The root of why it is so difficult to implement IAM is because systems are not designed in a way that changes, including creating user accounts, can be linked to the business decisions that originated them, IMHO...