Skip to content

The CFO's Business Case For IAM


As the CFO, you are faced with the challenge of justifying technology purchases based on some combination of necessity, functionality, cost savings, benefits, and the overall ROI.

It is your job to see the big picture of how a technology impacts the business in all areas. You must determine how the technology creates business value. In order to do this, your conversations should be about the benefits or value that will result in purchasing a new technology, rather than the specific technology itself. Identity & Access Management (IAM) is a technology solution that impacts virtually every functional area of your company as well as your customers. It is a solution that makes a compelling business case with an almost immediate ROI. Let’s look at the typical areas of a company and how each of them might be impacted and benefitted by implementing IAM.

IT Support Costs

Your IT department is tasked with keeping your organization working. They maintain your infrastructure, provide technology support, and are tasked with keeping your company’s information safe and secure. IAM adds significant value and immediate cost savings to your IT department by reducing help desk support costs by 20% to 50% from day one. How does IAM accomplish this? Once the implementation of an IAM solution is complete, the volume of help desk calls stemming from login and password issues drops dramatically. According to Gartner, the number is between 20% and 50% less, with a recent report identifying calls for password resets and account lockouts to amount to 30% of total help desk calls. Forrester Research concurs: One recent study determined that 25% to 40% of help desk calls are related to password issues, and another estimated the number at 20% to 50%. Using the META Group’s average of 1.75 support calls per user per month, along with Gartner’s conservative estimate that 30% of all calls are for password-related incidents, your ROI will look something like this:

1,000 Employees × 1.75 Help Desk Calls per Month = $25.00 (Cost to Resolve 1 Call) × 1,750 calls = 30% Call Reduction (1,750 × 30%) = 525 Less Calls × $25.00 = 1,750 calls $43,750/month $13,125/month in savings

Plug in your numbers to see how IAM will impact your IT support costs!

IT Process Streamlining and Productivity

One of the main functions of your IT department is managing users. They are tasked with adding new users, managing access for all applications, creating accounts in each application, removing access when an employee leaves, and protecting your company from unauthorized access. Without IAM, your IT department must manage these processes manually, which is extremely inefficient, time-consuming, and expensive.

IAM streamlines all of these processes without changing the way you currently operate. Once you add a new user to your company directory (LDAP), IAM can automatically provision new accounts in all the applications required in less than a minute. When it is time to remove a user, access to all applications can be terminated in less than 30 seconds. Add the significantly increased security that IAM brings, and your IT department saves hundreds of man-hours.

Increased Security

As the CFO, you may not consider network security as a primary job function. But the fact is that network security is one of the most important aspects of your position. In 2014, the average annual cost of a successful cyber-attack increased to $20.8 million in financial services, $14.5 million in the technology sector, and $12.7 million in the communications industry. Approximately 76% of those network breaches were the result of compromised user credentials!

IAM protects the weakest and most targeted area of your IT security by significantly reducing the risk of compromised user credentials. No firewall in the world can protect your company if the hacker has the proper credentials. IAM acts as the first line of defense in your company’s security strategy. Mitigating your company’s risks has far-reaching effects on your company’s bottom line. As you can see, a proactive approach can protect your company from the catastrophic cost of a network breach. Additionally, a network breach damages your company’s reputation and may lead to the loss of customers and partners due to diminished confidence in your ability to protect critical information. This is the situation that Target found itself in when over 70 million records were compromised, resulting in a potential liability estimated at $3.6 billion.

Another example is JPMorgan Chase. While most of the JPMorgan Chase servers were outfitted with 2-Factor Authentication, a single server was overlooked and hackers were able to break into it and compromise 76 million records. Servers with 2-Factor Authentication were not breached.

The external benefits of IAM are evident, as illustrated above, but there are also significant security benefits that can be gained internally. By reducing the number of passwords to one with Single Sign-On (SSO), your IT department can enforce more secure password policies and eliminate password fatigue. Users who are forced to memorize multiple passwords often dismiss and avoid approved security practices by resisting the use of strong passwords, using simple patterns that can expose a group of passwords if one is compromised, or reusing the same password for multiple accounts. Users might also just write their passwords down on a sticky note or an Excel spreadsheet, committing a security infraction of the first order. Many people keep their passwords and user IDs on their phones, meaning that if the phone is lost, your network is compromised.

Increased Productivity

A productive workforce is the result of both efficient operations and high utilization of labor resources. Neither of these objectives are achieved when users are forced to continually enter and reenter login IDs and passwords.

By centralizing access to all your business applications, not only will they be more secure, but access will be easier and more efficient. Gone are the days of remembering 10 or more passwords and having to change them every 60–90 days. Single Sign-On has been proven to significantly increase user satisfaction and productivity. While these effects might seem trivial at first glance, their impact can be significant when considered across an entire organization over an extended period of time. Redundant entry of login credentials can easily consume a minute or two per employee per day, even without login problems. Over the course of a year, this equates to more than one lost day per employee. Potential gains from SSO are far greater when the estimated average of 20 minutes of productivity loss per incident is caused by actual password problems.

The real question, then, is not one of “need,” but of cost and benefit. The cost of SSO implementation is increasingly more affordable, and the Authen2cate IAM solution adapts to the way your company operates.

So, does your organization need IAM? The answer is very likely a resounding, “Yes!” Can your organization afford IAM? Again, “Yes!” IAM from Authen2cate has very low startup costs, and the “pay-as-you-go” model makes it easy to work into your operating budget. Be sure to choose a full-service solution, where virtually no customer resources are required to implement the solution. In addition, full-services means there are no additional costs for ongoing support; everything is included in a low monthly fee. Once all of the advantages are considered, the business case becomes very compelling with very little risk. But one thing is certain: If your organization has any interest in increased productivity, enhanced security, and reduction of support costs, a serious evaluation of IAM solutions is absolutely essential.