Contractor access stays open after a contract ends because the end date and the access are tracked in different places, and a person has to connect them. Reviews of contractor identity management by inspectors general at several agencies have turned up three kinds of gap: records that are wrong, removal that depends on one request, and cleanups that aren’t verified.
Key takeaways
- A 2024 Treasury Inspector General for Tax Administration review found that 10% of the contractors one federal agency listed as active were no longer on a contract.
- Access decisions inherit the errors in the list they are made from.
- A 2023 Department of Homeland Security Office of Inspector General review found that 84% of the separated-personnel accounts examined at one component were still active after the person’s last workday.
- Reminders and cleanups still depend on someone acting on them.
- Access with its own end date closes unless someone renews it.
What is contractor identity management in government?
Contractor identity management is how an agency creates, scopes, reviews and removes access for the people who work for it under contract. It covers a named sponsor, the scope of access, the end date, periodic review and removal, across badges, network accounts and application roles. NIST SP 800-53 includes aligning account management processes with personnel termination and transfer processes in its account management control, AC-2, which is the connection this article examines.
Contractor access sits inside a wider program for governing who holds access and why that also covers employees.
Why does contractor access outlive the contract?
Contractor access outlives the contract because the contract record and the access records are separate, and nothing forces them to match. The end date sits in a contract, task order or personnel record, while the access sits in the network, the applications and the badge system. A person is the only link between them, so access closes only when someone notices the contract has ended and acts on it.
The contract record exists to manage payment and performance, so its end date triggers invoicing and close-out rather than anything in an identity system. The access systems, in turn, only know that an account exists and was approved, which means neither side holds the fact that the other needs.
How does a contractor stay active after the work ends?
Two illustrative scenarios, which are examples rather than data, show how it happens. In the first, a task order winds down quietly: the deliverables are accepted, the invoices stop, and nobody files anything because there’s nothing left to approve. In the second, the contractor moves to a follow-on task order, and the access granted for the original scope stays in place even though the work it was granted for is finished.
What do the records show?
A Treasury Inspector General for Tax Administration (TIGTA) review published in September 2024 (report 2024-100-063) found that 1,821 of the 18,454 contractor employees listed as active at one federal agency in April 2023 were no longer assigned to an ongoing contract, which is 10% of the list. As of October 2023, 63 of those former contractors hadn’t returned their ID cards, and 13 of the 63 still had active network access.
Twelve of the 13 could reach systems holding taxpayer or personal data, and two more former contractors had network access without an ID card. The review couldn’t assess 299 of the 1,821 at all, so the real count may be higher.
The larger effect is that every access decision made from the list inherits its errors, because a sponsor certifying a roster, a system owner approving an account and a security team scoping a review are all working from names that include people who’ve left. Access that carries its own end date doesn’t depend on the list being right.
Why does removal depend on one person?
At the agencies these reviews covered, ending access started with a person submitting a request, so a missed step was invisible to the system. The contracting officer’s representative (COR) or a supervisor had to start the separation, have each application deactivated and collect the badge, all on top of a regular job. Nothing in the process noticed when one of those steps didn’t happen.
A process built this way works when the representative has time and fails without any signal when they don’t.
What happens when the step is missed?
The TIGTA review found that in 12 of the 20 contractor separations it reviewed, required steps were missing or only partly documented. The 20 were a judgmental sample, so the result can’t be projected across the agency.
Is this only a contractor problem?
It isn’t, and the mechanism looks similar for employees. A Department of Homeland Security Office of Inspector General review in 2023 (OIG-23-33) found that 84% of the separated-personnel accounts it examined at one component (159 of 190) were still active after the person’s last workday, because supervisors and system administrators hadn’t followed the procedure for disabling access. That figure covers separated personnel, not only contractors, and it shows what happens when removal depends on individuals following a procedure.
What did the follow-up find after the cleanup?
The follow-up found that a records cleanup didn’t prove the access was gone. In the TIGTA follow-up work, only 51% of the sampled former contractors had been listed as separated by January 2024, and two of the 13 with network access still had it in February 2024. The follow-up used a statistically valid random sample of 72 former contractors.
For the 299 the review couldn’t assess, the agency couldn’t identify the ID number needed to check their access. There was also no automated review to flag contractors marked active with no ongoing contract.
An illustrative case shows why a cleanup can look finished while access remains. A records effort closes with a memo and a green dashboard, while a former contractor’s network account, created under a different identifier from the one in the personnel record, keeps working.
How did the agency respond?
The agency itself pointed to the cause, describing an overreliance on manual input and the lack of an automated framework that covers contractor onboarding and offboarding end to end. Its response included email reminders to responsible staff at 30, 60 and 90 days before a contract ends, and planned automatic separation of contractor records 30 days after the end date, unless the contractor is active on another contract.
Both steps still route the removal through the COR. The reminders prompt the COR to act, and the automatic separation changes the record and then emails the COR a deadline to complete the separation actions. A changed record doesn’t show that the badge, the network account and the application roles were removed.
What does good look like?
Good looks like a change of default, from access that stays open until someone closes it to access that closes unless someone renews it. Four features make that change real:
- Access has its own end date matched to the contract, and it ends unless someone renews it on purpose, with explicit re-approval.
- Every contractor has a named internal sponsor and scoped access from the start, so someone is accountable for the account from the first day.
- An automated check flags anyone marked active without an active contract, so a wrong record is caught by the system and not by an audit.
- Removal leaves evidence, showing who ended the access, when, and what was removed.
This is identity governance and administration applied to contractors: the access, the sponsor and the end date are managed as one record, and the contract date is enforced where the access lives. Renewal becomes a deliberate act with a named person behind it, so inertia no longer keeps access alive.
How can an agency test its own process?
An agency can test its process with five questions, each of which should be answered by pointing to a system rather than to a procedure. The checks come straight from the gaps above.
| Check | Red flag | What to ask |
| Contract status and system access tracked separately | The end date lives in a contract or personnel record, and nothing links it to the accounts | What happens to this contractor’s access on the contract end date, and what triggers it? |
| Removal depends on someone submitting a request | A COR or supervisor has to start the separation and each application owner has to act | If nobody submits the request, what in the system notices? |
| Cleanup treated as proof of removal | A records cleanup closed without comparing the records to the actual accounts | After the last cleanup, how did you verify that access was gone, not only that records changed? |
| No reliable record of who has left | Some former contractors can’t be matched to an identifier, so their access can’t be checked | Can every former contractor be traced to an ID and to every account they hold? |
| No automated check for contractors marked active with no active contract | The check is a manual review, or doesn’t exist | What flags a contractor who is marked active but has no active contract? |
A red flag in any row means the control can’t yet be shown to work, and the answer should be a report from a system, not a description of a procedure.
How OpenIAM approaches contractor access
OpenIAM manages contractor and external identities with the end date built into the access itself. Every contractor has a named internal sponsor who receives access review requests and is responsible for certification. Access is time-bound with a hard expiry, and extensions need explicit re-approval.
Permissions are scoped to the engagement using role templates that apply least privilege from the start, and contractor populations can be loaded in bulk and synchronized with vendor management systems. One lifecycle model covers employees, contractors, partners and AI agents. Access reviews include an AI assistant for reviewers, detection of rubber-stamp approvals and plain-English entitlement descriptions, and an audit-ready decision log records each access decision, so each renewal leaves a record of who approved it.
Next step: See how access governance handles contractor access
Access Governance for Regulated Industries covers access reviews and includes a section on contractor and third-party access, with sponsors, time-bound access and deprovisioning, for teams ready to move from testing their process to evaluating a platform.
Frequently asked questions
Q1. What is contractor identity management?
A: Contractor identity management is how an agency creates, scopes, reviews and removes access for people who work for it under contract. It covers a named internal sponsor, the scope of access, an end date, periodic review and removal across badges, network accounts and applications, so that access ends when the engagement does.
Q2. Why does contractor access stay active after a contract ends?
A: Contractor access stays active because the contract end date lives in a contract or personnel record while the access lives in the network, applications and badge system, and a person has to connect them. A 2024 Treasury Inspector General for Tax Administration review found that 10% of the contractors one agency listed as active were no longer on a contract.
Q3. How long should a contractor’s access last?
A: A contractor’s access should last no longer than the engagement it was granted for, with an end date matched to the contract and extended only through explicit re-approval by a named sponsor. Access that closes by default at that date doesn’t depend on someone remembering to remove it.
Q4. How can an agency find former contractors who still have access?
A: An agency can compare contract and personnel records against actual accounts, and run an automated check that flags anyone marked active without an active contract. Every former contractor also needs a traceable identifier, because a 2024 Treasury Inspector General for Tax Administration review found the agency couldn’t identify the ID number needed to check access for 299 of 1,821 former contractors.
Q5. What should an agency document when a contractor leaves?
A: An agency should document who ended the access, when it ended, and what was removed, covering the badge, the network account and each application. The evidence should show that access was actually removed, not only that the contract record was updated or a reminder was sent.