This is sort of a "back to the roots" post, but for some good reason. I've done several advisories and customer calls recently, and in some of them it became obvious that companies tend to miss some of the critical success factors for IAM (Identity and Access Management). Some of the projects are still too technology-focused. So I've put together some key success factors for IAM projects. These are not that technical, so you won't read things like "support the cloud", because that should just be a result of the requirements analysis.
Requirements: Understand the requirements of Business and IT - of both! And look at what might become requirements soon, so the obvious trends (like Cloud Computing, like the increasing regulatory compliance pressure even in not-that-heavily regulated industries). Knowing the requirements helps in defining the right architecture and in slicing the big elephant of IAM into smaller pieces, e.g. projects you can handle successfully.
Architecture: IAM is more than only provisioning, even while provisioning still is an important element. But oeverall, architectures are increasingly modular, providing more flexibility, better integration with other pieces of IT, and the ability to serve new requirements quickly when needed. So, look at the architectural options you have today and don't focus on the classical architectures only.
Context: IAM is one element of IT, and one piece of your Information Security framework. It has to interface with Service Management and with other Information Security technologies, as well as with the entire GRC (Governance, Risk Management, Compliance) stack. So don't look at IAM without understanding how it fits into the big picture.
Policies, Processes, Roles: Does your organization have well-defined policies for IAM? Does it have well-defined processes? And how about business roles, defined by the business? If any of these elements is missing, important input for your IAM deployment is missing. The policies define what you have to do and what to do first, the processes are about your implementation of provisioning and Access Governance (and more) - not even to speak about roles. The good news is that businesses better understand the need for these and are more willing to actively work on these topics then some years before.
Team: For sure it is always about having the right people - the ones who understand technology, the ones who understand business, and the ones who connect both sides.
Service focus: Last but not least it is about having a service focus. IAM is one service IT provides, as part of Information Security. It has to be user-centric, focusing on the services the users (from business and IT) require. That includes integration points to your service management environment.
You might define other ones - but these are the ones I find most important from my experience.