Source Of Record

What a source of record does

A source of record is the system that governance teams treat as the authoritative basis for a decision. In identity programmes, that usually means one system is trusted to define a person, account, entitlement, or membership state, while other systems consume, mirror, or report on it. The value is less about storage and more about decision authority.

Because the source of record drives governance outcomes, its records must be stable, owned, and reconcilable. If two platforms disagree, the organisation needs a clear rule for which one wins, otherwise reviews, recertifications, and access decisions become inconsistent or hard to defend.

Why the concept matters in identity governance

Source of record is not the same thing as every downstream reporting or provisioning system. A directory, HR platform, cloud console, or ticketing system may each hold useful data, but only one should be treated as the governing record for a given attribute or lifecycle event. That distinction prevents duplicate authority and reduces ambiguity during access reviews.

In practice, the term often appears when organisations are trying to decide where identity truth starts for attributes such as employment status, manager, department, group membership, or joiner mover leaver events. The right answer can vary by data element, which is why governance models usually define source ownership per attribute rather than assuming one platform governs everything.

For identity data quality, the key question is whether the downstream platforms can be reconciled back to the authoritative source without manual guesswork. NHIMG’s Identity Data Quality and Authoritative Sources Guide is useful here because it frames authoritative sources, correlation, and remediation ownership as governance problems, not just data hygiene problems.

How organisations use it to keep records defensible

Good governance depends on the source of record being explicit, documented, and operationalised. That means downstream systems should not silently redefine identity data, and reviewers should be able to trace a record back to the system that owns it. If a record cannot be traced, it may still exist operationally, but it is weak as a governance basis.

This is especially important when different systems carry overlapping data. For example, HR may be the source of record for employment status, but a directory may be the practical source for group membership, and a cloud platform may be the only place where a particular entitlement exists. The governance task is to define which record governs which decision, then reconcile the rest.

Identity and access controls only stay defensible when the source of record is paired with reconciliation discipline. The NIST SP 800-53 Rev 5 Security and Privacy Controls catalogue is relevant because access control, identity and authentication, auditability, and configuration discipline all depend on trusted records.

Failure modes and operational consequences

The most common failure is drift: the source of record says one thing, while a downstream collector or review tool says another. That can lead to incorrect access reviews, stale memberships, orphaned accounts, delayed removals, or false confidence that governance has been completed.

Another failure mode is distributed authority with no clear ownership. When multiple systems each behave like a source of record, people tend to resolve conflicts informally, which is dangerous because the resolution can vary by team or by event type. Over time, that makes audits, investigations, and remediation harder than they should be.

From a control perspective, the issue is not only accuracy but also accountability. If the organisation cannot say which system owns the record and how discrepancies are resolved, then the record may be operationally useful but not governance-grade. That is why review platforms, provisioning tools, and analytic collectors should be treated as consumers unless they are explicitly designated as authoritative for a specific attribute.

How to think about the term in practice

Practitioners should use source of record as a governance rule, not a vague synonym for “main database.” The practical test is simple: when two systems disagree, which record is used to make the decision, and who is responsible for fixing the mismatch?

That framing helps avoid a common mistake, which is assuming that whichever system is most visible is also the one that should govern. In mature identity programmes, visibility and authority are deliberately separated. A system may be excellent for reporting, but still not be the record of governance truth.

Governance implication: define source of record per attribute or lifecycle event, document the reconciliation path, and make ownership explicit so review and provisioning decisions stay auditable.

Related resources from NHI Mgmt Group

• What breaks when offboarding is not tied to the source identity record?
• What breaks when organisations treat a source of truth and a system of record as the same thing?
• Identity Source of Record
• Source System Of Record