The Operational Effectiveness or Cost Savings Driven Business Case
This type of business case is arguably the hardest business case to make for an IAM program. Every IAM vendor will have an elaborate model that will determine the cost savings an organization can achieve by using their product. The models are typically based on factors like the number of users, the number of applications, the number of people working on IAM processes, and the number of help desk calls made to change passwords. The cost savings numbers and operational efficiencies saved seem compelling until the CFO asks the question: “How much in IT operational staff costs will we be able to cut next year?” Translated: How many positions will we be able to cut from our current IT operational work force? That question is invariably followed by a long pause and usually an incomplete answer, because it is very difficult to say with confidence that an investment in IAM will result in any meaningful reduction in staff or even hard dollar savings. This is because—for most of the activity an IAM program is designed to implement—the organization either has not been doing prior to the program or it has not been doing in an acceptable manner and therefore those functions have not been using the staff resources they should have been using. What usually happens, if the IAM program is successful, is the existing staff becomes more productive, processes and controls are more effective, and users gain access and therefore can become productive themselves sooner making the business more productive. A successful IAM program rarely results in any meaningful hard dollar return on investment (ROI) in terms of cost savings or salary saved.

That is not to say that potential efficiency gains are not valid and cannot be used in a business case. IAM programs do result in IT operational efficiencies and have the potential long-term cost savings and operational improvements, but they are rarely significant enough, timely enough, or quantifiable enough to justify the costs of the entire IAM program. Hard dollar operational efficiency gains and cost savings can be used as supporting evidence in your compelling business case and not the main theme.

(Osmanoglu, 2013, p. 6-7)

Data security, regulatory compliance, competitive advantage, productivity benefits and reduced overhead are some of the goals that can be targeted during the road map phase.

(Ravindran, 2013, p. 2)

3.3.1 Why Do Organisations Introduce EIdM?

EIdM projects are no ends in themselves, as they are introduced to obtain a specific goal. Amongst a variety of driving factors and reasons for introducing EIdM into an organisation,¹⁷⁹ the following primary and secondary reasons taken from the interviews seem to be the most prevalent reasons being named by the experts¹⁸⁰:

• Primary goals:

◦ Compliance goals (constraint for organisations)

◦ Business-related goals (e.g., efficiency, automation of processes, general cost reduction, accounting for IT costs)

• Secondary goals:

◦ Risk management/IT security goals

◦ Enabler for new business opportunities

The presented primary and secondary goals are not mutually exclusive.¹⁸¹ Overlaps and synergies can for example occur in cases where organisations seek to comply with relevant laws by introducing a EIdMS. In the course of the introduction and the proceeding re-organisation of the organisational IT and related processes, better efficiency can be gained due to clean-ups and streamlining of process once being fragmented. Also other overlaps in goals can be achieved; however, these depend on the individual setting being analysed.

(Royer, 2013, p. 46-47)

The key business drivers that make identity management important are financial discipline, operational risk and compliance with legal and regulatory requirements.

(Small, 2004, p. 7)

In relation to identity management, this means organisations knowing who their customers are, what their customers want, and making it easier for customers to obtain the products and services that they want from them. When doing business on the Internet the number of customers can be so large that manual security administration processes cannot provide the service required at a realistic cost. By automation, for example through customer self-registration, it is possible to offload the costs to the business units or the customers. The cost of getting new customers is higher than that of retaining existing ones. So technologies that recognise individuals and their preferences are important by making it easier for customers to do business with your organisation rather than with your competitors.

Financial discipline also means managing operations more effectively, making employees more efficient and reducing administrative overheads. In a typical organisation, password and account lockout problems can represent a large proportion (often over 50%) of the help desk load. The need to individually sign-on to multiple applications wastes time. The costs and delays involved in providing access for new employees can be a significant problem in industries with high staff turnover (call centres and retail are good examples).

(Small, 2004, p. 8)