IAM Governance & Compliance

IAM governance is the framework of policies, processes, and controls that ensure identity and access management operates effectively, transparently, and in compliance with regulatory requirements. Governance answers the question: “How do we know our IAM controls are working?”

While identity management and access management are the doing parts of IAM — creating identities, provisioning accounts, authenticating users — governance is the checking part. It verifies that the doing is correct, complete, and compliant. Without governance, IAM becomes chaotic: orphan accounts accumulate, privileges creep, access reviews become rubber-stamping exercises, and audit findings pile up.

Why IAM Governance Matters

The consequences of poor IAM governance are severe and well-documented:

• Insider threats — Former employees with active accounts (the 2024 Data Breach Investigations Report found that insider threats account for over 30% of breaches, many involving orphaned accounts)
• Regulatory penalties — GDPR fines of up to €20M or 4% of annual revenue; HIPAA penalties of up to $50K per violation
• Audit failures — SOX Section 404 requires management to assess internal controls over financial reporting; IAM failures are the most common material weakness
• Fraud — Absence of segregation of duties enables financial fraud (the average occupational fraud case lasts 12 months before detection — ACFE Report)

Core Governance Processes

Access Certification (Access Reviews)

Access certification is the periodic review of user entitlements by resource owners and managers. It is the single most important governance process — the mechanism by which organisations confirm that current access is appropriate.

The Certification Lifecycle:

    graph TD
    A[Identify All Active Entitlements] --> B[Group by Reviewer]
    B --> C[Assign Reviewers]
    C --> D[Open Review Campaign]
    D --> E[Email Reviewers with Dashboard Link]
    E --> F{Reviewer Action}
    F -->|Certify Access| G[Record Approval with Timestamp]
    F -->|Revoke Access| H[Trigger Automated Deprovisioning]
    F -->|No Action| I[Escalate after 7 Days]
    I -->|No Action| J[Escalate to Manager]
    J -->|No Action| K[Auto-Certify or Auto-Revoke?]
    
    H --> L[Verify Remediation Complete]
    L --> M[Close Remediation Ticket]
    G --> N[Generate Campaign Report]
    M --> N
    K --> N
  

Certification Best Practices:

Types of Certification Campaigns:

Segregation of Duties (SoD)

Segregation of duties ensures that no single person has enough access to commit fraud or cause significant damage. Conflicting access combinations must be identified, prevented where possible, and mitigated where unavoidable.

Common SoD Conflict Pairs:

SoD Implementation Approaches:

1. Preventive controls — System blocks conflicting access assignments in real time. The IAM platform checks each new entitlement request against the SoD matrix and rejects assignments that create conflicts. Strongest control — prevents the problem.

2. Detective controls — System identifies and reports existing conflicts during periodic certification. Weaker than preventive but catches inherited conflicts (e.g., from mergers) or conflicts that arise from role changes.

3. Mitigating controls — Compensating controls for unavoidable conflicts. When a conflict cannot be avoided (e.g., in a small organisation where one person must perform multiple roles), compensating controls include:

   • Enhanced monitoring and logging of all transactions
   • Mandatory peer review of high-risk actions
   • Transaction thresholds requiring second approval
   • Post-transaction random audits

SoD Rule Authoring Example:

{
  "sodRuleId": "SOD-FIN-001",
  "description": "User must not have both AP Clerk AND Vendor Admin access",
  "conflictingRoles": ["AP_Clerk", "Vendor_Admin"],
  "severity": "Critical",
  "controlType": "Preventive",
  "mitigation": {
    "allowed": false,
    "overrideRequired": true,
    "overrideApprover": "Compliance Officer"
  }
}

Audit and Reporting

IAM systems must produce auditable records that satisfy internal and external audit requirements. Audit readiness is a continuous state, not an annual exercise.

Compliance Frameworks — Detailed Requirements

IGA Technology — Identity Governance and Administration Tools

As organisations mature their governance programs, they invest in dedicated IGA tools:

IAM Maturity Model — Detailed

Governance maturity typically progresses through these stages. Understanding your organisation’s current level is the first step toward improvement:

Key Takeaways

• IAM governance provides auditable, provable evidence that access controls are working — it is the “checking” that ensures IAM operations are correct and compliant
• Access certification must be risk-based (different frequencies for different risk levels), automated (reminders, escalation, verification), and closed-loop (revoke → verify → report)
• Segregation of duties prevents fraud by identifying and blocking conflicting access combinations — implement preventive controls where possible, detective where necessary, and compensating where unavoidable
• Multiple compliance frameworks (SOX, GDPR, HIPAA, PCI DSS, ISO 27001, NIST SP 800-53) mandate IAM controls with significant penalties for non-compliance
• IAM maturity progresses through five levels (Initial → Defined → Managed → Measured → Optimized) — most organisations are at Level 2 or 3
• Moving to higher maturity levels requires investment in IGA technology, process automation, and organisational commitment to continuous compliance verification