IGA Program Readiness Checklist

Use this before starting an IGA program, or to diagnose why an existing one isn’t producing real governance value. It’s built from the gaps I’ve actually seen cause problems — not a generic vendor checklist.

Authoritative Source & Data Quality

• HR system identified as the single authoritative source for identity lifecycle events
• Core attributes (department, title, manager, employment type, effective date) are consistently populated
• Termination and transfer events are captured with accurate effective dates

Application Landscape

• Applications inventoried and classified by integration complexity, criticality, and risk
• Connector approach identified per application: direct, JDBC, web service, or disconnected/manual
• Disconnected applications have a defined manual fulfillment process and SLA

Role & Entitlement Model

• Existing access patterns reviewed for candidate birthright roles (role mining complete or planned)
• Governed exception process defined for access outside birthright roles
• SoD conflict rules defined at the business-function level, with business ownership assigned

Governance Process

• Certification cadence defined and risk-tiered, not a single blanket schedule
• Reviewers will see role-based, contextualized summaries — not raw entitlement lists
• Audit and compliance reporting requirements (SOX, GDPR, etc.) mapped to available data

Platform & Technical Readiness

• Provisioning and governance share the same identity/entitlement data, not separate systems
• Technical observability (connector health) and governance observability (certification/SoD metrics) both defined
• Knowledge transition plan exists to avoid single-person dependencies