The Fix That Never Reached the Process

Every certification campaign started with no terminated people on the list. It looked like the leaver process was working. It wasn't.

The campaigns were run by someone outside the identity team, out of spreadsheets. That person also had admin access to the systems being reviewed.

Before each campaign went out, they would check the accounts and find people who had been terminated but still had access. They saw a security problem, which it was, so they removed those accounts themselves.

They were trying to help. The trouble was where the fix happened.

Terminated people with access are a sign that something in the leaver process is broken. Maybe the HR feed, maybe a termination step, maybe a system nobody connected. Because the fix happened before the review, it never got back to anyone who could fix the cause. So it kept happening.

The review lost its record, too. When the fixes happen first, there is nothing to show, and nobody reviewing or auditing it can see the real state.

And there was no separation of duties. The person preparing the review could change the access being reviewed, with no ticket, no approval, and no trail. Deleting an account can also erase history an investigation might need.

Why does this belong in identity and not in GRC? The fixes a review finds live in identity: the leaver process, access roles, entitlements, the connected systems. The identity team sets the standard for how reviews run. GRC makes sure that standard meets the obligations and tests whether it works. If GRC also runs the review, it ends up testing its own work.

As a leader, I would put it back where it belongs.

The identity team owns the certification campaign and the evidence it produces. The business makes the access decisions.

Every finding goes back to whoever owns the process that caused it, so the fix sticks. Count the terminated people each review finds. If the leaver process is fixed, that number goes down.

Nobody changes the access they are reviewing. Removals go through the normal process, with a record. If the identity team is too small to separate those duties, have someone outside it sign off.

If a script or an agent removes access on its own, have it report every fix to the process owner. Otherwise it clears the symptom in seconds and the cause stays where it was.

I would rather see a review find terminated people than hide them.

Related

• Series 2 Post 12: LinkedIn post
• Series 3 Post 3: LinkedIn post
• Series 3 Post 5: LinkedIn post