A Lean Approach on Identity & Access Governance

Identity & Access Governance (IAG) has emerged alongside traditional Identity and Access Management (IAM) to help organizations govern identities and access controls, reduce access risk, and meet regulatory expectations. Core building blocks include designing access concepts, managing access requests and approvals, recurring access recertification (access reviews), and controls such as Segregation of Duties (SoD) checks. While manual attestation and recertification remain important, the central challenge is balancing audit expectations with what the organization can realistically execute, including producing evidence that recertification cycles were completed and documented.

Common IAG implementations—especially large, complex annual access reviews—are described as “failing” in practice. Key flaws include their detective nature (reviewing already-active access), high workload spikes tied to fixed schedules, poor prioritization versus “real business” work, and heavy dependence on recertifiers’ contextual knowledge. Organizational churn (reorgs, mergers, job changes) and turnover of recertifiers further erode continuity and quality, making reviews tedious, time-consuming, ineffective, and sometimes error-prone. A lean approach is proposed: focus governance effort on actual risk, translate technical entitlements into business language, differentiate treatment of high- vs low-risk access, apply continuous analysis to access and activity data, and automate where possible—reviewing primarily what is manually managed and what has changed.

Kleverware IAG is presented as an example of a lean, rapidly deployable access governance solution focused on access governance (not full IGA with provisioning). It consolidates cross-system entitlements (including mainframe), correlates accounts, detects entitlement changes (“mutation detection”), supports cross-system SoD, enables targeted reviews based on risk and change, and provides compliance reporting. It integrates with fulfillment tools (e.g., ServiceNow) and supports modular architectures to improve flexibility and reduce lock-in.

• Identity & Access Governance spans both GRC and traditional IAM markets.
• Access Governance commonly includes Access Request Management, Access Recertification (Access Review), and Segregation of Duties checks.
• Recertification requires evidence of completion and documentation to prove compliance to internal and external auditors.
• Traditional recertification controls are detective because they review access that is already assigned and active.
• Organizations can accumulate five- or six-digit counts of entitlements in an access governance data warehouse.
• Low-risk entitlements can be appropriate for annual or semi-annual recertification.
• High-criticality access may be unacceptable to leave incorrectly assigned even for weeks or days.
• Kleverware started in 2005 and is based in Paris, France.
• Kleverware IAG does not provide identity provisioning and positions itself as not being a full IGA solution.
• Kleverware IAG’s warehouse is based on an in-memory database, and it can collect data agentlessly via CSV exports and interfaces such as LDAP.

• “Manual controls based on attestation and recertification processes are important building blocks in corporate Access Governance – but keep them lean.”
• “The challenge is about finding the balance between what you must do for audits and what the organization is capable in doing.”
• “If the people involved in Identity & Access Governance lack the required knowledge for these processes, the processes will fail.”
• “Not all entitlements share the same criticality. Understand what is really critical and what to spend your time with.”
• “Identity & Access Governance shall foster business instead of just being a burden.”
• “It is about working to the business, beyond working to the auditors – be compliant, but in a way that helps not penalizes the business.”
• “Why not aim at always being compliant? Can we be permanently prepared for audit?”
• “How can we reduce or balance the workload for recertifiers and approvers?”
• “Why not treat high-risk access differently from low risk access?”
• “Access Governance done right is no longer just a means of getting an auditor’s sign-off.”