Access Risk is the potential for harm arising from an identity's access, including excessive privileges, policy violations, toxic combinations, orphaned accounts, inappropriate data exposure and misuse. Risk is usually evaluated using likelihood, business impact and contextual signals.
IGA uses access risk to prioritize approvals, reviews, controls and remediation. A score supports judgment; it should not replace a documented policy or accountable decision.