Governance frameworks don't collapse — they erode. The signals are quiet at first: certification campaigns that complete in under two minutes per account, role catalogs that haven't been touched since the last major org restructure, SoD violations that accumulate quarter after quarter because no one owns cross-system entitlement visibility. By the time the dysfunction is visible in an audit finding or an incident, the decay has typically been running for 18 months or more. Recognize those signals early and execute a disciplined rebuild before the window closes.
Where Programs Fail
Certification rubber-stamping is the most common — and most dangerous — form of governance decay. When reviewers approve access at high rates with minimal per-account time, the certification process is producing audit artifacts, not access decisions.
Legitimate certification requires reviewers to have enough context about each entitlement to make a meaningful yes/no judgment. When that context is missing — because role descriptions are stale, because the review interface buries relevant usage data, or because managers are assigned hundreds of accounts with a two-week deadline — approvals become reflexive rather than deliberate. A certification completion rate above 95% combined with an average review time under three minutes per account is a signal worth investigating, not celebrating.
Role definition drift follows a predictable timeline. Role-based access control depends on role definitions that accurately reflect actual job functions. In environments where roles are defined during initial deployment but not maintained against HR system changes, org chart restructures, or application changes, the role catalog quietly diverges from reality.
After 24 months without active maintenance, roles in many environments no longer map cleanly to the entitlements employees actually need — they've accumulated additions from one-off requests, lost entitlements that were provisioned outside the role framework, and inherited permissions from predecessor roles that were never decommissioned. The practical consequence is that access reviews become harder to complete accurately, SoD analysis produces false negatives, and provisioning based on role assignment delivers either too much or too little access.
SoD violation accumulation is often invisible until it's auditable. Separation of duties controls require cross-system visibility — a conflict between a financial approval right in an ERP and a payment modification right in a treasury system only surfaces if both entitlements are visible in the same analysis pass.
In environments where access reviews run quarterly, automated conflict detection is limited to single systems, and no one owns enterprise-wide entitlement aggregation, SoD violations can accumulate for months before any review cycle catches them. By the time they appear in an audit, remediation may require removing access that operational staff have come to depend on — creating friction that drives workarounds rather than compliance.
Orphaned accounts persist because deprovisioning workflows fail silently. When an employee terminates, access revocation depends on the HR-to-IAM connector firing correctly, the downstream application receiving and processing the deprovisioning event, and someone verifying the account was actually disabled.
Any break in that chain — a connector timeout, a service account that wasn't tied to the identity lifecycle, an application that processes deprovisioning events asynchronously — leaves an active account with no owner. The accounts are rarely discovered through normal operations; they show up in periodic reconciliation runs or, more consequentially, after unauthorized use.
Program Components
A functioning governance framework rests on four operational dependencies: access certification that produces decisions rather than approvals, role definitions that reflect current job functions, SoD detection that spans systems rather than operating within them, and deprovisioning workflows that confirm execution rather than assuming it.
NIST SP 800-53 Rev. 5 formalizes these dependencies through the Access Control (AC) family, which includes controls for account management, access enforcement, and least privilege — all of which require active maintenance, not one-time configuration. Treating these controls as implementation checkboxes rather than ongoing operational processes is where many programs diverge from the framework's intent.
The NIST Cybersecurity Framework similarly structures identity outcomes as a continuous function — detect, respond, and recover are not one-time events but recurring cycles applied to access state as much as to threats. Applying that continuous-cycle framing to governance means every component has a health metric, every metric has a threshold, and crossing that threshold triggers a defined response — not a future project.
Entitlement visibility is the precondition for everything else. Without an aggregated, current view of what access exists across systems, role definitions can't be validated, SoD analysis produces incomplete results, and orphaned account detection is manual. Building that visibility layer — whether through an IGA platform's connectors, a custom aggregation pipeline, or periodic reconciliation exports — should be prioritized before attempting to improve certification quality or role rationalization, because both depend on it.
Phased Approach
Phase 1: Measure Current Governance Health
Diagnosis before prescription. Attempting to rebuild certification processes or rationalize roles without baseline measurements produces effort without direction. The first phase is measurement, not remediation.
Pull the last three certification cycles. Calculate per-reviewer approval rates and average time-per-account. A reviewer approving at a rate above 95% in under three minutes per account warrants a follow-up conversation about the review process itself.
Calculate what percentage of entitlements in scope have a role assignment versus an individual exception — this ratio indicates how much of the environment the role framework actually governs. Run a point-in-time orphaned account scan: compare active directory or IdP user objects against HR termination records from the past 90 days. The gap is your starting inventory.
Phase 2: Stabilize Highest-Risk Gaps
Address orphaned accounts and active SoD violations before rebuilding process, because both represent current exposure rather than future risk. Orphaned account remediation is operationally straightforward — disable, confirm, then deprovision after a short hold period — but requires someone to own execution and verify completion. SoD violation remediation is harder because it requires deciding which of two conflicting entitlements to remove, which may require operational stakeholder involvement.
For certification quality, the fastest stabilization path is reducing reviewer scope before redesigning the workflow. Assign reviewers only the accounts they can meaningfully evaluate — typically direct reports and system-specific owners for technical roles — rather than bulk-assigning large populations. This alone can shift completion behavior even before any process redesign.
Phase 3: Rebuild Sustainable Process
Role rationalization is a Phase 3 activity because it requires stable entitlement visibility and stakeholder engagement that can't happen during an active stabilization effort. Start with the roles that cover the highest-privilege or highest-volume populations. For each role, compare the defined entitlements against what current role members actually hold — the delta reveals both drift and exception accumulation.
Deprovisioning reliability requires testing, not assuming. Build a monthly check: take a sample of terminations from the prior 30 days and verify that every downstream system processed the deprovisioning event. Connector failures are common enough that periodic manual verification remains worth the operational cost until automated reconciliation is running reliably.
Governance and Ownership
Governance decay accelerates when ownership is diffuse. Certification campaigns without a named process owner tend to slip deadlines and accumulate incomplete reviews. Role maintenance without a named catalog owner produces drift. SoD analysis without an owner who can drive cross-system remediation produces findings that age out without resolution.
Assign ownership to governance functions at the operational level, not the organizational level. "The IAM team owns governance" is not an assignment — it's a diffusion. The specific owner of the certification campaign is responsible for completion rates, reviewer education, and escalation for non-responders. The role catalog owner is responsible for a defined review cycle and a process for ingesting org changes. Without those specific assignments, accountability gaps create the conditions for the decay patterns described in Phase 1.
Cross-functional coordination is a structural requirement for SoD governance. No single team owns all the systems that contribute to a meaningful SoD conflict. Establish a standing cross-functional working group — or at minimum a defined escalation path — that can approve entitlement removals when remediation crosses system ownership boundaries. Without it, SoD findings sit unresolved for quarters.
Implementation Checklist
Governance Health Diagnostic
| Decay Signal |
Measurement |
Corrective Action |
| Certification rubber-stamping |
Pull per-reviewer approval rate and average time-per-account for last three campaigns. Flag any reviewer at >95% approval / <3 min per account. |
Reassign scope to accounts the reviewer can evaluate. Add entitlement usage data to review interface. Rerun targeted campaign for flagged reviewers. |
| Role definition drift |
Compare role-defined entitlements against actual entitlements held by current role members. Calculate percentage match. |
For roles below 80% match, initiate role review with business owner. Separate drift (additions) from exceptions (out-of-role provisioning). |
| SoD violation accumulation |
Run cross-system SoD analysis against current ruleset. Count open violations by age bracket: <30 days, 30-90 days, >90 days. |
Violations >90 days without a documented exception or remediation plan require escalation. Assign a named owner to each unresolved violation. |
| Orphaned account inventory |
Compare active accounts in IdP/AD against HR termination records for prior 90 days. Count unmatched active accounts. |
Disable unmatched accounts within 24 hours of discovery. Deprovision after a defined hold period (commonly 30 days). Document each instance. |
| Privilege review cycle |
Identify privileged accounts (admin, service, shared). Determine date of last entitlement review for each. Flag any overdue by more than 30 days against policy. |
Initiate out-of-cycle review for overdue privileged accounts. Treat any privileged account without a review in 12 months as a reset candidate. |
Rebuild vs. Reset Decision Table
| Decay Pattern |
Diagnostic Signal |
Rebuild Path (If Recoverable) |
Reset Threshold |
| Certification decay |
Last two campaigns >90% approval rate; avg review time <2 min/account |
Reduce reviewer scope, add usage context to UI, retrain reviewers, rerun campaign with monitoring |
Three or more consecutive campaigns with no meaningful access removals — start new campaign from scratch with redesigned scope and reviewer assignments |
| Role definition drift |
>40% of role members hold entitlements not defined in the role; role last reviewed >24 months ago |
Incremental role review by business unit; separate drift corrections from exception approvals |
Role structure covers <50% of entitlements in the environment — the role model is not governing access and requires full re-architecture before further certification |
| SoD gap |
Active violations >90 days; no named owner; no cross-system analysis running |
Assign owners, establish cross-functional escalation path, work down violation backlog by risk tier |
Violation backlog exceeds remediation capacity within a single certification cycle — requires a dedicated remediation sprint with access freezes on highest-risk conflicts |
| Orphaned access |
>5% of terminated employees from prior 90 days have active accounts in one or more systems |
Immediate disable, connector audit, deprovisioning workflow remediation |
Evidence of orphaned account use after termination — treat as an active incident; conduct full entitlement audit across all terminated accounts in prior 12 months |
Governance frameworks decay because the operational conditions that produced them — clear role definitions, engaged reviewers, functioning connectors — drift without active maintenance.
The rebuild sequence matters: measure before remediating, stabilize current exposure before optimizing process, and assign specific ownership before scaling any component. The checklist above is executable without waiting for a program redesign. The decision table tells you when incremental repair is no longer viable. Starting with either is better than waiting for the next audit cycle to force the question.
Sources