Operating-model fit

What operating-model fit means in practice

Operating-model fit is about whether a platform can actually live inside the organisation’s real governance rhythm, who owns decisions, how often reviews happen, where data moves, and who escalates exceptions. It is a practical fit test, not a feature checklist.

A tool may look strong on paper and still be a poor choice if it assumes faster approvals, different segregation of duties, or a more centralised control model than the business really uses. That is why fit is judged against operating reality, not vendor intent.

Why operating-model fit matters for control performance

Security controls only work when they match the process that people will actually follow. If a platform does not align with review cadence, ownership boundaries, or escalation paths, controls tend to drift into exceptions, manual workarounds, or missed approvals.

That mismatch often shows up as “shadow process” behaviour, where teams preserve the outcome they need but bypass the platform to get there. The control may still exist, but its assurance value drops because the platform is no longer the system of record for governance decisions.

How to assess fit against governance, ownership, and scale

The most useful questions are operational: who will approve, who will certify, who will remediate, and who will be accountable when something is stale or wrong. If the platform cannot support those answer paths cleanly, it will usually create friction at scale.

Fit also depends on how the organisation handles change over time. A platform that works for a small central team may fail once governance becomes federated, review cycles lengthen, or different business units need different controls. The same is true when reporting, audit evidence, or exception handling must cross team boundaries.

For organisations formalising identity governance and programme structure, NHIMG’s Identity Security Programme Guide is a useful companion because it frames ownership, RACI, roadmap, and governance as operating-model decisions rather than tool features.

What operating-model fit tells you about platform selection

Operating-model fit is often the deciding factor when several tools appear functionally similar. Two platforms can offer similar controls, but only one may support the organisation’s review frequency, approval hierarchy, evidence needs, or escalation rules without heavy customisation.

It also helps distinguish true capability gaps from adoption gaps. If the organisation expects one workflow but the platform is built for another, the problem is not just configuration, it is a mismatch between governance design and control implementation.

That is why fit should be treated as a structural requirement, not a late-stage usability concern. Once governance, ownership, and escalation do not line up, the platform will usually become harder to operate, harder to evidence, and harder to sustain.

Practitioner Guidance

Governance implication: Evaluate operating-model fit by checking whether the platform can support the organisation’s actual approval chain, review cadence, ownership model, and exception process without forcing brittle workarounds.

Practitioner takeaway: A platform that is technically strong but operationally awkward will usually fail in the control layer first, then in the audit layer, then in user adoption.

Related resources from NHI Mgmt Group

• What should small teams do when standard SOC 2 controls do not fit their operating model?
• What happens when organisations buy security tools that do not fit their current infrastructure or operating model?
• Shared Responsibility Model
• How do non-human identities fit into a product ownership model?