July 2026. Orphaned accounts and slow offboarding remain top ISO 27001 findings. Auditors follow one departure: HR event → IdP disable → SaaS revoke within agreed SLA.
Joiner-mover-leaver (JML)
- HR system as source of truth for start/end/role change;
- automation to IdP where possible — manual for exceptions;
- checklist per SaaS without SSO;
- periodic reconcile: active accounts vs HR list.
Metrics
Average offboarding time, orphaned accounts found in reconcile — report in management review. Target: critical apps within 24 hours, rest within 72 hours.
More: ISO 27001 SaaS, access reviews, ISMS. Service accounts: named owner + quarterly review.
Externals and freelancers: expiring access and line sponsor — no permanent guest accounts.
Reconcile and exception management
Monthly reconcile HR vs IdP vs critical SaaS — differences resolved or justified within 48 hours. Keep reconcile reports as audit evidence.
Exceptions (shared accounts, legacy apps): named owner, review date, compensating controls in risk register.
Mover events: role change triggers access review within 5 business days — do not wait for quarterly batch.
Next steps in your ISMS
Turn this article into one concrete action in your risk register or improvement plan: owner, deadline, expected evidence. Discuss progress in the next management review — auditors and chain partners want decisions, not policy intent alone. Link where possible to existing ISO 27001, NIS2 or GDPR documentation so you do not maintain parallel folders.
Questions on scope, certification or chain requirements? Use our readiness overview and knowledge base for deeper guidance. This article does not replace legal or audit advice for your situation.
Share relevant findings briefly with line management and procurement — compliance becomes workable when the whole organisation recognises the same priorities. Repeat the chosen action quarterly in team meetings and update evidence locations in your SoA or control plan so surveillance samples are easy to answer.