The Client & Programme Background
The client, a leading global specialist insurance institution, was experiencing persistent deficiencies in Identity Access Management (IAM) controls. Repeat audit findings had labelled IAM as ‘critical’, exposing the organisation to regulatory and reputational risks.
There were highly manual, fragmented processes across access requests, movers, leavers and recertification, limiting scalability and control assurance. The absence of a centralised view of user access led to accumulation of inappropriate access and weak ability to respond to insider threats.
The client’s technology and delivery landscape was fragmented, particularly across privileged access management, with duplicated systems and inconsistent controls.
Approach & Solution
ECMS was engaged to:
- Re-establish a baseline for the IAM/IGA programme following loss of momentum and unclear scope, cost and benefit definitions
- Provide a clear, evidence-based view of current maturity, risks and gaps to support decision making and prioritisation
- Define a coherent vision, scope and roadmap aligned to evolving business strategy, technology direction and regulatory requirements
- Support tooling and investment decisions (IGA and PAM), including evaluation of options and long-term suitability
- Manage the execution of the project from re-baseline to closure
In order to strengthen and streamline controls, we:
- Conducted a comprehensive current state assessment
- Performed discovery across corporate IAM, PAM and programme delivery
- Performed benchmarking and gap analysis
- Benchmarked and analysed gaps against industry frameworks (ISO, NIST, ECMS proprietary) and defined maturity across people, process and technology
- Developed a structured capability and maturity assessment
- Identified strengths, weaknesses and priority risk areas for remediation
- Designed a comprehensive roadmap
- Produced a future-state vision and design principles for IGA, including improved user experience, governance and automation
“ECMS delivered a defined, coherent vision, aligning scope and roadmaps to business strategy, technological direction and regulatory requirements while helping to establish future-ready controls.”
Key Outcomes
The client has reduced regulatory and operational risk, achieving stronger, automated identity controls and improved user experience. In overseeing outcomes, ECMS:
- Delivered a validated, evidence-based view of current IAM maturity, risks and control gaps to inform executive decisions and address a complex, legacy landscape, with 28+ systems, multiple access routes and duplicated identity processes
- Established clear prioritisation of initiatives, focusing on high-risk, high-value areas such as PAM and core IGA capabilities
- Defined a target IGA vision, including automated lifecycle processes (joiner, mover, leaver, recertification) and improved governance
- Enabled development of a structured roadmap and delivery plan aligned to 2026 priorities and beyond
- Reduced regulatory and operational risk through stronger, automated identity controls and closed-loop assurance
- Improved user experience, with simpler, role-based access requests and streamlined lifecycle processes, delivering greater efficiency and cost optimisation
- Established future-ready identity capability, including automated recertification and better licence management
The overall programme enabled the client to form an evidence-based view of current identity access management maturity and reduce regulatory and operational risk, achieving stronger, future-ready automated identity controls with improved user experience.
Delivered an evidence-based view of current identity access management maturity
Prioritised high-risk, high-value initiatives such as privileged access management
Streamlined lifecycle processes, delivering greater efficiency and cost optimisation