IGA projects usually unfold along two closely linked paths: a governance track and a technical implementation track. Although distinct in focus, the two often overlap and reinforce each other as the project progresses.
Governance track
While it is not always the starting point, the governance track typically sets everything in motion (either completed by KPMG or the client). It begins with a deep dive into how identities and access are currently managed within the organization. Through discussions with key stakeholders across HR, IT, security, and business units, a clear picture of existing processes and their challenges is developed. Using structured maturity assessments and best‑practice benchmarks, the current approach is evaluated for its support of business needs. This often uncovers departmental inconsistencies, unclear process ownership, and controls that appear sound on paper but underperform in practice.
The findings from this assessment form the basis of a comprehensive report, outlining where things stand today and what needs to change. From here, organizations typically move into developing a Target Operating Model (TOM), which is the blueprint for how identity governance should function in the future. Defining this future state often requires thoughtful discussion, as topics such as responsibilities, approval flows, and the degree of centralization can involve multiple perspectives. Once a shared vision is established, the TOM becomes a solid foundation for selecting the right vendor.
Selecting the right vendor is a crucial moment on any IGA journey, and the process becomes far more effective when it is grounded in a clear TOM. With the TOM defined, future‑state requirements can be translated into a well‑structured Request for Proposal (RfP), enabling evaluation to focus not only on tool features but also on how each solution supports governance objectives. During selection, KPMG’s Digital Identity team can help refine requirements, interpret vendor responses, and ask targeted questions to find a true functional and technical fit, bringing context from assessments, stakeholder input, and process analysis. By approaching vendor selection as a guided, structured exercise rather than a purely technical comparison, organizations can make confident decisions and lay a strong foundation for the implementation work that follows.
Technical track
Once the right IGA tool has been selected, the technical track begins to take shape. This is the moment where strategy turns into something tangible, where the TOM and governance decisions start evolving into actual processes, integrations, and automated workflows.
The technical work never starts with software alone. Before a single configuration is made, technical teams sit together with system owners to map out what already exists. In many environments, legacy tooling or scripts have been running quietly for fifteen or twenty years, often undocumented and poorly understood. These “black boxes” need to be opened up, analyzed, and translated into something modern and maintainable. It is a discovery phase that regularly brings forgotten components back into the spotlight and forms the basis for the design decisions that follow.
Once the groundwork is laid, the actual setup of the IGA platform begins. A crucial first step is establishing a reliable connection with the organization’s HR systems: the single source of truth for who works where, in which role, and under which contractual conditions. This data stream drives the essential lifecycle processes: joiner, mover, and leaver events. A new employee might appear in the system two weeks before their first day, triggering a chain of automated tasks that prepare accounts, request equipment, notify managers, and ensure everything is ready when they walk in on day one. These flows must be carefully designed and tested so they reflect not only the technical logic of the tool but also the operational reality defined in the governance track.
As the core identity processes take shape, applications across the organization are onboarded into the new IGA environment. Each application requires two elements: a functional understanding of who needs access and why, and a technical connection that allows the IGA platform to manage those access rights. Sometimes an out-of-the-box connector exists; sometimes a custom integration or even a data export is the only viable option. Regardless of complexity, every application requires conversations with its owners to understand roles, permissions, and risks before it can be managed in a standardized way.
Because most organizations operate in hybrid environments, the technical track also includes setting up infrastructure components that bridge cloud and on-premises systems. Even a modern cloud-based IGA solution still relies on local virtual appliances to communicate securely with internal applications. Configuring these components is rarely a technical challenge in itself, but organizational procedures, such as firewall approvals, certificate management, and network restrictions, often mean this part of the project takes time and coordination.
All of these elements together make the technical track a meticulous process. It is detailed, iterative, and highly dependent on collaboration across teams. But it is also the phase where the tangible benefits of IGA become visible: automated provisioning replacing manual work, outdated scripts retired in favor of standardized workflows, and a unified identity model emerging across the entire landscape. When the technical and governance tracks finally converge, the organization gains not only a working platform, but an identity environment that is aligned, scalable, and built to last.
