What Is Identity Governance?

Identity governance is the policy and oversight layer above access management: who should have access, how that is decided, how it is reviewed, and how the organisation demonstrates the answer to an auditor.

Where IAM is largely operational — provisioning, authentication, enforcement — governance is about whether the resulting state is correct and defensible.

Certification is the central ritual, and it usually fails

Periodic access review is the mechanism regulators expect and the one most reliably performed badly. A reviewer receives a list of entitlements with technical names, no context, and a deadline, and approves all of them because that is the only tractable response.

Rubber-stamped certification is worse than none, because it produces evidence of a control operating while changing nothing. An assessor who samples a review and finds one hundred per cent approval across hundreds of entitlements will draw the obvious conclusion.

What makes review actually work

Scope it. Reviewing everything quarterly guarantees superficial review; reviewing privileged and sensitive access properly is better than reviewing everything nominally.

Present it in business language rather than group names. Show what changed since the last cycle so the reviewer faces a short list. Include last-use data, because an entitlement unused for a year is an easy revocation. And make revocation the default for anything not actively confirmed, rather than requiring positive action to remove.

Role management and the drift toward chaos

Governance programmes frequently begin with role mining — analysing existing access to derive sensible roles. The output is useful and it describes the current state, including all its accumulated errors.

Roles then proliferate. Each exception spawns a variant, and an organisation ends up with more roles than people, at which point the model provides administrative overhead without simplification. Periodic role rationalisation is the unglamorous maintenance that prevents it.

Data quality decides whether any of it works

Governance depends on knowing who people are, who they report to, what their role is and when they leave. That information lives in the human resources system, and the quality of the link between it and the identity platform determines whether governance is automated or manual.

Where the link is weak the symptoms are predictable: accounts for people who left, accounts with no identifiable owner, contractors absent from the authoritative record entirely because they were never onboarded through the same process. Fixing the data source is unglamorous and it removes whole categories of finding at once, which makes it a better first investment than most tooling.

What an assessor will ask for is narrower than it first appears: evidence that reviews happened, that reviewers were appropriate, that decisions were recorded, and that revocations were actually carried out. The last is the one most often missing — a review that identified access for removal and no record that the removal occurred is a finding regardless of how well the review itself was run.

Where to start

Take your last access certification and check the approval rate. If it approaches one hundred per cent, the review is a formality and the underlying access has not been examined.

See identity governance for contractors. GuardsArm runs compliance auditing.