Risk Function

What a risk function is in identity governance

A risk function is a discrete activity that becomes risky when it combines with another activity in a way that creates exposure. In identity governance, the term is used to model whether two or more permissions, roles, applications, or workflow steps form a toxic combination that could enable inappropriate access or action.

That framing matters because most governance failures are not caused by a single entitlement in isolation. The problem appears when individually reasonable functions line up to create a path to data, approval, privilege, or transaction abuse.

How risk functions are used to detect toxic combinations

Risk functions help governance tools and reviewers reason about combinations, not just individual grants. A role might be harmless on its own, but if it can also approve its own requests, administer downstream systems, or trigger sensitive workflows, the combined function set becomes materially more dangerous.

This is why risk-function analysis sits close to segregation of duties, entitlement review, and role design. It gives organisations a vocabulary for spotting conflicts across business roles, application permissions, and automated workflows before those combinations are provisioned broadly.

In practice, the unit of analysis is often the action itself: create, approve, deploy, export, pay, change, or revoke. A risk function is the thing that matters from a control perspective, because exposure is created by the ability to perform that action in the wrong context or alongside another conflicting action.

Why the concept matters for access and workflow design

Risk functions are useful because modern access models are compositional. A person or process may hold many small privileges that look safe independently, but together they can bypass review, alter records, or move sensitive data without effective oversight.

The concept also helps teams move beyond coarse role-based thinking. If the only question is whether someone is “in the right role,” it is easy to miss that the role contains multiple conflicting functions that should be separated, delayed, or conditionally approved.

For workflow-heavy environments, the same logic applies to automation. A workflow step that requests access, approves access, and then executes the privileged action is a classic example of function combination that should be treated as a control concern, not just an efficiency gain.

Common failure patterns and governance implications

Risk functions usually become visible when organisations discover entitlement creep, role mining gaps, or approval paths that let one actor both request and validate the same sensitive action. The governance issue is less about the label and more about whether the control model can actually prevent conflicting functions from converging.

Definitions and implementation vary across vendors, so teams should be careful not to treat every “risk” term as equivalent. In one tool, the function may represent a business action; in another, it may map to a technical permission or workflow step. The governance rule is the same: the combination must be assessed in the context where it creates exposure.

Used well, risk-function modelling gives identity and access teams a precise way to express separation-of-duties requirements, review toxic combinations, and explain why certain access patterns should be blocked even when each individual entitlement looks legitimate.

Risk and Threat Considerations

Risk functions matter because exposure often arises from the combination of privileges, not from a single permission. When toxic combinations are not detected, an identity can accumulate enough authority to approve, modify, and execute sensitive actions without an effective independent check.

Failure mechanism: A conflicting set of functions is granted across roles, applications, or workflows, allowing one actor to move from access to approval to execution without segregation of duties.

Impact: The result can be unauthorized transactions, fraudulent approvals, data manipulation, or privilege abuse that is difficult to spot after the fact.

Practitioner Guidance

What to watch for: Treat any role or workflow that combines request, approval, and execution as a candidate toxic combination. The same applies when a user or process can both administer access and use the access it administers.

Governance implication: Build reviews around functions that create exposure when paired, rather than around isolated entitlements. That approach is more effective for modelling separation of duties and for explaining why a combination must be remediated or compensating controls added.

Related resources from NHI Mgmt Group

• Who should own broken function-level authorization risk in an enterprise?
• Why do compromised build and function hosts increase non-human identity risk?
• When do organisations need a dedicated model risk function rather than folding AI oversight into the engineering team?
• What breaks when crypto firms treat compliance as a simple approval layer instead of a risk management function?