Quick answer: An effective identity lifecycle process handles joiners, movers, leavers, contractors, and service accounts through approved triggers and removal evidence.
Why this problem persists
Access often persists because employment changes are not connected to ownership decisions. Joiner and leaver steps are often automated, but internal transfers rarely trigger a review of what the person no longer needs.
Pick a few people who changed roles recently and compare their current access with what their new role requires. Rights retained from a previous job are evidence of a missing mover trigger. Record which system should have sent the change, which application owner should have acted and where the approval should have been kept.
Worked example: Joiner, mover and leaver: the mover is often the hardest case
Illustrative scenario. A company automates account creation and termination, yet a project manager who transfers to finance retains administrator rights to a former application. The control failed at the role change rather than hiring or exit. Design lifecycle triggers around employment events and entitlements, with an explicit owner for each application.
| Event | Required authorization | Exception to test |
|---|---|---|
| Joiner | Role-based baseline + manager approval | Excess initial privileges |
| Mover | Remove old access and approve new | Accumulated old-role access |
| Leaver | Identity disable + app-level confirmation | Shadow/local accounts |
| Contractor end | Sponsor termination and access review | Access beyond contract date |
Measure latency from authoritative HR event to confirmed application action, but exclude time the event was not available to IT when assessing service performance. Separate human, non-human and emergency accounts. Require evidence of manager approval for role changes and retain an escalation channel for exceptions. NIST SP 800-53's access-control and identification families provide a reference for tailoring this control design.
A practical five-step method
1. Map onboarding, internal transfer, leave and departure events
Map HR hire, role change, approved leave, termination and contractor-expiry events, including the systems that receive each trigger.
2. Identify each system of record and triggering authority
Identify the authoritative event source and how identifiers map to tenant users, local accounts, SaaS groups and non-human identities.
3. Document approvers, role definitions and evidence capture
Tie each entitlement to an approved role or sponsor and preserve sign-off, fulfilment timestamp and exception evidence.
4. Design exception handling for urgent and nonstandard changes
Separate emergency privilege elevation from standard changes. Require expiry, monitoring and retrospective review of overrides.
5. Review separation-of-duties and periodic recertification checkpoints
Test a mover case and a leaver case end-to-end, including separation-of-duties conflicts and periodic entitlement certification.
What “done” should look like
For this problem, aim for a lifecycle workflow map, approval matrix and prioritized IAM gap register. It should show provenance, version, owner and outstanding exceptions. The sponsor needs to see what was decided, what was not decided and which actions remain. State the population, sampling method and limitations of any review. A scoped example is not a full assurance engagement.
A quick acceptance test
Ask someone outside the delivery team to locate the latest artifact, identify its accountable owner, explain the top unresolved issue and determine the next authorized action. If any answer depends on someone’s memory, the handoff is incomplete.
Common mistake to avoid
Assuming account disablement in one directory removes all SaaS and local application access. The remedy is not more paperwork for its own sake. Use the smallest set of artifacts that demonstrates scope, evidence, review and the next decision. Automate only after the underlying responsibilities and exceptions are clear.
Copy-ready working checklist
- Map onboarding, internal transfer, leave and departure events.
- Identify each system of record and triggering authority.
- Document approvers, role definitions and evidence capture.
- Design exception handling for urgent and nonstandard changes.
- Review separation-of-duties and periodic recertification checkpoints.
- Confirm who approves the final output and how corrections will be handled.
- Archive the approved version and record the next review or follow-up date.
Periodic SaaS access reviews then catch the accounts that lifecycle triggers miss, such as contractors and service identities.
How this connects to MeritSOLV
MeritSOLV currently lists the linked package as available for a scoped proposal, subject to triage and approval.
MeritSOLV’s Identity Lifecycle Blueprint provides a useful next reference for teams that want a defined output rather than an unbounded consulting engagement. Its model emphasizes a written scope, a named delivery lead, independent review and documented acceptance. The decision about what to implement, approve or accept remains with the customer.
For the broader set of options, review the MeritSOLV solution catalog and how the process works. Use a small, well-defined first engagement to validate whether the operating model fits your needs.
Frequently asked questions
What is joiner-mover-leaver?
A structured identity lifecycle covering new access, role changes and departures.
Does an IAM blueprint require admin access?
No. Workflow design can use approved documents and redacted examples.
Standards and further reading
Next step
Choose one real example, complete the checklist, and identify the evidence that would make a decision easier this week. Only after that should you decide whether an internal owner or a scoped external engagement is the right path.
These examples are illustrative, not reports of MeritSOLV™ client engagements. This guide is general operational information, not legal, audit, or certification advice. Review the cited standards and apply your organization's requirements.
