What Restricts the Value of Identity Governance and Administration (IGA) Programmes?

Struggling to make your Identity Governance and Administration (IGA) programme deliver real value despite significant investments? Countless organisations watch their IGA initiatives falter, leading to increased risk exposure and under-realised returns. This article uncovers the primary drivers of these failures and reveals best practices for success.

When an organisation makes a major investment in an IGA platform, expectations are naturally high. Leaders anticipate ramped-up automation, tighter controls, and improved audit confidence. Yet, despite utilising market-leading technologies, many of these initiatives stall.

The initial enthusiasm often fades six to 12 months after the programme goes live. Delivery teams become frustrated, business stakeholders feel burdened by certification cycles, and the perceived value plummets compared to the capital invested.

Here is the reality: identity programmes rarely underperform because of technology. They struggle because of how they are owned, operated, and supported over time. It is not usually a case of buying the wrong product; it is often a case of "mistaken identity," where the tool becomes a scapegoat for broader organisational gaps.

How Modern IGA Programmes Should Deliver Value

Ideally, a modern IGA programme functions as a living business control system. It should not be a static compliance exercise but a dynamic capability that reduces risk and streamlines operations.

The primary value drivers include:

• Automated Lifecycle Management: eliminating manual provisioning for joiners and leavers.
• Risk Reduction: ensuring "least privilege" access to sensitive data.
• Audit Confidence: providing immediate proof of compliance during reviews.
• Operational Efficiency: freeing up IT service desks from routine password resets and access requests.

When working correctly, the platform acts as a bridge, translating business decisions into technical enforcement.

The Scale of the Problem: Why IGA Value Stalls Post-Launch

Despite the clear benefits, many IGA deployments struggle to reach maturity or sustained adoption. Industry observations suggest that even organisations with top-tier tools suffer from disengagement and stalled momentum.

The pattern is predictable: companies plan obsessively for "go-live," celebrate the launch, and then move on. They treat identity as a finite IT project rather than an ongoing operational discipline. Without a long-term strategy, the platform accumulates technical debt, processes become brittle, and the business loses trust in the system.

Identity programmes almost always lose operational effectiveness before any technical failure occurs.

Primary Drivers of Underperforming IGA Programmes

The reasons programmes fail to deliver full value are rarely rooted in software bugs or feature gaps. Instead, they stem from organisational misalignment, poor data, and a lack of clear ownership.

Lack of Executive Buy-In and Stakeholder Alignment

Treating identity as solely an IT project is a fundamental error. When IGA is framed as a "set and forget" compliance task, it fails to gain traction as a business capability.

Successful identity governance requires input from HR, application owners, and security teams. Without executive backing to enforce this collaboration, the identity team is left administering workflows they do not own, leading to friction and slow decision-making.

Prioritising Provisioning Over Core Governance Functions

Many organisations focus heavily on the number of applications onboarded or workflows built. While automating provisioning is useful, it does not equal governance.

If the focus is purely on connecting apps rather than governing access, the programme becomes a utility rather than a control system. This approach often leads to "rubber-stamping" access rights without understanding the risk, undermining the security benefits the platform was purchased to deliver.

Integration Complexities and Technical Hurdles

IGA platforms do not exist in a vacuum; they must integrate with HR systems, legacy applications, and cloud infrastructure.

When the platform is neglected post-launch, teams perceive it as slow, overly complex, and risky to change. This leads to accumulated complexity. Without ongoing investment to match the pace of business change, the IGA solution falls behind, prompting teams to create manual workarounds that bypass governance entirely.

Poor Data Quality and Management

Data quality is often the "silent killer" of IGA programmes. Platforms consume data; they do not clean it. If HR data is inconsistent—such as rapidly changing job titles or cost centres—automation becomes impossible.

Common data issues include:

• Duplicate or orphaned identities.

• Conflicting sources of truth.
• Organisational structures that do not map to roles.

When the tool is fed poor data, it produces brittle role models and excessive exceptions, forcing identity teams into constant firefighting.

Skills Gaps and Resource Shortages

There is often a massive gap between the resources allocated for implementation and those reserved for long-term sustainability. Organisations frequently fail to answer who owns identity after the consultants leave.

Without a dedicated team to manage the platform's evolution, technical debt mounts. Internal teams may lack the specialist expertise to maintain complex IGA environments, leading to a degradation of service and a loss of stakeholder confidence.

Reviewer Fatigue and Resistance to Change

When ownership is unclear, certification campaigns become a "tick-box" exercise. Business approvers, lacking context or confidence, simply rubber-stamp access requests to get them off their desk.

This "certification fatigue" destroys the rigour of the process. Access becomes inconsistent, and the platform is viewed as a bureaucratic hurdle rather than a security asset. This resistance is often a symptom of poor change management and a lack of user-centric design.

Best Practices for Launching Successful IGA Programmes

To unlock consistent business value, organisations must shift their mindset from "deploying a tool" to "building a capability."

Align with Business Objectives from the Start

Identity must be reframed as a business control system. This means establishing clear ownership models where:

• HR owns the “people” data.
• Application teams own the access models.
• Managers are accountable for approval decisions.

The identity team should own the tool, but they cannot own the decisions. Aligning these responsibilities ensures that the platform enforces decisions the business is actually capable of making.

Phase Implementation Strategically

Avoid the "big bang" approach. Successful programmes rely on tightly scoped phases that deliver incremental value.

By securing small but meaningful wins, you build stakeholder confidence. A gradual journey allows the organisation to mature its processes alongside the technology, preventing the team from being overwhelmed by complexity on day one.

Leverage Automation and Modern Platforms

Automation should be the reward for good data governance. Focus on cleaning and rationalising identity attributes first.

Once the data is trustworthy, use the platform to automate low-risk decisions. This reduces the burden on human reviewers and ensures that manual intervention is reserved for high-risk exceptions, keeping engagement levels high.

Invest in Training and Change Management

"Go-live" is not the finish line. Organisations must invest in ongoing training for business users and technical support for the identity team.

Users need to understand why they are approving access, not just how to click the button. Continuous education helps maintain the rigour of governance processes and ensures the platform evolves in step with the business.

Common Mistakes That Derail IGA Initiatives

The most pervasive mistake is the "set and forget" mentality. Leaders often assume that once the software is installed, the problem is solved.

Other common mistakes include:

• Unclear Accountability: Having "too many cooks" leads to ownership gaps where no one is responsible for outcomes.
• Blaming the Tool: When processes fail, the IGA platform is often the visible scapegoat, masking the underlying organisational dysfunction.
• Ignoring the Operational Model: Failing to plan for how the system will be supported long-term guarantees technical debt.

Conclusion

The inability of IGA programmes to deliver sustained business value is rarely a technology problem; it is an ownership problem. To succeed, organisations must stop asking, "Do we have the right tool?" and start asking, "Do we own our identity decisions?"

Success requires reframing identity as a living control system, supported by clean data, clear accountability, and sustained investment. By addressing these operational realities, you can turn a struggling IGA project into a robust business enabler.

Gain clarity over the business value of your IGA programme and benchmark your organisation’s performance with our personalised IGA Value Assessment—it only takes around 3-minutes to complete.