A focused course, tailored for you
Access Governance That Closes Audit Findings for Good
A practical IAM course for senior managers who are tired of the same access-certification gap appearing in every audit cycle.
The certification campaign ran. The attestations were signed. Three months later the auditors flagged the same finding. The problem is not the tool — it is the governance design underneath it.
$199 one-time
Tailored to your situation. Access within 24 hours. 30-day money-back.
Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.
Why this course
Senior IAM managers at regulated financial institutions run access certification campaigns on schedule and still carry the same finding into the next audit cycle. The root cause is structural: role definitions are too broad for attestation to be meaningful, certification workflows optimise for completion rate rather than actual review, and privileged access exceptions accumulate between campaigns. Regulators like APRA (CPS 234) and external auditors want evidence of genuine access review, not a completion percentage. When the same finding recurs, it signals a governance design problem that a tool upgrade cannot fix.
The 12 modules
Module 1. Why Certification Campaigns Produce Rubber Stamps
Examines the structural reasons certification campaigns generate high completion rates but weak access decisions. Covers the specific conditions under which managers click approve without reviewing: role definitions too broad to interrogate, campaign windows too short for genuine review, and no accountability mechanism when approval is challenged in the next audit. Introduces the governance redesign framing that underpins the rest of the course.
Module 2. Role Mining for Defensible RBAC
Practical methodology for analysing actual access usage data to produce role definitions narrow enough for a certifier to make a genuine yes/no decision. Covers how to segment application access by functional area, how to identify toxic combinations that must never coexist, and how to document role intent so that the certification event is an evaluation of a specific access grant against a specific business need rather than a bulk approval of a named role.
Module 3. Certification Workflow Design for Financial Services Regulators
Builds certification workflows that satisfy APRA CPS 234 paragraph 53 (ongoing access reviews for critical assets) and ISO 27001 control A.9.2.5 (review of user access rights). Covers campaign scoping by asset criticality, escalation paths when certifiers do not respond, and the decision-logging requirements that allow an auditor to trace each access decision back to an individual certifier on a specific date with a specific justification.
Module 4. Privileged Access Controls That Satisfy External Audit
Covers the PAM evidence package required to close a privileged access finding in an APRA-regulated institution. Includes the artefact set: PAM inventory tied to asset register, session recording policy, emergency access procedure with dual-authorisation record, and privileged account certification separate from the standard user campaign. Explains how to present this package to auditors so the finding is closed rather than carried forward as a management action.
Module 5. Joiner-Mover-Leaver: Eliminating Orphaned Access
Maps the HR trigger events that produce orphaned access and the process controls required at each transition. Covers provisioning SLA that satisfies timely access grant requirements, transfer workflow that revokes previous-role entitlements before granting new ones, and leaver process with an audit-trail record of the revocation timestamp. Includes the quarterly reconciliation process that catches accounts that slipped through the JML workflow before auditors do.
Module 6. SailPoint and Saviynt Configuration for Governance Outcomes
Tool-agnostic governance principles applied specifically to SailPoint IdentityNow and Saviynt Enterprise Identity Cloud. Covers role object design that supports meaningful certification, campaign configuration that enforces accountability (no bulk approve, escalation to manager's manager after N days), and the reporting templates that produce the evidence artefacts an auditor expects rather than the platform's default completion-percentage report.
Module 7. CyberArk and PAM Platform Evidence Posture
Focused on extracting the audit-ready evidence set from CyberArk (or comparable PAM platforms) without relying on manual exports. Covers the vault account inventory report mapped to the critical-asset register, the session recording retention policy tied to the relevant regulatory retention requirement, and the administrative account certification cycle separate from standard user certification. Includes the integration point with the access governance programme so PAM and IGA campaigns are coordinated rather than siloed.
Module 8. Access Governance for Cloud and SaaS Entitlements
Extends the governance programme to cover AWS IAM roles, Azure AD groups, and SaaS application entitlements that sit outside the IGA platform's native connectors. Covers shadow entitlement discovery, the minimum-viable connector approach for bring-in-scope applications, and the interim manual certification process for applications that cannot be connected within the current audit cycle. Addresses the specific finding type: cloud entitlements not covered by the certification scope.
Module 9. Building the Audit Evidence Package
Constructs the full evidence set for an access governance audit from the component artefacts built in earlier modules. Covers the access governance policy document (what the programme commits to), the certification results report (who certified what and when), the exception log (elevated access approved with compensating control and expiry date), and the remediation-action register that maps each prior finding to its resolution. Explains how to present this set so the auditor can close findings rather than raise new ones.
Module 10. Recurring Findings: Root Cause and Permanent Fix
Addresses the specific failure mode of findings that recur across audit cycles. Uses the recurring finding as a diagnostic tool: what governance design weakness does it expose? Covers the five most common recurring IAM findings in regulated financial institutions (excessive privileged access, stale accounts, toxic combinations, incomplete JML coverage, certification without genuine review) and the specific governance design change required to close each one permanently rather than as a one-time remediation.
Module 11. Metrics, Reporting and Board-Level Visibility
Builds the governance metrics set that gives the CISO and board a genuine read on access risk rather than a programme-health dashboard. Covers the four metrics that matter to regulators (time to provision, time to revoke, certification completion with decision quality, PAM exception rate) and the reporting cadence that keeps the programme visible at the right level. Includes the one-page risk summary format that translates IAM posture into business risk language for non-technical stakeholders.
Module 12. The Implementation Playbook for Your Account Mix
Synthesises the course into a 90-day implementation sequence tailored to the specific constraints of a large regulated financial institution: existing IGA and PAM platforms already in production, certification campaigns already running, and audit cycle that cannot be paused. Covers the quick wins (campaign reconfiguration, JML reconciliation) that produce immediate audit-cycle improvements alongside the structural changes (role redesign, cloud entitlement coverage) that close recurring findings permanently.
How this addresses your situation
Specific modules that map to what you said you are dealing with.
Recurrent certification finding (same gap, third audit cycle): Modules 1, 3, 10
Privileged access PAM finding open for more than one cycle: Modules 4, 7, 9
Cloud entitlement scope gap flagged by external auditor: Modules 6, 8
Joiner-mover-leaver orphaned account finding: Module 5, plus Module 12 for sequencing
Who it is for
Senior managers in Identity and Access Management at large regulated financial institutions — banks, insurers, asset managers — who own access certification programmes, PAM controls, and the regulatory evidence posture. They manage platforms like SailPoint, Saviynt, or CyberArk and are accountable to internal audit and external regulators for access governance outcomes.
Who this is NOT for. IAM engineers focused on connector or platform configuration work. IT operations staff who administer but do not own governance outcomes. Organisations that do not face access-related regulatory obligations.
How it arrives
Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.
Time investment. 12 modules, each readable in 20-35 minutes. Total reading time approximately 5-7 hours. Templates and playbook are reference artefacts used over the following 90 days.
FAQ
Does this assume a specific IGA platform?
No. Modules 6 and 7 cover SailPoint, Saviynt, and CyberArk specifically, but the governance design in Modules 1-5 and 8-12 applies regardless of platform. If you use a different tool, the artefact templates are platform-agnostic.
Is this relevant outside Australia?
Yes. The regulatory references lean on APRA CPS 234 and ISO 27001 because those are the most common frameworks for financial services IAM in the Asia-Pacific region, but the governance design methodology applies to any regulated institution. Module 9 covers the evidence package structure that satisfies most major access-governance audit requirements.
What is the implementation playbook?
A hand-built document covering your specific situation: the platforms you are running, the audit cycle you are in, the findings currently open, and a sequenced 90-day plan that addresses quick wins first. It is produced within 24 hours of purchase and delivered to you directly.
