Larger networks and interconnected systems in a geographically diverse environments resulted in IAM federated identity access models. This approach enables organizations to optimally pursue business automation goals and higher operational efficiencies and market penetration through aligning together their business models, IT policies, security and privacy goals and requirements. In other words, identity federation is referred to the set of business and technology agreements between multiple organizations to allow users to use the same identification data to access privileged information across many disparate network domains. Obviously, identity federation offers economic savings, security and privacy as well as convenience, to both enterprises and their network users.

(Al-Khouri, 2011, p. 463)

The Operational Effectiveness or Cost Savings Driven Business Case
This type of business case is arguably the hardest business case to make for an IAM program. Every IAM vendor will have an elaborate model that will determine the cost savings an organization can achieve by using their product. The models are typically based on factors like the number of users, the number of applications, the number of people working on IAM processes, and the number of help desk calls made to change passwords. The cost savings numbers and operational efficiencies saved seem compelling until the CFO asks the question: “How much in IT operational staff costs will we be able to cut next year?” Translated: How many positions will we be able to cut from our current IT operational work force? That question is invariably followed by a long pause and usually an incomplete answer, because it is very difficult to say with confidence that an investment in IAM will result in any meaningful reduction in staff or even hard dollar savings. This is because—for most of the activity an IAM program is designed to implement—the organization either has not been doing prior to the program or it has not been doing in an acceptable manner and therefore those functions have not been using the staff resources they should have been using. What usually happens, if the IAM program is successful, is the existing staff becomes more productive, processes and controls are more effective, and users gain access and therefore can become productive themselves sooner making the business more productive. A successful IAM program rarely results in any meaningful hard dollar return on investment (ROI) in terms of cost savings or salary saved.

That is not to say that potential efficiency gains are not valid and cannot be used in a business case. IAM programs do result in IT operational efficiencies and have the potential long-term cost savings and operational improvements, but they are rarely significant enough, timely enough, or quantifiable enough to justify the costs of the entire IAM program. Hard dollar operational efficiency gains and cost savings can be used as supporting evidence in your compelling business case and not the main theme.

(Osmanoglu, 2013, p. 6-7)

Data security, regulatory compliance, competitive advantage, productivity benefits and reduced overhead are some of the goals that can be targeted during the road map phase.

(Ravindran, 2013, p. 2)

3.3.1 Why Do Organisations Introduce EIdM?

EIdM projects are no ends in themselves, as they are introduced to obtain a specific goal. Amongst a variety of driving factors and reasons for introducing EIdM into an organisation,¹⁷⁹ the following primary and secondary reasons taken from the interviews seem to be the most prevalent reasons being named by the experts¹⁸⁰:

Primary goals:

◦ Compliance goals (constraint for organisations)

◦ Business-related goals (e.g., efficiency, automation of processes, general cost reduction, accounting for IT costs)

• Secondary goals:

◦ Risk management/IT security goals

◦ Enabler for new business opportunities

The presented primary and secondary goals are not mutually exclusive.¹⁸¹ Overlaps and synergies can for example occur in cases where organisations seek to comply with relevant laws by introducing a EIdMS. In the course of the introduction and the proceeding re-organisation of the organisational IT and related processes, better efficiency can be gained due to clean-ups and streamlining of process once being fragmented. Also other overlaps in goals can be achieved; however, these depend on the individual setting being analysed.

(Royer, 2013, p. 46-47)