An IAM programme that has stalled, with the auditor watching.

The moment

It started as a clear project: one place where accounts are created and cleaned up, roles that determine who may access what, and an annual review in which managers check their own people. Two years later the tool is in place, three of the forty applications are integrated, nobody knows the difference between the roles anymore, and the auditor writes the same finding for the third time: employees who have left still have access, and administrator rights aren't reviewed. The project manager has left, the vendor points to the organisation, the organisation to the vendor. That's the moment an IAM specialist from outside, who has seen this before, gets the programme moving again.

Why IAM programmes stall

Rarely because of the tool. Usually because the organisation can't name the roles the tool is supposed to enforce, because application owners have no time to test integrations, because the source of truth for who works where isn't right, or because the project was set up as an IT project while three quarters of it is organisational work. A good IAM specialist therefore doesn't start with the tool but with the question of which access really has to be controlled, makes it small enough to finish, and gives the auditor within a few months evidence that last year's finding has been resolved.

What needs to happen now

1. The findings and the scope. What exactly the auditor found, which applications and rights really matter, and what can stay out of scope for now. The IAM specialist, in the first weeks.
2. The source in order. Joiners, movers and leavers from the HR system as the single truth, so accounts follow automatically. IAM engineer with HR and the administrators.
3. Roles that work. Not a hundred roles nobody understands, but a handful per department that you can explain and review. IAM specialist with the line managers.
4. Integrations in order of risk. First the applications with the most rights and the highest audit pressure, then the rest. IAM engineer.
5. The review that actually gets done. An access review managers can do in an hour and the auditor accepts, with evidence. Then handover to the operations organisation.

Who leads this

Organisations here look for an IAM specialist or IGA consultant who leads the programme and takes the organisation along, an IAM engineer who configures the tool and builds the integrations, and sometimes a security architect if identity is part of a bigger change, such as a cloud migration. The tool in place partly determines who fits; that's where the intake starts. If you need someone permanently, say an IAM administrator who stays after the project, that's simply permanent recruitment; for the programme itself it's interim. We've been doing both for years.

Interim: within two days, and what it costs

Fast doesn't mean sloppy. We start with a proper intake: which tool, where it's stuck, what the auditor found, who this person needs to bring along. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.

Freelance, and the Dutch DBA Act

Finishing an IAM programme is an assignment with a clear beginning and end: there's a result, the professional decides how the work gets done, and there's no employer-style line of authority. That is what the Dutch tax authority wants to see now that enforcement on false self-employment has resumed since 2025, so freelance fits well here, with a model agreement. The operations afterwards, the IAM administrator who maintains accounts and roles every day, is a job. Then we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.