Audit findings about access rarely start with technology. They start with a moment: an employee transferred departments and kept the old access; a contractor's engagement ended but their account didn't; a new hire waited two weeks for system access and the team 'solved' it with a shared login.
These are lifecycle failures — joiner, mover, leaver — and they're endemic wherever the process is email-and-memory. The fix isn't discipline. It's removing the human relay from the loop.
What good looks like
In a mature JML setup, your HR system is the single source of truth. A new hire record triggers account creation, role-based access assignment and a welcome notification before day one. A transfer triggers simultaneous grant-and-revoke — the new role's access arrives as the old role's access leaves, which is the only reliable way to prevent privilege accumulation. A separation triggers immediate deprovisioning across every connected system, including the ones without APIs, where a ticketing-workflow integration ensures a human completes and documents the removal.
Approval workflows handle the exceptions — access outside the standard role model — so the fast path stays fast and the unusual path stays governed.
Where to start
Start with leavers: it's the highest-risk transition and the easiest to automate because the trigger (HR separation) is unambiguous. Then movers, which quietly generate most SoD violations. Joiners last — they're a productivity win more than a risk win.
Measure three numbers before and after: time-to-productive-access for joiners, residual-access count for movers (entitlements from previous roles), and time-to-full-deprovisioning for leavers. Those three metrics tell the whole story to any board or auditor.