Why are auditors described as "good advisers" for identity management rather than as opponents?

Because their audits look for compliance violations, weaknesses and risks with the purpose of avoiding and improving them; their findings are free, expert input on where the IAM must get better.

Audits often feel like an ordeal to be survived. But look at what auditors actually do:

• They search for compliance violations, weaknesses and risks: orphaned accounts of people who left long ago, excessive permissions, missing approvals, shared admin accounts, no regular access reviews.
• The purpose of the audit mandate is to avoid damage and to improve the organisation, not to punish.

Seen this way, auditors are good advisers for IDM: they bring an outside view, they know what regulators and standards expect, and their findings give the IAM team arguments. An audit finding such as "leavers keep access for weeks" is often exactly what convinces a sponsor to fund automated leaver processes.

The practical consequence: involve auditors early, ask which evidence they will want (access reviews, approval trails, logs) and design the IAM processes to produce it as a by-product, rather than scrambling before every audit.

Go deeper:

• Internal audit (Wikipedia) — internal audit as an assurance and advisory function meant to improve the organisation.