Typical Risks and Pitfalls for IGA Projects

Digital identities sit at the center of digital transformation, information security, and privacy, making effective Identity Governance & Administration (IGA) essential for competitiveness, compliance, and resilience in fast-changing regulatory and hybrid IT environments. IGA spans identity lifecycle management and access governance across the administration and audit/analytics pillars of IAM, aiming to reduce risk from excessive access through centralized, policy-based orchestration of identity and access workflows, automation, and auditable controls. Strong IGA delivers business benefits such as agility, easier partnering, better customer-aligned services, and cost reductions, while weak IGA increases exposure to identity theft, unauthorized changes, entitlement creep, poor role management, inadequate auditing, and Separation of Duties (SoD) conflicts—especially as traditional network perimeters fade and infrastructures become heterogeneous.

IGA initiatives often fail due to five recurring pitfall categories: business alignment, organization, implementation, planning, and technology. Common alignment issues include weak executive sponsorship, unclear articulation of business value, unrealistic expectations (because early value is managerial rather than purely technical), insufficient broad business engagement, internal politics, and poor stakeholder communication. Organizational risks include inconsistent definition of policies/processes/roles, inadequate change management (e.g., provisioning teams impacted by automation), and shortages of specialist skills; mitigation centers on cross-functional governance, targeted expert support, and training for sustainability.

Implementation and architecture must handle expanding identity types, including partners, customers, contractors, and non-human identities, while enabling consistent governance across on-prem and cloud control points. Planning should avoid “big bang” rollouts, instead using maturity-informed scoping, incremental projects tied to the largest business benefits and highest risks, and minimizing customization. Technology choices should be driven by business requirements, verified via real-world pilots, and designed to cover broader access risks (beyond checklist compliance), privileged accounts, hybrid realities, and cloud-first delivery to reduce deployment time, accelerate upgrades, and lower total cost of ownership.

• IGA spans the administration and audit & analytics pillars of IAM and includes identity lifecycle management and access governance.
• Weak IGA can result in identity theft, unauthorized changes, access/entitlement creep, and SoD conflicts.
• IGA projects are grouped into five pitfall areas: business alignment, organization, implementation, planning, and technology.
• Initial deliverables of IGA are described as management outcomes rather than technology outputs.
• IGA must increasingly govern identities beyond employees, including contractors, partners, consumers/customers, and non-human identities.
• Customization can create technical issues, lengthy upgrades, security risks, maintenance overhead, and potential project failure.
• Historically, IGA was run on-premises and later extended to support cloud services.
• Cloud-based IGA is associated with shorter deployment cycles, faster upgrades, and lower total cost of ownership in the short term.
• Checklist compliance is described as insufficient in an era of increasing cyber attacks.
• “Super-robot” accounts in RPA can accumulate entitlements for multiple robots and conflict with least privilege goals.

• “IGA is primarily a management task, so initial deliverables will not come in the form of technology.”
• “The business needs to drive projects and lead the technology, not the other way around.”
• “Complexity is the enemy of success in most projects, and this is particularly true when it comes to IGA projects.”
• “Do not start with a product.”
• “Avoid a ‘big bang approach’ and divide IGA projects into several small projects that have clear boundaries.”
• “Customization can be reduced and even eliminated by implementing standardized, best-practice processes wherever possible.”
• “Checklist compliance is no longer sufficient.”
• “IGA must support more than just enforcing least privilege access.”
• “With the increasing number of non-human identities within enterprise IT environments, failure to address this category of identities is another potential pitfall in IGA projects.”
• “Implementation out of context is no proof of being able to function effectively in context.”