I agree "... recognize that Governance, Risk and Compliance for Identity is a journey."

It's a long time since identity and role were used in corporations except on paper and even that is a big maybe! The reason may be technical, on 70's, when it was hot and commonly(?) used, the role and identity management were centralized and much easier, then came the PC time, no central control of anything?

The journey always(?) started with HR because they were the keepers of roles and identities connected to those roles. Fortunately, because they were already handling sensitive information, it was an easy road to negotiate, they easily understood that there could be a need to control and manage other sensitive information and actions based on a role. Maybe it also made the rest of the road easier, HR can be a powerful companion on a trip but (usually) doesn't want to say how you drive so the implementation (driving) is easier without "the backseat driver". Some other departments / organizations are not always as easy, like IT itself or accounting or .. but HR on your side gives some weight. Risk and Compliance were like calling back from journey to your top management and lawyers checking that you are going to the right direction, telling that the roads have changed ahead or maybe telling that the journey have to go through certain places before it can continue.

The benefits were great, the roles could be managed, added, deleted, updated, merged, saved for future use, etc with identities same way managed, added, deleted, ... with "one" key stroke. Because the roles were bound to every action and information in IT, to configure a new, to delete an old, etc was most of the time just seconds and didn't always have to be real time, they could be planned a long time ahead because every role, identity and change could be timed. There was a log to see what, where, when and by whom was done, when anyone was allowed the access and to what, when the access rights were changed or deleted, etc. This made the IT (and other) planning and management so much easier, safer, economical, ... that I can't even describe it. (And changed my life back from 24x7 to (almost) normal working hours!)

Now, of course, once the road is mapped comes the question who controls and manages it - but politics in corporate life is another story in another time as interesting it can be..