IAM Risk Assessment Checklist

Most identity and access management programmes can say how many accounts they have; far fewer can say which of those accounts could do the most damage. This guide from IAM Careers gives a working IAM risk assessment checklist, a seven-step process, a scoring method and the evidence to collect. It sits alongside our wider guide to building an identity and access management strategy, and assumes you already run, or are building, a joiner-mover-leaver process and access reviews.

What Is an IAM Risk Assessment?

An identity and access management (IAM) risk assessment is a structured review of every identity that can reach your systems, the access each one holds and the controls that limit misuse, with each gap scored by likelihood and impact. Its output is a ranked list of risks with owners and deadlines, not a pass or fail grade.

Four vendor guides retrieved on 21 October 2026 describe essentially the same skeleton. Netwrix lists nine steps, miniOrange eight and C1.ai seven; all three begin with scope and inventory and end with continuous monitoring. Lumos frames the same work as an audit with seven steps. Every one of those publishers sells identity products, so treat their framing as vendor perspective and use the shared skeleton, which is sound, rather than any single product pitch.

What the vendor guides rarely say is where the first real finding comes from. In a SailPoint IdentityIQ (IIQ) implementation, the first aggregation of an application typically surfaces uncorrelated accounts: accounts that cannot be matched to any identity. Those are your orphan-account candidates, and they are usually the first evidence in the assessment. We explain the matching logic in our guide to what correlation means in SailPoint IIQ.

How Do You Run an IAM Risk Assessment, Step by Step?

Run an IAM risk assessment in seven steps: set the scope, inventory every identity, test controls against a checklist, score each gap by likelihood and impact, assign owners and deadlines, fix the highest risks first, and schedule the reassessment. The inventory decides whether everything after it can be trusted.

1. Set scope and objectives: name the systems, business units and identity types in scope, and the regulation or audit finding driving the exercise.
2. Inventory identities and access: export accounts, entitlements and last-login dates from each in-scope system, and map them to an owner and an authoritative source such as the HR system.
3. Test controls against the checklist: work through the nine areas in the next section and record the evidence for each answer.
4. Score each gap: rate likelihood and impact, multiply them, and rank the results (see the scoring section).
5. Assign owners and deadlines: every finding gets a named owner, a target date and a way to prove it is closed.
6. Remediate in priority order: remove orphaned and excess access first, then strengthen authentication and privileged controls.
7. Schedule reassessment and monitoring: agree the repeat date and the few metrics you will watch between assessments.

Step 2 is where most assessments succeed or fail. If the account export cannot be reconciled to an HR record or a named owner, the later scores rest on guesses. This is also why identity governance work usually begins with application onboarding and data quality rather than with reviews.

What Belongs on an IAM Risk Assessment Checklist?

A practical IAM risk assessment checklist covers nine areas: identity inventory, joiner-mover-leaver, authentication strength, privileged access, least privilege, segregation of duties, access reviews, non-human and third-party identities, and logging. Each area needs one question you can answer with evidence rather than opinion.

Checklist synthesised by IAM Careers from the Netwrix, C1.ai, miniOrange and Lumos guides (all retrieved 21 October 2026), and the least-privilege principle in NIST SP 800-53 control AC-6 as summarised by UpGuard. The ordering and wording are our own.

Two cautions from practice. First, an access review that completes with zero revocations is a finding, not a pass: Lumos's audit guide makes the same point when it tells assessors to check whether certifications actually changed access. Second, least privilege is a direction, not a state. NIST AC-6 asks that users and processes receive only the minimum access their tasks require, so the checklist question is whether excess access is found and removed on a schedule. Roles and policies are covered in our guides to IIQ role management and segregation-of-duties policies in IIQ.

How Do You Score and Prioritise IAM Risks?

Score each IAM finding on a three-point scale for likelihood and a three-point scale for impact, then multiply the two to rank it. A dormant administrator account on a payments system outranks an unused guest account on a wiki. Keep the scale simple enough that two assessors reach the same score.

Scores above are illustrative and set by IAM Careers; adjust them to your own risk appetite. The days, weeks and long-term grouping follows the remediation timeframes described in the C1.ai guide (retrieved 21 October 2026).

The timeframe column matters more than the number. C1.ai's guide groups remediation into days (revoke orphaned accounts, remove unneeded administrator rights), weeks (move towards role-based access, resolve segregation-of-duties conflicts, narrow over-permissioned service accounts) and a longer horizon (just-in-time access, governance for non-human identities). A score that does not change what happens this week has not done its job.

What Is the Difference Between an IAM Risk Assessment and an IAM Audit?

An IAM risk assessment asks which access problems could hurt the organisation and how badly, while an IAM audit asks whether defined controls operated and can be proven with evidence. The assessment ranks risk and feeds the plan; the audit tests against a policy or regulation. Most programmes need both, at different rhythms.

miniOrange's guide includes a section comparing the two, and Lumos argues that a quarterly point-in-time audit goes stale because access keeps changing after the snapshot; it recommends continuous auditing that reviews only changed access. Both views are reasonable. A practical pattern is an annual assessment that sets priorities, plus continuous monitoring of the few metrics that show whether those priorities are being met. Suitable metrics are listed in our IAM strategy guide.

Which Identities Do IAM Risk Assessments Usually Miss?

The identities most often missed are service accounts, API keys, bots and third-party users, because they sit outside HR-driven processes. The 2025 Verizon Data Breach Investigations Report found that credential abuse was the top initial access vector at 22% of breaches and that third-party involvement doubled from 15% to 30%.

Aembit's summary of the 2025 Verizon report adds further figures worth putting in front of a steering committee: infostealer logs held company credentials from 30% of corporate-managed devices and 46% of unmanaged devices, and 54% of ransomware victims had prior credential exposure in infostealer logs. It also cites IBM data that breaches starting with stolen credentials averaged $4.67 million and took 246 days to identify and contain, and GitGuardian data that 64% of valid secrets exposed in 2022 were still active in 2026.

Figures from the 2025 Verizon Data Breach Investigations Report, IBM and GitGuardian as summarised by Aembit (retrieved 21 October 2026). Aembit is a vendor of non-human identity products; check the primary reports before quoting these externally.

The practical response is plain. Give every service account, API key and bot an accountable owner and an expiry date, include them in access reviews, and treat vendor accounts as a separate population with their own lifecycle. For contractors and vendors specifically, see our explainer on SailPoint NERM and non-employee risk.

How Often Should You Repeat an IAM Risk Assessment?

Run a full IAM risk assessment at least once a year, and again after a merger, a major platform change, a breach or a new regulation, while reviewing high-risk areas such as privileged access more often. This interval is a practitioner recommendation, not a mandated one, so check what your own regulator expects.

Between full assessments, watch a short list of leading indicators: time to remove a leaver's access, the count of accounts with no owner, the share of privileged accounts with a current justification, and the revocation rate in access reviews. If any of these moves the wrong way for two cycles running, bring the assessment forward rather than waiting for the calendar. The earlier you catch drift, the cheaper the fix.

How Does an IGA Platform Such as SailPoint IIQ Help?

An identity governance and administration (IGA) platform such as SailPoint IdentityIQ (IIQ) turns several checklist items from manual evidence gathering into configured controls: lifecycle events handle joiners, movers and leavers, policies detect segregation-of-duties conflicts, and access certifications record reviews. It supports the assessment but does not replace it.

An IGA platform covers only part of the checklist. Multi-factor authentication, credential vaulting and log monitoring usually live in access management, privileged access management and security monitoring tools, which is why our comparison of IAM, IGA and PAM matters when you scope the assessment. If you want to learn the governance side hands-on, the live online SailPoint IIQ training program teaches these modules through guided hands-on practice, and the full 15-module IIQ curriculum lists every topic. Deeper guides: lifecycle events explained and the access certification guide.

Which Indian Rules Make an IAM Risk Assessment Necessary?

In India, banks, non-banking finance companies and other entities regulated by the Reserve Bank of India fall under its Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, issued on 7 November 2023. A documented identity and access risk assessment is one practical way to show that IT risk is governed.

A law-firm summary of the Direction (Mondaq, retrieved 21 October 2026) says it applies to banking companies, NBFCs, credit information companies, EXIM Bank, NABARD, the National Housing Bank and SIDBI, with foreign bank branches covered on a comply-or-explain basis and certain smaller categories excluded. That summary does not detail access-control requirements, so read the full Direction on the RBI website for the exact wording before citing it in an assessment report. This post is not legal advice.

Many global capability centres in Hyderabad and Bangalore also answer to their parent company's controls, which for US-linked firms often means SOX-driven access reviews and for UK-linked firms means UK GDPR security duties and FCA or PRA expectations. NIST SP 800-53 is widely used as a control catalogue, and its AC-6 control is the reference point for least privilege. Salary and hiring detail for these employers is in our IAM jobs in 2026 guide.

Who Should Run the Assessment, and What Careers Does It Create?

An IAM risk assessment is usually led by the identity or security team together with application owners, HR, internal audit and compliance, because no single group sees every identity source. Independent challenge from risk or audit keeps the scores honest. The work leads towards IAM analyst, governance and IGA consultant roles.

If you are moving into this work, the assessment is a good first project because it touches every part of identity governance: data quality, lifecycle, reviews and policy. Roles that run or support it include IAM analyst, access governance analyst, IGA engineer and IAM consultant. Our IAM career paths page maps the progression, and the IAM career roadmap 2026 guide shows how adjacent IT backgrounds transfer. This post does not state salary figures; for sourced, dated ranges see our regional salary guides.