You can’t outsource accountability

Most organizations today rely on external partners to run critical parts of their operation. Infrastructure is hosted. Applications are delivered as services. Security tooling is licensed rather than built. This is not a weakness. It is how modern organizations scale. 

But there is a dangerous line many organizations cross without noticing it: confusing delegation with accountability. 

That line is especially blurred when it comes to identity. 

 

When responsibility becomes fragmented 

In theory, identity belongs to IT. In practice, it belongs to no one. 

Access requests flow through service desks. Projects are delivered by consultants. Exceptions are approved by managers who do not fully understand their impact. Security teams review controls after the fact. HR triggers changes that rely on systems they do not operate. 

Gartner estimates that 30–40% of all IT service desk tickets are related to identity and access issues, making IAM one of the most operationally expensive yet least clearly owned domains in IT operations [2]. 

Each part of the process works in isolation. No single part owns the outcome. 

When access is delayed, it becomes an operational nuisance. When access is excessive, it becomes a security finding. When offboarding fails, it becomes a compliance issue. Each problem is addressed locally, by different teams, with different priorities. 

Research from identity governance vendors shows that more than half of organizations struggle to reliably remove access when employees change roles or leave, primarily due to fragmented ownership rather than lack of tooling [4]. 

From the outside, it appears that “identity is being handled.” From the inside, responsibility is fragmented across tickets, inboxes, and temporary fixes. 

The false comfort of delivery 

Many leaders take comfort in having identity “delivered.” 

An identity platform has been implemented. Best practices have been discussed. Documentation exists. The project has an end date, a sign-off, and a handover. On paper, responsibility has moved from the vendor to the organization. 

Gartner research shows that IAM maturity often declines 12–18 months after initial implementation, as provisioning speed, access accuracy, and review quality deteriorate without continuous operational ownership [1]. 

In reality, identity does not behave like a completed project. It behaves like a living system. The organization changes, but the identity model lags behind. Temporary decisions quietly become permanent. Manual workarounds outlive their justification. 

Microsoft reports that password resets and access-related issues can account for up to 40% of service desk workload in organizations that lack mature identity operations — even when modern identity platforms are deployed [3]. 

Months later, no one remembers why certain access paths exist. No one feels empowered to remove them. And no one is accountable for the growing gap between how the business operates and how identity is enforced. 

 

Why tools and partners don’t solve this on their own 

Platforms like Microsoft Entra ID are powerful, but they are not operators. They provide capability, not accountability. They assume someone defines how identity should work today, tomorrow, and next year — and actively keeps it aligned as reality changes. 

External partners face the same limitation. They can assist, advise, and deliver. They cannot own your outcomes unless that ownership is explicitly designed into how identity is run. 

Gartner notes that organizations treating IAM primarily as a support or managed service consistently underperform on access governance outcomes, including overdue access reviews and slow remediation of excessive access [1]. 

The moment identity is reduced to “support” or “administration,” accountability dissolves. Problems become tasks to close rather than risks to eliminate. 

For executives, this creates a dangerous asymmetry: the business depends on identity working flawlessly, but no one is measured on whether it actually does. 

Accountability is not a contract clause 

Accountability is not established by a service description or an SLA. It is established by clear ownership over outcomes.

That means someone wakes up responsible for identity still working when the organization changes. When a new system is introduced. When roles evolve. When regulations tighten. When incidents happen. 

Research from the Ponemon Institute shows that organizations with weak governance and unclear accountability incur significantly higher costs for remediation, audit response, and repeated control failures than those with proactive ownership models [5]. 

Without that ownership, organizations default to reactive behavior. Access issues are fixed when they block work. Security gaps are addressed when audits highlight them. Costs accumulate quietly in the form of inefficiency, rework, and growing risk. 

This is why identity-related problems feel repetitive. The same types of issues resurface because nothing owns the system end to end. 

Delegation without ownership increases risk 

Delegating identity work is normal. Delegating accountability is not. 

Gartner observes that IAM spending continues to rise year over year, while many organizations report no corresponding improvement in access accuracy, audit outcomes, or operational stability — a clear signal that investment without ownership does not reduce risk [1]. 

When identity is treated as a collection of tasks rather than a continuously operated capability, risk increases even as spend grows. 

Executives rarely see this clearly until a critical moment forces the issue: a stalled acquisition, a failed audit, a public incident, or an operational halt that could have been avoided. 

At that point, the question is no longer technical. It is organizational: who was actually responsible for ensuring this didn’t happen? 

The uncomfortable conclusion 

Accountability cannot be outsourced. It can be supported, shared, and enabled — but it cannot be transferred by contract or technology alone. 

Identity sits at the intersection of HR, IT, security, and business operations. As long as it belongs partially to everyone and fully to no one, it will continue to create hidden risk. 

Organizations that address this early do not start by buying more tools or running another project. They start by answering a simple, uncomfortable question with clarity: 

Who is accountable for identity working every day, not just being implemented? 

Sources 

1. Gartner — Outcome-Driven Metrics for IAM to Drive Value https://emt.gartnerweb.com/ngw/eventassets/en/conferences/hub/identity-access-management/documents/gartner-iam-outcome-driven-metrics-to-drive-value.pdf 

2. Gartner — Identity and Access Management Insights & Research https://www.gartner.com/en/information-technology/insights/identity-access-management 

3. Microsoft — Identity and Access Management (Entra ID) Documentation and Research https://www.microsoft.com/security/business/identity-access-management 

4. SailPoint — Identity Security Research and Reports https://www.sailpoint.com/identity-library/ 

5. Ponemon Institute — Security, Risk, and Governance Research https://www.ponemon.org/research