Identity governance produces a lot of metrics, and most of them get reported to whoever happens to be in the room, regardless of whether that number means anything to them. This is a framework for connecting governance activity to five specific outcomes, each with its own metrics and its own audience, so the same underlying data supports five different conversations instead of one generic one.
A governance metric only does its job when it reaches someone who can act on it, in language they can actually use. Mean Time to Revoke means something specific to a security team and almost nothing to a CFO. Assigned-but-unused license rate means something to finance and less to a board member scanning a maturity trend. The metrics themselves don't change. What changes is which lever they connect to, and who's on the other end of that connection.
The Five Levers
Each lever pulls from a different slice of the same underlying governance activity. None of them require separate tracking systems. The distinction is which metrics get surfaced to which audience, and in what frame.
Operational Efficiency: The IT Ops Case
This lever answers a question IT and IAM teams ask about their own workload: how much of the manual review burden is actually necessary versus just unclaimed automation.
- Request cycle time shows where decisions are getting stuck, and whether the delay sits with unclear policy or with a specific approver bottleneck.
- Auto-decision rate shows how much of that workload policy is already carrying, and whether that share is growing as approver logic gets codified.
- Workflow success rate shows whether the automation that is running can actually be trusted, or whether it's initiating work that quietly fails partway through.
Read together, these three answer the follow-up question every IAM team eventually faces: where automation should expand next, and where it should deliberately stop.
Risk Reduction: The Security Case
This is the lever most naturally aimed at a CISO or security leader, and it's built around exposure rather than activity.
- Orphaned accounts and Mean Time to Revoke describe how long a gap stays open before it gets closed.
- Revocation rate, read over time, shows whether the same entitlements keep getting flagged or whether upstream granting is actually getting tighter.
These are also the numbers behind the specific questions that come up in board and audit conversations, the ones a security leader should be able to answer without pulling an export first.
Compliance Assurance: The Audit Case
This lever exists to answer one recurring question: can you prove governance happened and produced an outcome, not just that a campaign ran.
- Campaign completion rate, per department, converts review execution into evidence an auditor can absorb at a glance.
- Exception aging shows every open deviation, how long it's been open, and who owns it, which is precisely the register auditors have learned to ask for.
Continuous evidence matters most here, because an exception that's been open and untracked for months is exactly the kind of gap an audit finds and a program should have caught first.
Productivity: The Business-Speed Case
Time to provision and time to revoke measure governance from the perspective of the people waiting on it: a new hire who needs access to do their job, a department head who needs a departing contractor's access closed out cleanly.
- Time to provision is the number HR and business leaders feel directly, since a joiner without access is a hire not yet productive.
- Time to revoke is the same workflow read from the leaver side, where it converges with the risk lever's exposure math.
This lever is easy to undercount because it rarely gets framed as a governance metric at all. There's also a financial version of this same argument, where unused licenses and audit-prep hours connect to the same underlying numbers.
Governance Maturity: The Board Case
This is the roll-up lever, and it's deliberately the smallest set of metrics on this list.
- Automation coverage trend answers whether the program scales with the company or needs proportionally more people every quarter.
- Governance scope growth answers whether oversight is keeping pace with how fast the estate is expanding.
- Certification coverage score answers whether governance is consistent across the company, and provable to an auditor.
Everything else on this page eventually feeds into this lever, but it shouldn't be presented at this altitude directly: a board slide with fourteen metrics gets the same reaction as one with zero.
Using the Framework
The practical value of this structure isn't the categorization itself, it's the discipline it forces: before reporting a metric to anyone, know which lever it belongs to and who's actually asking. A revocation rate presented to a board reads as noise. The same number presented to a security lead as part of a risk trend is exactly the evidence they need. Governance data doesn't change between those two moments. The frame around it does, and that frame is the difference between a number that gets acted on and one that gets skimmed past.
Frequently Asked Questions
Do all five levers apply to every organization equally? Not necessarily at the same intensity. A smaller company might not have a formal board reporting cadence, in which case the maturity lever matters less than efficiency and risk. The framework scales down as easily as it scales up, since it's organized around audiences, not company size.
Can one metric belong to more than one lever? Yes, and that's normal. Mean Time to Revoke is the clearest example: it's a risk-reduction metric on its own, and it also feeds directly into the productivity lever from the leaver side. The lever a metric gets reported under depends on which question is actually being asked.
Where do the underlying metric definitions live? The full set of governance metrics, including the ones referenced across all five levers here, is covered in how to measure an IGA program. This framework focuses on how to route those metrics to the right audience, not on defining them from scratch.
Is this framework specific to one identity governance platform? The five levers describe outcomes any governance program should be able to point to, regardless of tooling. What varies by platform is how easily the underlying metrics can actually be produced, which is a separate question covered in why disparate identity stacks can't measure themselves.
.svg)
