Business oriented IAM workflows: what they need to provide

Business Driver of identity access management workflows

Particularly in the field of authorization allocations, withdrawal of authorizations and authorization amendments, business-oriented approval workflows are rapidly gaining in significance.

This is largely due to the fact that the responsibility for ensuring that employees have the right access authorizations at the right time is being shouldered by the departments, not least as a result of legal regulations.

Identity and access management workflows need to speak the language of the end user – both their native language and the business language. It is regarded by the end user as a help rather than a hindrance from the very first use and it guides the end user intuitively though the process and offers freedom along with the set processes. Identity and access management workflows must provide the perfect balance between standardization on the one hand and flexibility on the other.

Today, the workflow of IAM systems forms an indispensable part of the compliance policy in many companies. The process reliability, transparency, traceability, flexibility and performance afforded by workflow systems forms an intrinsic part of modern IT concepts.

The ideal approval workflow

Particularly in the field of authorization allocations, withdrawal of authorizations and authorization amendments, business-oriented approval workflows are rapidly gaining in significance. The responsibility for ensuring that employees have the right access authorizations at the right time is being shouldered by the departments, not least as a result of legal regulations.

Added value and benefit potential of a workflow be realized:

• Efficiency: Standardized understanding of the authorization processes results in reduced susceptibility to errors and quicker processing times
• Transparency: Compliance with legal regulations
• Control: Protection from compliance violations

So what are the requirements for modern authorization workflow systems? An IAM workflow standardizes work processes of the same type. It usually includes a large number of static applications and pre-defined approval levels. Despite this high level of standardization, identity and access management workflows must still offer maximum flexibility to cover as many situations encountered during everyday business as possible. After all, it is the exceptions, escalations and special cases that take up the most time.

Creating ad-hoc identity and access management workflows

With a business oriented workflow, these exception processes must be controlled by intelligent escalation, delegation and last but not least the option of ad-hoc changes during the run time. This flexibility and ability to make changes makes the process quicker and ideally suited for use in practice. The workflow should not be interrupted by irregularities or error sources, but shall continue in a solution-oriented way. It should also be possible to trace all activities completely thanks to the automated full documentation.

“Maximum transparency and control of
GRC-relevant security processes”

With standardized identity and access management workflows, you will gain control and transparency over your business processes relating to authorization management. The responsible people can view all activities in the process overview and intervene if necessary.

This means that processes can be controlled and monitored much more effectively and the digital process display also helps to reduce through-put times. Using escalation rules, defined time periods can be specified for processing tasks and deadlines can be secured with e-mail notifications.

Each process should be recorded, improving the documentation with no additional work. Colleagues must be informed of new tasks and processes automatically via e-mail.  The information flow between colleagues, departments and sites is significantly improved, which helps to optimize the process quality.

But don’t forget about Identity Access Governance!

Governance in authorization management – also known as access governance – means transferring more responsibility to the departments to secure important business resources. Access activities of employees in the company must be monitored more stringently as soon as access authorizations are approved and by carrying out regular checks (recertification) on existing rights.

When introducing business oriented identity and access management workflows, enterprises should look for a wide range of workflow-supported application and approval processes, offering maximum transparency and control of GRC-relevant security processes.

To sum it up: Access governance transfers the responsibility and decision-making power for assigning access rights to the departments. Enterprise must start with simple, business-oriented processes, which can be used to implement efficient, revision-proof requirement workflows. The “need to know” approach and multi-dimensional approver structures should be broken down to the individual user level for requirement processes.