User access-related business risk comprises a broad array of potentially damaging events that may be caused or made possible by inadequate governance of access to an enterprise’s information assets. Such events range from relatively minor policy and compliance violations to disastrous business losses.  The stakes involved in access-related risk have risen dramatically in recent years as organizations have become thoroughly operationalized by technology.

With nearly every facet of large enterprises’ operations now dependent on or supported by automated systems, risks related to unauthorized or inappropriate access can appear anywhere within an organization at any time and spread rapidly through the business. The potential cost to the business in terms of lost revenue and increased expense or in damage to customer relationships as well as the loss of corporate brand and reputation is virtually unlimited.

This paper discusses the consequences of unacceptable levels of risk and presents a model for managing access-related risk.