Most organizations assume their identity and access management practices are in reasonable shape. They have a directory service running, they issue credentials when employees are onboarded, and they revoke access when people leave — at least in theory. The day-to-day operations feel manageable, and unless something visibly breaks, there is little urgency to look deeper.
That assumption tends to collapse the moment a structured review is conducted. What appears functional on the surface frequently turns out to be a tangle of outdated permissions, undocumented accounts, and access rights that have accumulated over years without any formal review. The gap between what organizations believe about their access environment and what actually exists in it is often significant — and the implications extend well beyond IT operations into legal compliance, operational continuity, and security risk.
Understanding what a thorough identity and access review actually uncovers requires moving past the general idea that “access needs to be managed” and into the specific, operational realities that most teams have never had the time or structure to examine properly.
What an IAM Assessment Actually Examines
A structured iam assessment is not a simple audit of whether user accounts exist in a system. It is a methodical examination of how access rights are granted, maintained, modified, and removed across an organization’s entire technology environment. That includes not just active employee accounts but service accounts, vendor access, legacy system credentials, shared accounts, and any identity that can authenticate to a business system in any capacity.
Organizations that engage in a formal iam assessment often discover that the breadth of what needs to be reviewed is considerably wider than anticipated. A typical enterprise environment may have thousands of identities across dozens of systems, many of which have not been reviewed since the accounts were first created.
The assessment typically maps access rights against actual job functions. This means comparing what a user or service account is permitted to do against what they genuinely need to do in order to perform their role. That comparison, done systematically and at scale, is where the most significant findings emerge.
The Problem of Accumulated Permissions
Access rights accumulate over time in ways that are difficult to track manually. When someone changes roles, their original permissions are rarely fully removed — new ones are added on top of the old set. Over the course of several role changes, a single employee may hold access rights that span multiple departments, systems, and data categories that have nothing to do with their current responsibilities.
This is sometimes called permission creep, and it is extraordinarily common in organizations that have not conducted a structured review. The risk it creates is real: excessive access rights mean that if an account is compromised, an attacker has a much wider surface area to work within. It also means that internal misuse — whether intentional or accidental — is more likely to have serious consequences.
Dormant and Orphaned Accounts
One of the most consistent findings in any identity review is the presence of accounts that should no longer exist. Dormant accounts belong to users who have not accessed a system in a significant period of time, often because they left the organization, changed roles, or the system itself became less relevant to their work. Orphaned accounts are those with no clear current owner — often created for a specific project or vendor engagement and never formally decommissioned.
These accounts represent a meaningful risk. They may retain elevated access rights, they are unlikely to be monitored actively, and they often fall outside the normal cycle of password updates and access reviews. An organization may believe that departing employees have their access removed, but without a structured process and regular verification, exceptions accumulate quietly.
Why IT Teams Are Routinely Caught Off Guard
The surprise that follows a thorough identity and access review is not a reflection of negligence on the part of IT teams. In most cases, it reflects the structural reality that managing access is a continuous process that competes with many other operational priorities. When teams are focused on keeping systems available, managing helpdesk volume, and supporting infrastructure changes, the granular review of who can access what tends to be deferred.
There is also a tool visibility problem. Organizations may use multiple systems — cloud platforms, on-premises applications, collaboration tools, security infrastructure — each with their own access controls and administrative interfaces. Without a consolidated view across all of those systems, it is genuinely difficult to understand the full state of access at any given moment. Data that lives in separate directories, spreadsheets, and ticketing systems does not combine automatically into a coherent picture.
The Gap Between Policy and Practice
Most organizations have written policies about access management. Those policies typically describe how access should be requested, approved, and reviewed. What a structured assessment often reveals is a significant gap between what the policy says and how access is actually managed day to day.
Access requests may be approved informally, via email or verbal agreement, without proper documentation. Periodic access reviews may be listed in policy but not consistently executed. Approval workflows may exist in theory but be routinely bypassed when time pressure is high. These gaps do not mean that people are acting in bad faith — they mean that the operational process has not kept pace with the written standard, which is an extremely common condition in organizations of any size.
This gap has direct implications for compliance. Frameworks such as those defined by the National Institute of Standards and Technology establish clear expectations around access control, least privilege, and account management. When an organization cannot demonstrate that its actual practices match its documented controls, it faces real exposure during audits, regardless of how strong its technology stack may be.
Shared Credentials and Accountability Gaps
Another finding that surprises many teams is the extent of shared credential use. Shared accounts — where multiple people log in using the same username and password — are commonly justified on grounds of convenience or cost, particularly for legacy applications or specialized tools with limited licensing. The problem is that shared credentials make it impossible to determine who performed any given action in a system. When something goes wrong, or when an audit requires attribution, the trail disappears.
This is not only a security concern. In regulated industries, the inability to demonstrate individual accountability for access to sensitive systems or data can constitute a compliance failure on its own, independent of whether any harm actually occurred.
What the Findings Enable
The value of completing a formal identity and access review lies not just in identifying what is wrong but in establishing a clear baseline from which improvements can be made in a structured, prioritized way. Without that baseline, organizations are essentially making decisions about access management in the dark — addressing the issues they happen to notice while remaining unaware of the ones they cannot see.
A completed iam assessment produces a documented picture of the current access environment, including where the highest concentrations of risk exist. That picture allows IT leadership and security teams to prioritize remediation based on actual exposure rather than assumption. It also provides a foundation for building the ongoing processes — regular access reviews, automated provisioning and deprovisioning, role-based access structures — that prevent the same issues from re-emerging over time.
Prioritizing Remediation Without Disrupting Operations
One concern that often arises after findings are delivered is how to address them without disrupting the business. Revoking access rights at scale, changing account structures, or implementing new approval workflows all carry the risk of operational impact if handled poorly. This is why findings from an iam assessment are most useful when categorized by risk level and operational sensitivity.
Dormant accounts with no current business justification can typically be disabled or removed with minimal operational risk. Excessive permissions on active accounts require more careful coordination, since removing access that someone depends on — even access they arguably should not have — can create immediate workflow problems. A phased approach, informed by the specific findings rather than generic recommendations, tends to produce sustainable results.
The Ongoing Nature of Access Management
A common misunderstanding is that completing a review resolves the problem. It does not. What it does is establish a clean starting point and surface the process failures that allowed the current state to develop. Sustaining the improvements requires embedding access review into regular operations — ideally with defined cycles, clear ownership, and tooling that supports visibility across systems.
Organizations that treat identity and access management as a one-time project tend to find themselves in the same position a few years later, facing a new review with the same patterns of accumulated permissions and unmanaged accounts. The structural problems — informal approvals, inconsistent deprovisioning, lack of cross-system visibility — do not resolve themselves without deliberate process design.
An iam assessment creates the conditions for that process design, but the design itself requires commitment from IT leadership, security teams, and the business units that rely on access to critical systems. Without that alignment, findings get acknowledged and then quietly set aside as other priorities take over.
Closing Thoughts
What makes an identity and access review genuinely valuable is not the technology used to conduct it or the comprehensiveness of the report that results. It is the clarity it provides about a part of the organization’s security and operational posture that is rarely examined with sufficient rigor.
For IT teams that have been managing access reactively — responding to requests, handling departures, troubleshooting access problems as they arise — a structured assessment often represents the first time they have seen the full picture. That picture is almost never what they expected. The dormant accounts, the permission accumulation, the gap between policy and practice — these are not unusual findings. They are the predictable result of managing a complex, evolving environment without a structured review process in place.
Recognizing the current state clearly, without overreaction or minimization, is the starting point for building access management practices that are actually sustainable. That is what a real assessment makes possible — not the elimination of all risk, but the ability to understand it, prioritize it, and address it in a way that holds over time.
