Quiz Entry - updated: 2026.10.22
Which stakeholders have an audit or control function towards IAM, and what does each look at?
Auditors (statutory auditors, internal auditors) check compliance; employee representatives watch over employee interests, depending on national law; information and IT security looks at security; data protection looks at personal data.
| Stakeholder | Focus | Typical question to IAM |
|---|---|---|
| Auditors (Wirtschaftsprüfer, Revisoren, Auditoren) | Compliance mandate | Who had which access, who approved it, and were leavers removed in time? |
| Employee representatives (Arbeitnehmervertreter) | Co-determination rights, depending on national law | Can the system be used to monitor employees' behaviour or performance? |
| Information and IT security | Security | Is authentication strong enough, are privileged accounts protected, is least privilege enforced? |
| Data protection | Personal data | Which personal data does the IAM hold, for what purpose, how long, and who can see them? |
All four look at the IAM rather than using it. That makes them easy to forget in a project plan, and expensive to forget: each can stop a rollout. An IAM system stores and processes personal data about every employee and logs their activity, so it is squarely in the scope of data protection and, in many countries, of employee co-determination.
Go deeper:
Information technology audit (Wikipedia) — what IT auditors examine, including access controls.- Privacy by design (Wikipedia) — the data-protection principle an IAM design is measured against.