In order for access rights to have proper effect and value, access management must ensure that people can be properly identified: that each person has a unique identity to which their rights can be attached and to which activities, legitimate or otherwise, can be traced. Identity management is critical to effective access management, preventing, for example one person from pretending to be another and hijacking their rights to access and change information or, some would say even more importantly, to create new information. Organisations must take action to manage circumstance where access controls may be bypassed, for example where software developers require access to live systems during incident management.