For many organizations, one of the most visible IAM metrics is also one of the least useful.

“98% of access reviews completed.”

It sounds like a successful control.

The review campaign was launched. Managers responded. Certifications were completed. Audit evidence exists.

But what does the number actually tell us about the organization’s identity risk?

Very little.

A completed access review does not necessarily mean that inappropriate access was identified. It does not tell us whether reviewers had enough information to make good decisions. It does not tell us whether excessive privileges were removed, whether terminated users were deprovisioned on time, or whether unmanaged identities exist outside the formal IAM process.

This highlights a broader problem in identity governance:

IAM programs often measure what they do rather than whether the organization is becoming safer because of what they do.

A mature IAM measurement framework needs to go further.

Activity Is Not the Same as Effectiveness

IAM teams naturally collect operational metrics.

They know:

• how many access requests were processed
• how many certifications were completed
• how many accounts were provisioned
• how many accounts were disabled
• how many applications were onboarded
• how many tickets were closed

These numbers are useful for understanding workload and operational performance.

But they do not necessarily demonstrate control effectiveness.

Consider two organizations.

Organization A

• 99% of access reviews completed
• 2% of reviewed access revoked
• 15% of applications have unclear ownership
• Thousands of dormant accounts
• Significant manual provisioning
• Several hundred unresolved exceptions

Organization B

• 92% of access reviews completed
• 15% of reviewed access revoked
• Nearly every critical application has an accountable owner
• Dormant access is actively identified
• Most lifecycle events are automated
• Exceptions are time-bound

Which organization has better identity governance?

The answer is not obvious from completion rates.

This is why IAM metrics need to evolve from activity measurement toward risk and control measurement.

1. Start With the Outcome

Before defining metrics, an IAM program should ask:

What are we trying to accomplish?

Typical objectives include:

• ensuring the right people have the right access
• removing access when it is no longer required
• limiting excessive privilege
• reducing identity-related security risk
• ensuring accountability for access
• automating predictable lifecycle processes
• maintaining reliable identity data
• demonstrating compliance

Metrics should map back to those outcomes.

Otherwise, organizations can end up optimizing processes that have little relationship to the underlying risk.

A useful IAM scorecard can therefore be organized around several dimensions:

1. Identity lifecycle
2. Access hygiene
3. Privilege
4. Governance effectiveness
5. Ownership and accountability
6. Automation
7. Exceptions
8. Identity data quality
9. Control responsiveness
10. Business impact

2. Identity Lifecycle Metrics

The first area to measure is whether identities are being created, changed and removed correctly.

Time to provision

How long does it take to provide required access after an identity becomes eligible?

This can reveal unnecessary manual work and delays in onboarding.

Time to deprovision

How long does it take to remove access after termination or another triggering event?

This is often more important from a security perspective.

A useful metric is:

Median time from authoritative termination event → access revocation

But averages can hide serious outliers.

An organization might have an average of two hours while a small number of highly privileged accounts remain active for days.

Therefore, IAM teams should also track:

• median
• 90th percentile
• critical-system outliers

Mover effectiveness

Employee transfers are particularly interesting.

A user changing roles may need new access while losing old access.

Measure:

Percentage of movers whose previous-role access was removed within the defined control window.

This is often more informative than simply measuring how many users changed departments.

3. Access Hygiene

The next question is:

How much unnecessary access exists?

Possible measurements include:

• dormant accounts
• unused entitlements
• inactive application accounts
• excessive group memberships
• stale privileged access
• access without a current business justification
• access belonging to terminated or inactive identities

One particularly useful metric is:

Percentage of granted access with no observed usage over a defined period

This does not automatically mean that the access should be removed.

Some access is legitimately required even if it is rarely used.

But the metric creates a valuable signal for investigation.

The objective is not:

Remove everything unused.

It is:

Identify access that deserves a closer governance decision.

4. Privileged Access

Not all access carries the same risk.

IAM measurement should therefore distinguish ordinary access from privileged access.

Useful metrics include:

• number of privileged identities
• privileged identities without accountable owners
• dormant privileged accounts
• privileged access without expiration
• standing privileged access
• emergency access usage
• time required to revoke privileged access
• percentage of privileged access that is just-in-time or time-bound

A useful question for executives is:

How much privileged access exists today that does not need to exist permanently?

That question is usually more meaningful than simply reporting the number of privileged accounts.

5. Access Review Effectiveness

Access reviews still matter.

The problem is measuring only completion.

Instead of reporting:

98% of reviews completed

measure the quality and outcome of the review.

For example:

Review decision rate

What percentage of reviewed access was actually changed?

Revocation rate

What percentage of reviewed access was removed?

Reviewer response quality

How frequently do reviewers make meaningful decisions rather than approving entire batches without examination?

High-risk review coverage

What percentage of high-risk access is reviewed according to policy?

Remediation completion

After an access decision is made, how quickly is the change actually implemented?

This creates a much more complete control chain:

Review → Decision → Remediation → Verification

Measuring only the first step can give a false sense of security.

6. Ownership and Accountability

One of the most valuable IAM metrics is also one of the simplest:

What percentage of identities and access relationships have accountable owners?

Consider measuring ownership for:

• applications
• privileged accounts
• service accounts
• groups
• roles
• sensitive entitlements
• machine identities

An organization might have excellent visibility into what access exists while still having poor governance because nobody is accountable for deciding whether that access should exist.

Ownership therefore becomes measurable.

For example:

Percentage of critical applications with an assigned business owner

or:

Percentage of privileged non-human identities with an accountable owner

These metrics reveal governance gaps that access-review completion rates cannot.

7. Exception Metrics

Exceptions are unavoidable.

The problem is unmanaged exceptions.

An IAM program should know:

• how many active exceptions exist
• how many are past expiration
• how many have no owner
• how many involve privileged access
• average exception duration
• recurring exceptions by application or business unit

One particularly useful metric is:

Percentage of exceptions past their expiration date

An exception that was approved for 30 days but remains active six months later is no longer functioning as a temporary exception.

It has effectively become part of the access model.

That is a governance signal.

8. Automation Metrics

Automation is not valuable simply because it reduces tickets.

It also improves consistency.

IAM teams can measure:

Percentage of lifecycle events processed automatically

Percentage of applications supporting automated provisioning

Percentage of deprovisioning actions automated

Percentage of access changes requiring manual intervention

Number of recurring manual exceptions

These metrics help identify where the IAM operating model is still dependent on people performing repetitive actions.

The goal is not 100% automation.

Some decisions should remain human.

The goal is to automate predictable decisions and repetitive execution, while preserving human judgment for complex or high-risk situations.

9. Identity Data Quality

Bad identity data produces bad governance decisions.

IAM programs should therefore measure the quality of the information used to make access decisions.

Potential metrics include:

• identities missing managers
• identities missing departments
• identities with conflicting attributes
• duplicate identities
• inactive identities still present
• applications with incomplete ownership information
• accounts that cannot be mapped to an authoritative identity
• entitlements without descriptions
• groups without owners

A useful composite measure could be:

Governance-ready identity percentage

Percentage of active identities containing the minimum attributes required for lifecycle and governance decisions.

This shifts the conversation from:

“Our directory contains 100,000 identities.”

to:

“97% of our identities contain the information required to govern them reliably.”

That is much more useful.

10. Orphaned and Unmanaged Access

Another important measurement category is access that exists outside the organization’s intended governance model.

Examples include:

• accounts not connected to an authoritative identity
• application accounts without owners
• service accounts without ownership
• local accounts
• credentials outside approved management processes
• applications not integrated with the IAM lifecycle
• identities discovered outside the central identity platform

This is where the concept of governance coverage becomes useful.

For example:

What percentage of known enterprise identities are actually covered by the organization’s defined lifecycle and governance controls?

The answer may be considerably lower than expected.

11. Control Responsiveness

Security controls are not only about whether something eventually happens.

They are also about how quickly it happens.

IAM programs should measure response times for events such as:

• employee termination
• privileged access revocation
• high-risk access detection
• policy violations
• access-review remediation
• emergency access expiration
• identity compromise

For example:

Median time to revoke high-risk access

can be a more meaningful security metric than:

Number of access revocations performed.

The latter measures volume.

The former measures responsiveness.

12. Risk-Based Metrics

Eventually, IAM programs should connect identity information with risk.

Not every identity deserves the same level of scrutiny.

Consider measuring the population of identities that combine multiple risk factors:

• privileged access
• sensitive application access
• unusual activity
• dormant status
• weak authentication
• excessive permissions
• conflicting roles
• unusual geographic or behavioral patterns

The objective is not necessarily to create one perfect “identity risk score.”

Rather, IAM teams should be able to answer:

Where is the concentration of identity risk?

That is a much more useful question for security leadership.

13. Business Impact Matters Too

IAM is ultimately a business capability.

Operational metrics should therefore include business impact.

For example:

• average time to onboard employees
• time required to grant critical application access
• access-related support tickets
• access-related employee delays
• percentage of access requests automatically fulfilled
• application onboarding time
• number of manual approvals per access transaction

Security and efficiency should not be treated as opposing goals.

A well-designed identity process can improve both.

If a legitimate employee waits three days for routine access, the organization has an efficiency problem.

If anyone can obtain sensitive access instantly without appropriate controls, it has a security problem.

Good IAM architecture tries to solve both.

14. A Better IAM Scorecard

A practical executive IAM scorecard could look something like this:

This is already substantially more informative than:

Access reviews completed: 98%.

15. Metrics Should Tell a Story

An IAM dashboard should not become a collection of 50 numbers.

The best metrics answer a sequence of questions.

Are we seeing the environment?

Visibility

↓

Do we know who is accountable?

Ownership

↓

Is access appropriate?

Access hygiene

↓

Is risky access controlled?

Privilege and risk

↓

Are lifecycle changes happening correctly?

Lifecycle effectiveness

↓

Are problems being fixed?

Remediation

↓

Are controls improving?

Trend

That gives security leadership a much clearer picture of IAM effectiveness.

16. The Most Important Metric May Be the Trend

A single IAM metric is rarely enough.

What matters is whether the environment is improving.

For example:

Dormant privileged accounts

January: 1,240
April: 860
July: 510
October: 280

That trend tells a story.

So does:

Applications without accountable owners

January: 430
April: 390
July: 410
October: 425

The second example indicates that the organization may be treating ownership as an unresolved structural problem rather than reducing it.

Metrics become much more valuable when they expose direction and persistent weaknesses.

From Compliance Reporting to Identity Risk Management

The maturity of an IAM program can often be seen in the questions its leadership asks.

An immature program asks:

How many access reviews did we complete?

A more mature program asks:

How much inappropriate access did we identify?

An even more mature program asks:

Which categories of inappropriate access keep recurring, and why?

Eventually, the question becomes:

Where is identity risk increasing, where is it decreasing, and what should we change?

That is the real purpose of IAM measurement.

Access reviews, provisioning workflows, certifications and audit reports remain important.

But they are mechanisms, not outcomes.

The ultimate objective of identity governance is not to complete more workflows.

It is to create an environment in which the organization can confidently answer:

Who has access?

Why do they have it?

Who is accountable for it?

Is the access still appropriate?

How quickly can it be changed when circumstances change?

And perhaps most importantly:

Is the organization’s identity risk getting better or worse over time?

When IAM metrics can answer those questions, the IAM program stops being measured primarily as an operational function and starts being measured as what it should be:

a security and risk-management capability.