Identity management risks start with one question: can you say who holds each employee account, who owns it, and whether the person still works here? If the answer is “not without asking three teams”, access has slipped out of control. That is Signisys’ working test, not a standard. Identity and access management (IAM) is how a firm decides who can sign in to what. Its own page explains how identity and access management works. This guide is for an IT manager or owner at a firm in India or the GCC. It gives six signs, a test for each and an order for fixing, but it covers employee accounts only, not machine accounts or tools.
Last reviewed 2026-11-01 by Manish Sharma.
Identity Management Risks in Short: Six Signs Access Has Slipped
Six signs show that access has slipped, listed from the plainest to confirm.
Key Takeaway Access is out of control when a list your firm already holds disagrees with reality: a leaver is still active, a login has several users, or an account has no owner.
The signs below show up when two lists disagree.
| The sign | What it puts at risk | How to confirm it |
|---|---|---|
| A leaver’s account still works | If it signs in, someone who no longer works here can act in the firm’s name. | Compare HR’s leaver list with enabled accounts and their last sign-in dates. |
| Several people share one login | If several people use it, a record shows the login, not the person, and a leaver may know the password. | List each shared login and who knows its password. |
| An account has no owner | Nobody notices when it is no longer needed or is misused. | Pick a handful of accounts and ask who owns each. |
| Rights outlast a move | If the old team’s access stays, the person reaches work they no longer do. | Start from HR’s transfer list and look for groups that still belong to the old team. |
| A powerful account has no named reason | If it is taken over, the damage reaches further. | List who holds administrator rights and ask why. |
| A sensitive app asks for one step to sign in | If that one step is stolen, an outsider needs nothing more. | For each application that holds sensitive data, look at what the sign-in screen asks for beyond the password. |
Identity Management Risks, Sign 1: A Leaver’s Account Still Works
When a person leaves and the account stays enabled, the firm has no way to tell who signs in later. It could be the former employee or someone else using the account.
NIST SP 800-53 Rev. 5 (September 2020, with updates as of December 2020) is US federal guidance. It is a catalogue of controls, not a how-to for a mid-size firm. NIST also leaves the time period to the organisation. Its account-management control, AC-2, includes the item “Align account management processes with personnel termination and transfer processes.”
This is one of the identity management risks that a single list comparison can confirm. Here is an illustration, not a client. A finance analyst leaves and HR closes the record. However, the account in one finance application stays enabled; that application sits outside the main sign-in.
Get the list of people who have left.
Look each person up in the main directory and in two or three applications that matter.
For any account that stays enabled, read the last sign-in date and compare it with the leaving date.
Leaver risks in more depth belong to the offboarding article planned for this set.
Identity Management Risks, Sign 2: Several People Share One Login
A shared login is one username and password used by more than one person. A record of what happened under it does not say which person did it.
The NCSC’s 10 Steps guidance on identity and access management is UK guidance from 11 May 2021 (version 1.0), written for cyber security professionals. It says to “ensure you can associate all actions in the system to the person or account that performed them”. That sentence is about the design of access control systems, and it does not mention shared logins. Here is Signisys’ reasoning, not the NCSC’s: a shared login ties actions to the account but not to one person, so a record does not say who among the users did it. NIST and the NCSC do not state this.
NIST does address shared accounts. Its AC-2 discussion says: “Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts.”
Of the identity management risks in this article, this is the one where the record itself does not name a person.
Key Takeaway In Signisys’ reasoning, a shared login ties actions to the account but not to one person.
To confirm it, ask each team which logins several people use, for example a banking portal, a social media account or an administrator console. For each one, ask who knows the password, when it last changed and whether anyone who has left knew it. If the answer to the last question is “we do not know”, that is the finding.
Identity Management Risks, Sign 3: Accounts Nobody Owns
An account with no named owner can stay open and unwatched, and nobody may notice it is no longer needed. In Signisys’ wording, the owner is the person who answers for why the account exists and when it should end.
NIST’s control list includes “Assign account managers”. An enhancement to the control, AC-2(3), is also one of the conditions under which the control says to disable accounts, namely when they “Are no longer associated with a user or individual”. NIST again leaves the time period to the organisation. The NCSC adds that firms should remove or suspend a temporary account, such as one made to test a process, once the need for it ends. Service and machine accounts are out of scope here.
Someone opens a project account for a six-week task, and nobody records who asked for it. When the task ends, the account carries no name, and nobody has the job of closing it.
To confirm this sign, export the account list from the main directory and from one application that matters. Pick a handful of accounts. For each, ask who asked for it, who owns it now, and what would show it is no longer needed. If an account lacks any of the three answers, it is an example of this sign.
Identity Management Risks, Signs 4 to 6: Three More to Check
Three more signs need a short block each, because other articles in this set cover them in depth.
Sign 4, rights outlast a move. A person who moves team can carry the old team’s access into the new one, and the account then reaches work the person no longer does. The NCSC asks for a policy that covers movers as well: “Ensure your account management processes includes a ‘joiners, movers and leavers’ policy, so access can be revoked when no longer needed, or changed for movers.” To test it, ask HR for the list of internal transfers, pick one name, and list the groups and shared folders that still belong to the old team. The access review article planned for this set also goes deeper.
Sign 5, a powerful account with no named reason. An administrator-level account is a bigger prize if someone takes it over. List who holds administrator rights and ask for a reason for each. A separate page explains how privileged access management works, while a separate article on why attackers go after admin accounts covers the detail.
Sign 6, a sensitive app asks for one step to sign in. If that one step is stolen, an outsider needs nothing more. For each application that holds sensitive data, look at what the sign-in screen asks for beyond the password. The password risks article planned for this set covers reuse and theft instead.
What to Check First: Three Lists to Compare
Compare three lists the firm already holds, in this order. First, HR’s leaver list against enabled accounts. Second, the shared-login list from the teams against who knows each password. Third, a sample of accounts against named owners. Signisys’ planning target is under an hour for these checks if the lists are available. It is our rule of thumb, not a measured time, and it is not from NIST or the NCSC. If the lists are not available, that is itself the answer to the first question.
The order is ours as well. A leaver’s active account is the one clear case. We know the named person has no business signing in, and nobody has to make a judgement call. Signs 2 and 3, by contrast, need a conversation.
Disable the leaver accounts and note the sign-in dates. Replace the shared login’s password or retire it, then record who needs the access in a named account. Give each ownerless account an owner or close it.
Disabling and closing are your decisions, and this article gives no step-by-step method. NIST leaves the review frequency to the organisation. The NCSC page calls for regular reviews without an interval; the repeat interval is a decision for your firm. These checks put a first answer on your identity management risks without any new tool.
Get specialist help in three cases: the lists are not available, the directory and the applications disagree about who exists, or a finding suggests someone has already used a leaver’s account. In that last case, tell your security lead at once.
What This Article Leaves Out, and Where to Go Next
The sources here are US federal guidance (NIST) and UK guidance (NCSC). This article says nothing about Indian or GCC rules, because we read none for it. It gives no statistic and makes no claim about how common any sign is. It covers employee accounts only. Machine accounts are a different subject, but how machine and AI-agent accounts get their identities is a separate read. For devices, see how devices end up compromised.
The six signs are Signisys’ own list, not a ranking, and the list may be incomplete. Other articles in this set cover nine steps for setting up access and choosing software for this use case. For the checklist, read a scored list of 16 checks for employee accounts. For the day-to-day view, see how employee identity and access work day to day.
Signisys offers identity and access management services, and this is a Signisys offer, not neutral advice.
Signisys provides identity and access management, helping organisations control who can access what, with single sign-on, strong authentication, privileged access and automated provisioning. Signisys agrees the exact scope for each engagement. Our Solution: Identity and Access Management (IAM). Our Service: Cybersecurity Services.
Identity Management Risks FAQ
What are the main identity management risks for a business?
How do I know whether an employee’s access is out of control?
Does NIST set a review interval for accounts?
Can a firm keep a shared login?
Do these signs apply to AI agents and service accounts?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.