6 Common Causes of Failure in IGA Projects

Identity Governance and Administration (IGA) implementations are critical for modern businesses, yet they often face significant challenges. A McKinsey study reveals a disheartening trend in IT projects: they tend to run 45% over budget, 7% over time, and deliver 56% less value than predicted. Understanding the common pitfalls is crucial for organizations aiming to successfully implement IGA solutions.

1. Lack of Clear Business Objectives and Strategy#

IGA projects frequently struggle because they lack well-defined business goals, which can result in confusion and misalignment with the organization’s needs. Without clear objectives, teams may pursue initiatives that do not effectively address the core requirements of the business. Examples of undermining practices include:

• Implementing IGA without clear joiner-mover-leaver processes, resulting in improper access assignments and failed audits
• Rushing into IGA for compliance without defining business value, causing resistance from business units
• Starting projects without clear success criteria for access certification campaigns
• Failing to define clear ownership between HR, IT, and business units for identity lifecycle management
• Lacking scalable design to support M&A or major enterprise changes

2. End-User Resistance and Adoption Issues#

End-user resistance can significantly impede success, as users often view new processes as burdensome and disruptive. This reluctance may lead to non-compliance or circumvention of protocols. Common issues include:

• Access certification campaigns overwhelming managers with thousands of entitlements to review
• Complex access request catalogs where users cannot understand what access they need
• Certification interfaces lacking context about the access being reviewed
• Role management interfaces that business users cannot understand

3. Insufficient Stakeholder Engagement#

Organizations often fail to involve key personnel from various departments beyond IT and security. This oversight can result in misalignment with business objectives, resistance to change, and inadequate buy-in. Examples include:

• Not involving application owners in onboarding decisions
• Implementing automated provisioning without understanding business unit approval requirements
• Rolling out access reviews without proper manager training
• Excluding HR from identity lifecycle management discussions

4. Underestimating Complexity and Scope#

Organizations often fail to recognize that IGA represents an ongoing program requiring extensive integration across various systems and departments. Common shortfalls include:

• Attempting to implement automated provisioning for all applications simultaneously
• Underestimating effort required to clean up historical access rights
• Failing to account for complex approval workflows varying by department and risk level
• Discovering midway through that role mining requires significantly more business input
• Requiring heavy customization of the IGA product to satisfy business needs

5. Data Quality and Integration Challenges#

Organizations often underestimate the complexity of consolidating and cleansing data, resulting in inconsistencies that affect access management and compliance. Common issues include:

• Poor HR data quality preventing accurate role-based access control implementation
• Inconsistent application account naming conventions making identity correlation impossible
• Incomplete attribute data preventing automated access decisions
• Multiple authoritative sources with conflicting identity information breaking automated provisioning
• Obsolete, redundant, or unclassified entitlements causing inefficiency
• Current IGA products requiring highly skilled developers for system integration

6. Costly Maintenance and Support#

IGA projects can lead to significant maintenance and support costs that organizations often underestimate. Ongoing updates and customizations are essential for system effectiveness. Overlooked examples include:

• Underestimating effort needed to maintain role definitions as business processes change
• Regular access policy changes requiring constant updates to automated provisioning rules
• Access certification campaigns requiring dedicated support teams for exceptions
• Application onboarding costs exceeding budget as each integration needs custom development
• Non-cloud-native IGA products requiring substantial effort for upgrades, patching, and monitoring

Conclusion#

Identity Governance and Administration projects face several challenges that can lead to failure if not addressed. The six common causes-lack of clear business objectives, end-user resistance, insufficient stakeholder engagement, underestimating complexity, data quality issues, and costly maintenance-underscore the need for strategic planning and collaboration. Organizations must recognize that IGA represents a complex, ongoing program requiring clear goals, effective stakeholder involvement, and continuous improvement. By proactively addressing these pitfalls, companies can enhance security, improve compliance, and streamline operations.