Most identity governance programs can tell you exactly who has access, when it was last reviewed, and which control signed off. Provisioning is automated. Certification campaigns run on schedule. The audit reports come back clean.
So why does identity risk keep showing up anyway?
Excessive access still accumulates. Privileges stay active long after the job changes. Segregation-of-duty conflicts appear between review cycles. In a lot of organizations, inappropriate access is discovered months after the risk first appeared. The problem isn’t a lack of governance activity. It’s a timing mismatch. Identity risk changes continuously, but governance validates it periodically. That gap is becoming one of the harder problems in modern identity programs.
Periodic reviews were built for a slower enterprise
For decades, periodic access reviews have been the backbone of identity governance. A manager or application owner looks at a user’s access on a schedule and confirms it still fits the job.
That model earned its place. Certifications create accountability, satisfy regulators, and give organizations a formal record of access decisions. They still matter across financial services, healthcare, manufacturing, and government. But they were designed for a workplace that changed slowly. People stayed in roles for years. Application estates were smaller. Access moved at a pace a quarterly or annual review could keep up with. That workplace is gone. Cloud adoption spread access across thousands of applications. People change teams and projects constantly. Access now evolves far faster than the review cycle that’s supposed to watch it. The result is governance that keeps evaluating yesterday’s access instead of today’s risk.
Governance latency: the gap between change and validation
Here’s a simple way to name the problem. Call it governance latency: the time between a meaningful identity change and the governance step that checks whether access is still appropriate.
Picture an employee moving to a new department with new responsibilities. Their access needs to change immediately. Some old privileges should drop. Some new ones are required. If governance runs on a quarterly cycle, that validation might not happen for months. In the meantime, the person keeps their old access and picks up new access on top of it. The footprint grows beyond what the role needs. The longer that latency runs, the more room there is for excessive access and policy violations to sit undetected. Security teams already treat response time as a core metric for incidents. Governance deserves the same lens. The longer it takes to validate access after a change, the wider the exposure window.
Movers are where access quietly piles up
Of all the identity lifecycle events, transfers are the one most programs under-govern.
Onboarding and off-boarding get real attention. New hires are provisioned carefully. Leavers are de-provisioned in a defined process. Both have a clear trigger and a clear owner. Transfers are messier. They rarely reset access. New permissions get added for the new role, and the old ones tend to stay, either because they still look relevant or because nobody owns removing them. Do that a few times across a career and you get privilege accumulation. Someone who has held three roles can carry fragments of all three. Each grant looked reasonable on its own. Together they add up to far more access than the current job needs.
What makes it dangerous is how quietly it happens. There’s no single alarming event. The risk builds slowly and usually stays invisible until a certification or an audit trips over it.
That’s the core case against leaning only on periodic reviews.
From calendar-driven to event-driven governance
As organizations try to close that latency, a different operating model is taking shape. Real-time identity governance moves governance from a calendar to an event.
Instead of waiting for the next campaign, validation fires when something meaningful changes. A role change, a department transfer, a new manager, a change in employment status. Each becomes a trigger to check whether access still fits. That changes the question being asked. Not whether access was appropriate three months ago, but whether it’s appropriate now that the context just changed. This doesn’t retire periodic certification. Regulators and auditors will keep requiring formal cycles. It adds a layer that operates much closer to where risk appears.
Continuous validation is Zero Trust applied to governance
The spread of Zero Trust makes the case stronger.
Zero Trust rests on one idea: trust shouldn’t be assumed to hold forever. It should be re-checked against current context and risk. Governance is part of that. When someone’s responsibilities change, the assumptions behind their access may no longer hold. A certification decision from three months ago doesn’t necessarily reflect who they are today. Validating access at the moment context changes keeps governance aligned with that principle. It’s the same instinct Zero Trust applies to authentication, pointed at access decisions instead.
What does this mean for identity leaders
A few things are worth considering:
- Periodic reviews are necessary but no longer sufficient as the primary control for access risk.
- Governance latency creates exposure windows where inappropriate access persists undetected.
- Transfers and role changes usually carry more risk than onboarding or offboarding.
- Event-driven governance lets you validate access when risk appears, not months later.
- Continuous validation is how identity governance supports Zero Trust in practice.
Governance must move at the speed of change
Periodic reviews served enterprises well for a long time, and they’ll stay part of the program. They give accountability, satisfy compliance, and create a record.
But identity risk doesn’t wait for the certification calendar. It shows up when people change roles, when responsibilities shift, when the org chart moves. In most enterprises, that’s happening every day.
The next phase of governance won’t be about reviewing access more often. It’ll be about validating access continuously, as identities change. Closing governance latency is where that starts.
When change is constant, governance must move with it.