Performance Playbooks › Technology › Identity & Access Management
How fast should access take to provision, and when is it truly secure?
Benchmark your identity and access management performance against world-class targets for provisioning speed, access reviews, orphaned accounts, and compliance. Learn what separates strong execution from elite, and where to focus first.
World-class identity and access management combines speed with rigor: access provisioning completes within 1-2 days, privileged reviews stay on schedule at 96-99% completion rates, and compliance violations drop below 1.5%. The gap is not just technology—it reflects governance clarity, integrated systems, and sustained operational discipline that treat access management as a continuous control, not a periodic task.
How performance compares
| Metric | Minimum | Strong | World-class |
|---|---|---|---|
| Access Request Resolution TimeAverage calendar days required to provision, modify, or revoke user access from initial request submission to completion and verification. | 5-8 | 2-4 | 1-2 |
| Privileged Access Review Completion RatePercentage of scheduled privileged account reviews (admin, service accounts, elevated permissions) completed on or before their scheduled certification date within a fiscal period. | 65-75 | 85-93 | 96-99 |
| Unprovisioned Access Violation RatePercentage of active user identities with resource access permissions that lack documented approval or have expired authorization records relative to total access grants. | 8-15 | 2-6 | 0.5-1.5 |
| Identity Lifecycle Onboarding-to-Productive-Access DurationMedian number of business days from new hire system record creation to provision of all primary role-required system and application access. | 7-12 | 3-5 | 1-2 |
| Orphaned and Stale Account Remediation CyclePercentage of dormant or unowned accounts (inactive >90 days or missing business owner) identified and disabled or remediated within 30 days of detection. | 50-65 | 80-90 | 94-99 |
| Identity Governance Audit Defect RatePercentage of sampled access control configurations (permissions, role assignments, entitlements) found non-compliant during internal or external audit engagements. | 12-20 | 4-8 | 0.5-2 |
The performance spread tells a story of compounding complexity. Organizations at minimum tier experience two structural problems: access requests wait because approval workflows lack clear owners and integration points, and orphaned accounts accumulate because dormancy detection runs quarterly or annually rather than continuously. Moving to strong tier (2-4 day provisioning, 85-93% review completion) typically requires one major investment: integrated identity governance platforms that unify data from HR, directories, and resource systems. The jump to world-class (1-2 day provisioning, 96-99% completion, <1.5% violations) is harder and slower—it requires governance architecture to mature. Managers must own access decisions with real-time visibility. Data quality disciplines must be enforced. Compliance becomes continuous monitoring, not annual certification. The cost of staying below strong tier is material: access delays block hiring, stale accounts create audit findings and insider threat exposure, and certification backlogs force rushed reviews that miss violations. Financial services and healthcare organizations typically operate in strong to world-class range due to regulatory pressure; mid-market organizations often sit at minimum tier not from lack of will but from tool investment and staffing decisions that delay progress.
What separates the leaders
Metric by metric
Access Request Resolution Time
The fastest path to 1-2 day provisioning is integrated orchestration: pre-built role templates that connect HR on-boarding events to automatic identity creation, with approval workflows mapped to defined owners rather than ad-hoc email chains. The single strongest lever is eliminating hand-offs between approval and execution—when the system that approves access can also trigger provisioning without manual re-keying, delays collapse. Measurement: track calendar days from submission to verification completion; if your median exceeds 4 days, audit your approval workflows for missing owners and your systems for integration gaps that force manual bridge steps.
Get the full Access Request Resolution Time playbook →Privileged Access Review Completion Rate
Reaching world-class on-time completion hinges on executive sponsorship and workflow automation working together. Executive sponsors—typically security or compliance leaders—must enforce accountability for overdue reviews by escalating to business leaders weekly; simultaneously, the access governance platform should auto-flag accounts for review based on a calendar, not a human reminder. The leverage point is removing friction: pre-populate reviews with recent access data and activity patterns so reviewers spend time on judgment, not data collection. Measurement: track the percentage of scheduled reviews completed by their certification date each quarter; if completion drops significantly, investigate whether review owners have changed or the system is introducing delays.
Get the full Privileged Access Review Completion Rate playbook →Unprovisioned Access Violation Rate
Violations drop to world-class levels through continuous, not periodic, validation. Build a routine—weekly or monthly—that compares active access permissions against documented approvals in your access management system, surfacing any gap for investigation and remediation. The key is removing latency: when violations are discovered months after they occur, remediation costs time and creates compliance risk. Automated comparison logic, run on schedule and alerting via workflow, replaces manual quarterly audits. Measurement: measure violations as a percentage of total active access grants; if your rate rises significantly, your approval documentation lags provisioning events or your platform lacks real-time reconciliation between access and approvals.
Get the full Unprovisioned Access Violation Rate playbook →Identity Lifecycle Onboarding-to-Productive-Access Duration
Moving from 7-12 days to 1-2 days requires automating the chain from hire to access. The critical lever is role-based access templates: when a new hire's job code maps automatically to a pre-built role with all required system and application access, provisioning can begin before the first day. Integrate your HRIS directly to your identity provisioning platform, and stage the user's identity record and role assignment before arrival. Measurement: track median calendar days from system record creation to access verification; if you exceed 3 days, examine whether role templates exist for all common job codes and whether your provisioning platform receives timely signals from HRIS.
Get the full Identity Lifecycle Onboarding-to-Productive-Access Duration playbook →Orphaned and Stale Account Remediation Cycle
Moving from minimum to world-class remediation rates requires shifting from annual cleanup to continuous detection and rapid action. Deploy automated tools that flag accounts inactive for 90 days and surface business owners for confirmation weekly; pair this with a defined workflow that disables accounts on the 30th day if no owner responds. The difference between strong and world-class is response discipline: organizations reaching world-class levels have accepted that stale account cleanup is a standing operational task, not a project. Measurement: track the percentage of dormant accounts disabled within 30 days of detection; if remediation lags, your alert workflow is not reaching business owners or your disable process requires manual steps.
Get the full Orphaned and Stale Account Remediation Cycle playbook →Identity Governance Audit Defect Rate
Defect rates drop to world-class levels when access control configurations are treated as code and continuously validated against policy, not checked manually once annually. Build or adopt a platform that encodes your access control policies (role definitions, segregation of duties rules, approval authorities) in a queryable form, then run continuous compliance scans that flag configurations that violate policy. Combine this with preventive design: require access requests to pass automated policy checks before approval is even offered. Measurement: in your next internal or external audit, calculate defects as a percentage of sampled configurations; if the rate rises above expected levels, examine whether your policies are documented in a form that can be audited programmatically, or whether preventive controls exist at approval time.
Get the full Identity Governance Audit Defect Rate playbook →What the best do differently
Identity and Access Management Governance
Governance establishes the structural backbone: who decides whether a user gets access, to what systems, for how long, and under what conditions. In practice, this means documenting approval authorities—which managers approve access to which systems, what triggers re-approval, and how conflicts escalate—then building workflows that enforce those rules consistently. A mature governance structure also creates an audit trail: every access decision is documented with approval, justification, and audit evidence. Without governance, organizations spend cycles debating who should approve each request; with it, approval decisions can move fast because the rules are clear. Start by mapping your highest-risk systems (those with financial, compliance, or security impact) and defining who owns access approval for each one. Then codify those rules in your identity platform so that approval workflows follow policy automatically, rather than requiring judgment call on each request.
Leading Practice Report
Full detail: Identity and Access Management Governance
The full report covers:
- Expected benefits
- Core principles
- Key success factors
- Key metrics
- Risks and mitigations
- Implementation roadmap
Identity Data Quality and Master Data Governance
Every access management challenge traces back to data quality. When a user appears with different names or IDs across your HR system, directory, and access platform, provisioning fails, reviews become unreliable, and audit trails break down. Master data governance treats identity data—users, organizational structure, job codes, roles—with the same rigor that finance applies to chart of accounts. Establish an authoritative source for each identity attribute: HR owns employee records, security owns roles, business process owners own role-to-system mappings. Then build automated reconciliation: compare data across systems weekly, flag conflicts, and resolve them by a defined rule. Measurement: if your provisioning errors trace frequently to mismatched user names, missing organizational assignments, or conflicting role mappings, data governance is your limiting factor. Fixing this foundational layer often accelerates every other metric on this playbook.
Leading Practice Report
Full detail: Identity Data Quality and Master Data Governance (Identity Source Systems Management)
Benefits, core principles, success factors, metrics, risks and the implementation roadmap.
Get the full report →Periodic Access Certification and Recertification
Certification is the discipline that catches access drift. On a defined schedule—typically annual for broad access, semi-annual for sensitive systems—managers review and certify that their teams still need the access they have been granted. This forces a conversation: do you still use that database? Does this person still work here? Does their role still require admin access? Certification creates two critical artifacts: documented proof that access was intentional (audit evidence), and a list of access that should be revoked (remediation). The lever is coupling certification with a remediation workflow: when managers identify unnecessary access during certification, the system routes it to removal without another round of approval. Build your first certification cycle on your highest-risk systems (financial, compliance-sensitive applications), then expand to broader access as process maturity increases. Measurement: completion rates tell you whether the process is enforced (strong performance at 85%+); defect findings tell you whether managers are actually reviewing access or just approving it by default.
Leading Practice Report
Full detail: Periodic Access Certification and Recertification
Benefits, core principles, success factors, metrics, risks and the implementation roadmap.
Get the full report →First steps
- Measure your current state this week without installing anything: sample 50 recent access requests and calculate median days from submission to completion; sample 50 active users and manually check whether their access matches a documented approval; note how many accounts were disabled in the past 90 days and why. These three snapshots anchor your gap relative to the benchmarks and reveal which metric is your highest leverage point.
- Map access approval authorities for your three highest-risk systems (those handling financial transactions, regulated data, or critical operations). Document who is authorized to approve access, which roles can request it, and what justification is required. Then define this in your identity platform as policy rules, so future requests are routed to the correct approver automatically instead of by email.
- Identify your authoritative source system for identity data: typically your HRIS for employee records. Audit its quality (spot-check 20 records for missing or conflicting organizational assignments, job codes, or manager linkages), then ensure your identity platform imports this data daily and alerts when imports fail. Poor data quality blocks every other improvement; fixing the source eliminates cascading errors downstream.
What is preventing us from completing access requests in 2 days instead of 5, and which systems are holding the most orphaned accounts today?
Start free with Ask Kepler →Beyond the fundamentals
Advanced & Emerging Practices
Emerging practices are included with Ask Kepler Pro and Max.
Unlock these practices →How are these playbooks made? Read our methodology.