate Guide to NHIs is useful here because it frames excessive permissions, inactive accounts, and governance gaps as lifecycle problems, not isolated technical findings.
• NHI Lifecycle Management Guide helps connect provisioning, access review, and offboarding to the practical question of when access should be removed rather than merely monitored.

How compliance frameworks interpret the exposure

Most banking compliance regimes do not require the exact phrase “dormant account” to appear in a finding before it matters. They care about whether access is restricted to business need, whether privileged access is controlled, whether changes are reviewed, and whether deprovisioning is timely. If a stale account can still operate in production, the control objective has not been met even if no abuse has been observed.

That is why unmanaged privileges are often treated as a governance failure across multiple obligations. Weak entitlement management can undermine auditability, increase the likelihood of unauthorized or excessive access, and create evidence gaps when the organisation must show that controls operated consistently over time. In banking, those issues can surface in access review failures, SoD violations, orphaned admin rights, and weak joiner-mover-leaver discipline.

A useful way to think about the issue is that compliance is testing whether access state matches current organisational intent. If it does not, the bank may be able to explain the exception, but it will struggle to show that the exception is controlled, approved, and time-bounded.

• ISO/IEC 27001:2022 Information Security Management supports the need to govern access, privileged rights, and authentication as part of a managed ISMS.
• SOC 2 Trust Services Criteria (AICPA) is relevant where banking workflows or service providers must demonstrate controlled access, confidentiality, and traceable operations.
• PCI DSS v4.0 is a useful external benchmark when payment systems or cardholder data environments are in scope, because it expects least privilege and tightly managed accounts.

What practitioners should verify before they call the control effective

What to verify: check whether dormant accounts are truly disabled, removed, or just ignored in reports. Validate that privileged entitlements are recertified on a schedule, that exceptions have expiry dates, and that access reviews cover both human users and shared or technical accounts where they can affect banking operations.

What good looks like: the bank can produce a current inventory of privileged and inactive accounts, show who owns each account, and demonstrate that access changes are tied to role changes, approvals, and revocation events. The best signal is not simply fewer accounts, but a lower gap between access approval, business need, and actual enforcement.

Practitioner takeaway: treat dormant accounts and unmanaged privileges as a control integrity issue, not an account cleanup task, because the compliance risk comes from being unable to prove that access is current, necessary, and revocable.

Related resources from NHI Mgmt Group

• Why do manual user access reviews create higher risk for credit unions with core banking systems?
• Why do unmanaged Google Cloud permissions create compliance and breach risk for sensitive data?
• Why do non-human identities create more audit risk than human accounts?
• Why do non-human identities create compliance risk even when policies exist?