What is the difference between identity governance and identity management?

Identity Management is the operational engine that creates, updates, and deactivates accounts and access. Identity Governance and Administration is the oversight layer that reviews, certifies, and produces audit evidence for those access decisions. IDM is about execution; IGA is about proof. Most enterprises end up needing both, often in that order - reliable provisioning data first, then governance on top of it.

What is the difference between access review and access certification?

The terms are often used interchangeably, but access review is the broader process of examining who has access to what and determining whether it remains appropriate. Access certification is the formal act of a designated reviewer - a manager, application owner, or data owner - attesting that a specific entitlement is still warranted. Certification produces a signed, timestamped record suitable for audit evidence. Access recertification refers to repeating that process on a defined cadence.

How do we implement segregation of duties without a complete role model in place?

Most organizations implement SoD controls before their role model is mature, and that is a reasonable approach. Start with a targeted set of high-risk SoD rules - typically the combinations that represent the greatest fraud or compliance exposure in financial, HR, or privileged systems - and enforce those rules against raw entitlement data. The role model and the SoD policy can mature in parallel, with the role model ultimately making SoD analysis more efficient rather than being a prerequisite for it.

Which regulatory frameworks require formal reviews of who has access?

SOX Section 404 requires management to assess and attest to the effectiveness of internal controls over financial reporting. This directly implicates access certification for systems that touch financial data. HIPAA requires covered entities to review information system activity and workforce access to protected health information. PCI-DSS requires periodic review of user accounts and access privileges. NIST 800-53 control families AC-2 and AC-6 require that least privilege be demonstrably maintained over time. Most organizations in regulated industries end up running certification campaigns aligned to multiple frameworks simultaneously.

How long does an IGA implementation usually take?

Timelines vary considerably with organizational scope, the number of connected applications, the maturity of the existing role model, and how much source-of-truth cleanup is required before governance can be meaningful. Targeted programs focused on high-risk applications can produce meaningful results in a few months. Broader enterprise IGA programs spanning many applications and business units are typically delivered in phases so certification campaigns can begin before the full platform buildout is complete.

Does GCA run IGA environments for clients, or only implement them?

Both. We deliver IGA implementation engagements and operate IGA environments as an ongoing managed service for organizations that prefer to consume identity governance as a service rather than build the internal team to run certification campaigns, manage the platform, and keep the integration layer current with application changes.

How long does an IGA engagement typically take?

Targeted programs focused on high-risk applications can produce meaningful results in 3-6 months. Broader enterprise IGA programs spanning many applications and business units typically run 6-12 months and are delivered in phases so certification campaigns can begin before the full platform buildout is complete.

Identity Governance and Administration

Organizations struggle with access governance, review fatigue, and conflicts from incompatible access that leave them exposed to compliance violations and audit findings. We help you replace manual, spreadsheet-driven access reviews with automated, continuous governance - so you can prove compliance instead of scrambling for it.

Book a Consultation Explore Capabilities

What Is Identity Governance?

What is identity governance? Identity governance - also called identity governance and administration (IGA) - is the framework of policies, processes, and technology that ensures the right people have the right access at the right time. The identity governance definition encompasses access governance, access reviews, access certification, access recertification, role management, segregation of duties, risk-based access decisions, and compliance reporting. It answers a fundamental question: who has access to what, and should they?

We help organizations move from manual, spreadsheet-driven access reviews to automated, continuous access governance. Our engagements follow a structured Assess, Implement, Manage lifecycle - from initial governance assessment and platform selection, through implementation, and into ongoing managed operations. GCA's identity governance solutions deliver compliance automation, risk-based access controls, and efficient access reviews tailored to your requirements, drawing on established modern IGA platforms rather than a single proprietary stack. For the 13 decisions that determine IGA implementation success, see our SailPoint implementation checklist.

Key Terms Defined

Before diving deeper, here are plain-language definitions of the terms you will encounter throughout identity governance:

Access Certification

The formal process where designated reviewers - managers, application owners, or data owners - periodically review and attest that each person's access is still appropriate. Think of it as a scheduled "permission checkup" that produces a timestamped, audit-ready record proving someone verified every access right.

Segregation of Duties (SoD)

A control that prevents one person from having enough access to both initiate and approve a sensitive action - like creating a vendor payment and approving it. When SoD rules are enforced, no single individual can complete a high-risk transaction alone, which reduces fraud and error.

Role-Based Access Control (RBAC)

An approach to assigning access where permissions are grouped into roles based on job functions (e.g., "Accounts Payable Clerk" or "HR Business Partner"), and users are assigned to roles rather than receiving individual permissions one by one. RBAC makes access easier to manage, review, and audit.

The Case for Identity Governance

What happens without IGA? Organizations face compliance violations, audit findings, and excessive access that creates fraud risk. Manual reviews become rubber-stamp exercises. Conflicting access goes undetected. When regulators ask for evidence, teams scramble to assemble it retroactively.

Most enterprises arrive at identity governance gradually, then suddenly. Access accumulates through years of provisioning decisions that were never reviewed collectively - employees change roles and retain old entitlements, contractors finish engagements and keep their system access, and what looked manageable a year ago becomes a sprawling inventory of entitlements no single team fully understands. The COSO framework and SOX Section 404 treat access control as fundamental to internal controls over financial reporting, and auditors have learned to ask not only whether controls exist but whether they are actually reviewed and enforced.

That gap is where the cost shows up. Spreadsheet-driven reviews degrade into rubber-stamp exercises once reviewers are asked to approve hundreds of entitlements in bulk without context - nobody meaningfully evaluates line 214 of a 300-row spreadsheet. Meanwhile, conflicting access accumulates invisibly across disconnected systems: a single individual can end up able to both initiate and approve a financial transaction, and no one notices until an auditor or an incident forces the question. NIST 800-53 control families AC-2 and AC-6 require that least privilege be not only enforced but demonstrably maintained over time, and manual processes routinely fail that bar - not because the reviewers are careless, but because bulk approval without context isn't actually review.

The business case for a formal IGA program lands in three places. Review campaigns become meaningful when reviewers work from real context instead of a raw entitlement list. Segregation-of-duties enforcement moves from a periodic manual check to a continuous automated one, catching conflicts as they form rather than discovering them months later. And audit evidence becomes a byproduct of normal operations rather than an emergency project - the same certification records and entitlement histories a regulator would ask for are already sitting there, generated as a matter of course. None of this requires ripping out what's already in place: many organizations already own governance capability bundled inside their existing identity platform, and activating it is often the fastest path to closing the gap.

GCA's IAM Professional Services practice is rated 4.6 / 5.0 on Gartner Peer Insights based on 32 verified reviews (as of 5/1/2026). This reflects engagements where those outcomes were realized in production, not only demonstrated in a proof of concept.

IGA Capabilities

Access Review & User Access Review - Campaign Design

Designing and operating the access review and user access review campaigns themselves - how often they run, who reviews what, and how decisions become action. The focus here is the mechanics of the review cycle, from scoping to reviewer experience to automated revocation.

Quarterly, continuous, and event-driven review cycles
Risk-based scoping for high-privilege populations
Reviewer routing with entitlement context and decision support
Automated remediation and revocation workflows on review outcomes

Access Certification & Recertification - Audit Evidence

Turning review and re-review results into defensible audit evidence. The focus here is mapping certifications to regulatory control frameworks, capturing the artifacts auditors ask for, and proving that previously approved access remains appropriate over time.

SOX 404, HIPAA, and PCI-DSS aligned certification design
Manager, application owner, and data owner attestation paths
Micro-certification for high-sensitivity entitlements
Evidence packaging and entitlement history for regulator review

RBAC Implementation

Role-based access control design, mining, and implementation. RBAC implementation creates a role model that maps business functions to system entitlements, reducing access request volume and simplifying certifications.

Top-down and bottom-up role mining
Birthright role and joiner automation
Role lifecycle management and hygiene
Segregation of Duties (SoD) conflict detection

IAM Governance & Compliance

Access policies and controls that align your identity program with regulatory requirements. IAM governance integrates access controls, policy enforcement, and reporting into a continuous compliance engine.

SOX, HIPAA, PCI-DSS, NIST, ISO 27001, and other regulatory frameworks
Segregation of Duties (SoD) policy management
Entitlement analytics and risk scoring
Audit report generation and evidence packaging

What Success Looks Like

Access reviews happen on schedule. Reviewers work from real context about what each entitlement grants, so certifications reflect an informed decision instead of a rubber-stamped bulk approval.
Conflicts from incompatible access are caught in real time. Segregation-of-duties violations are detected and blocked as they occur, not discovered months later during an audit or after a loss has already happened.
Compliance evidence is a byproduct of daily operations. Review records, entitlement histories, and access conflict reports are generated continuously, so audit preparation becomes retrieval rather than reconstruction.
Access follows the person, automatically. Employees receive the access they need through automated role assignments when they join or change roles, and access is revoked promptly when they leave.

The Cost of Inaction

Compliance violations and audit findings. SOX Section 404, HIPAA, and PCI-DSS all expect access controls to be demonstrably reviewed and enforced, not merely present - a gap auditors are trained to find.
Excessive access and fraud risk. Entitlements accumulate as employees change roles and contractors finish engagements without offboarding, creating conflicts from incompatible access that go undetected across disconnected systems.
Manual reviews become rubber-stamp exercises. Reviewers asked to approve hundreds of entitlements in bulk without context stop meaningfully evaluating them, which defeats the purpose of the certification in the first place.
Retroactive scrambling when regulators ask for evidence. Without continuous governance, producing an audit trail becomes an emergency assembly project instead of a routine data pull.

Identity Governance vs. Identity Management

Identity Management is the operational engine. It creates accounts when users join, modifies access when people change roles, and removes access when they leave. IDM keeps identity state synchronized with workforce reality. It automates the provisioning and deprovisioning decisions that would otherwise consume IT ticketing queues. Without a functioning IDM layer, access is granted and revoked inconsistently, and the data that governance depends on is unreliable.

Identity Governance and Administration is the oversight layer on top of that engine. Where IDM is concerned with execution, IGA is concerned with proof. Who decided this person should have this access? When was that decision last reviewed? Where do we have conflicts from incompatible access across systems? Can we produce the entitlement history a regulator will ask for?

An IGA system captures, evaluates, and certifies the access decisions that IDM implements. The HIPAA minimum-necessary principle, for example, requires that access be provisioned appropriately at hire and continuously reviewed to remain appropriate over time. That continuous review is IGA's core function.

Most enterprises end up needing both, though not always at the same time or from the same vendor. Organizations early in their identity maturity often benefit from establishing the identity management foundation first - without reliable provisioning data, governance certifications tend to devolve into the rubber-stamping problem described above. Organizations already operating a mature IDM environment often turn to governance next to close the audit gap and bring access decisions under structured, auditable review. The two layers are designed to work together, and GCA delivers across both.

How We Approach IGA Implementation

Assess

We start by understanding your organization - which regulators are driving the conversation, where access risk is concentrated, what tooling is already on the floor, and whether existing capabilities can be activated before new platforms are recommended.

Design

Build the role model against the access data you actually have. Write SoD policies that match your regulatory frameworks. Scope certification campaigns by risk - privileged users, sensitive applications, and high-turnover populations get attention first.

Implement

Connect the platform to identity sources and target systems. Configure certification workflows, SoD enforcement, and role lifecycle automation. Build reporting around the evidence auditors actually ask for.

Manage

Run certification campaigns, maintain SoD policies, handle platform upgrades, and keep connectors current as applications change. Our managed identity practice provides the ongoing discipline that keeps IGA effective after go-live.

IGA consulting at GCA starts with the organization, not the platform. Most engagements open with an assessment to understand regulatory drivers, access risk concentration, and existing tooling - the same discipline that shapes every IGA services engagement we deliver, whether the work is a greenfield build or an operational handoff.

In many cases, an existing IGA or IAM platform can deliver required outcomes once properly scoped and configured. Organizations often own governance capability bundled inside their enterprise identity suite - access reviews, lifecycle workflows, and entitlement management features that come with existing licenses. Activating what's already paid for is often the fastest path to early compliance value.

The role model, SoD policies, and certification design depend on data from the organizational scope. Building artifacts in the right order keeps the program defensible.

Once the baseline is in hand, the work follows a predictable order. The role model is built against the access data the organization actually has, not an idealized version of it. SoD policies are written to match the regulatory and internal control frameworks the organization is held to, not a generic template.

Certification campaigns are scoped by risk. Privileged users, sensitive applications, and high-turnover populations get attention first. The platform connects to identity sources and target systems, with reporting built around auditor requirements.

None of this is designed as a once-a-year exercise. Least privilege, segregation of duties, and keeping access appropriate as people change roles are continuous problems. The governance architecture must treat them that way from day one.

GCA also operates IGA environments on an ongoing basis for organizations that prefer to consume identity governance as a managed service rather than build the internal team to run it. Certification campaigns, SoD policy maintenance, platform upgrades, and connector updates to applications that change - these are the operational disciplines that keep an IGA program effective after go-live. That ongoing operating discipline is what GCA's managed identity practice provides. It draws on the same team that built the program rather than handing off to a separate operations group.

IGA Platform Expertise

GCA has spent more than two decades delivering identity governance and administration solutions across the enterprise landscape, implementing and operating governance tools through each shift the category has undergone. That history spans the tools that defined the category, the tools that lead it today, and the tools reshaping it. The consulting practice has adapted with each shift rather than tying itself to any single vendor.

The practice supports the major IGA platforms commonly found in regulated and enterprise environments, spanning legacy on-premises deployments, cloud-native identity security platforms, and directory-integrated governance suites built into broader identity ecosystems. Engagements range from greenfield implementations to platform migrations, modernization of long-running deployments, and ongoing managed operations for organizations that want to consume identity governance as a service. Check out our partner pages below for the specific capabilities, certifications, and engagement models available for each platform.

The identity governance market continues to move. GCA actively evaluates emerging platforms, builds delivery capability with promising options early, and helps clients understand where each choice fits in a longer-term strategy. Vendor-specific capabilities, certifications, and delivery tiers are detailed on the relevant partner pages.

Why GCA for Identity Governance?

Vendor-Neutral Expertise

GCA is not tied to one platform. GCA evaluates the best fit for your environment across all major identity vendors.

4-Pillar Approach

IDM + WAM + IGA + PAM = complete identity security. GCA doesn't silo services - we deliver unified governance.

Proven Methodology

20+ years, 100+ implementations. Our Assess-Design-Implement-Manage framework reduces risk and accelerates time-to-value.

Frequently Asked Questions

What is the difference between identity governance and identity management?

Identity Management is the operational engine that creates, updates, and deactivates accounts and access. Identity Governance and Administration is the oversight layer that reviews, certifies, and produces audit evidence for those access decisions. IDM is about execution; IGA is about proof. Most enterprises end up needing both, often in that order - reliable provisioning data first, then governance on top of it.
What is the difference between access review and access certification?

The terms are often used interchangeably, but access review is the broader process of examining who has access to what and determining whether it remains appropriate. Access certification is the formal act of a designated reviewer - a manager, application owner, or data owner - attesting that a specific entitlement is still warranted. Certification produces a signed, timestamped record suitable for audit evidence. Access recertification refers to repeating that process on a defined cadence.
How do we implement segregation of duties without a complete role model in place?

Most organizations implement SoD controls before their role model is mature, and that is a reasonable approach. Start with a targeted set of high-risk SoD rules - typically the combinations that represent the greatest fraud or compliance exposure in financial, HR, or privileged systems - and enforce those rules against raw entitlement data. The role model and the SoD policy can mature in parallel, with the role model ultimately making SoD analysis more efficient rather than being a prerequisite for it.
Which regulatory frameworks require formal reviews of who has access?

SOX Section 404 requires management to assess and attest to the effectiveness of internal controls over financial reporting. This directly implicates access certification for systems that touch financial data. HIPAA requires covered entities to review information system activity and workforce access to protected health information. PCI-DSS requires periodic review of user accounts and access privileges. NIST 800-53 control families AC-2 and AC-6 require that least privilege be demonstrably maintained over time. Most organizations in regulated industries end up running certification campaigns aligned to multiple frameworks simultaneously.
How long does an IGA implementation usually take?

Timelines vary considerably with organizational scope, the number of connected applications, the maturity of the existing role model, and how much source-of-truth cleanup is required before governance can be meaningful. Targeted programs focused on high-risk applications can produce meaningful results in a few months. Broader enterprise IGA programs spanning many applications and business units are typically delivered in phases so certification campaigns can begin before the full platform buildout is complete.
Does GCA run IGA environments for clients, or only implement them?

Both. We deliver IGA implementation engagements and operate IGA environments as an ongoing managed service for organizations that prefer to consume identity governance as a service rather than build the internal team to run certification campaigns, manage the platform, and keep the integration layer current with application changes.
How long does an IGA engagement typically take?

Targeted programs focused on high-risk applications can produce meaningful results in 3-6 months. Broader enterprise IGA programs spanning many applications and business units typically run 6-12 months and are delivered in phases so certification campaigns can begin before the full platform buildout is complete.

IGA Platforms

GCA implements IGA across the established platforms. We're vendor-neutral - we recommend what fits your environment, not what pays us the highest margin.

SailPoint Microsoft Entra Netwrix C1

Govern Access With Confidence

From access certification to RBAC implementation - we help organizations automate compliance, reduce risk, and build identity governance programs that stand up to audit scrutiny.

Book a Consultation Contact Us