OpenText NetIQ Identity Governance is the access-review and SOD-enforcement product inside the OpenText IAM line, designed for SOX-aligned and regulated identity programs that require recurring entitlement attestation, audit-ready reporting, and segregation-of-duties analysis. The product reads from identity stores (NetIQ Identity Manager, AD, LDAP, HR systems), runs scheduled access-review cycles, and surfaces SOD violations across the entitlement landscape.
Access reviews are the load-bearing capability for SOX programs. Public companies subject to SOX section 404 controls run quarterly or annual access reviews on financially material applications, and auditors expect documented evidence that managers attested to direct reports' access. Identity Governance handles the review cadence, the manager workflow, the rejection-and-remediation loop, and the audit-evidence packaging. Programs running ad-hoc spreadsheet-based reviews struggle to scale and routinely fail audit on documentation gaps.
SOD enforcement is the second capability that pays back on regulated programs. Toxic combinations of access (employee can both create vendors and approve payments, employee can both modify code and deploy to production) need to be identified and either blocked or compensated by review. NetIQ has been doing SOD across SAP, Oracle EBS, and PeopleSoft for two decades; the rule library covers the patterns regulated finance and HR programs face. Programs running SOD enforcement get the catch; programs without it find out about toxic combinations during audit or after fraud incidents.
Identity Governance programs usually stall on data quality rather than on the product, because access reviews inherit every flaw in the entitlement data that feeds them. Programs with stale provisioning (terminated employees retaining access), shared service accounts, and unmanaged contractor entitlements generate access reviews that look chaotic regardless of actual risk. The right pattern is to fix identity hygiene first (NetIQ Identity Manager) and then layer Identity Governance on top. Merito's engagement scopes both.
Ideal use cases
- Quarterly and annual access-review cycles for SOX-aligned programs
- Segregation-of-duties enforcement across SAP, Oracle EBS, PeopleSoft, and other regulated apps
- Audit-ready entitlement reporting and access-attestation evidence
- NetIQ Identity Governance modernization
- Identity governance integrated with NetIQ Identity Manager provisioning