Description

A focused course, tailored for you

The Bank Security Administrator's Access Review Playbook

Run quarterly user access reviews that survive the regulator without burning your weekends on spreadsheet evidence.

Your quarterly user access review keeps producing the same three audit findings, and the evidence pack you assemble at the end of every cycle takes two weekends you do not have.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Bank security administrators sit between identity governance tooling, the joiner-mover-leaver feed from HR, the application owners who certify entitlements, and second-line compliance who tests the work. When any of those four breaks, the user access review becomes a manual reconciliation exercise on spreadsheets, with approvers rubber-stamping certifications because they do not understand what they are approving. The OCC, the FRB, and internal audit all read the same evidence pack and ask the same questions: who approved this, on what basis, with what segregation-of-duties check, and how do you know the access was actually revoked when the role changed. Without a documented sampling plan, an entitlement-to-role mapping, an approver-attestation log, and an exception register, the answer is always weaker than it should be. The course is built to give you those four artefacts as your own, sized for a bank with SailPoint or Saviynt as the IGA tool, CyberArk for privileged access, AD as the directory, and a mix of mainframe and cloud applications behind it.

What you walk away with

Build an entitlement-to-role mapping document that maps every privileged entitlement to a defined business role with a documented owner.
Run a defensible sampling plan for quarterly certifications that the second-line testing team accepts on first review.
Maintain an approver-attestation log that survives a regulator request for the basis of every certification decision.
Operate a segregation-of-duties exception register that flags toxic combinations before they reach the approver queue.
Cut the post-review evidence assembly from a two-weekend exercise to a half-day pull from the artefacts you already maintain.

The 12 modules

Module 1. Mapping the access review universe

Walks through identifying every application, system, and entitlement that falls inside the quarterly review scope at a bank. Covers the difference between in-scope and out-of-scope by regulatory driver, the joiner-mover-leaver feed structure, and the source-of-truth question for application owner identity. Includes a worked example of building the scope matrix and reconciling it against the previous cycle's findings register.

Module 2. Entitlement-to-role mapping as a living document

Teaches building and maintaining the canonical entitlement-to-role mapping for a bank-grade environment with SailPoint or Saviynt. Covers the role taxonomy decision, how to handle composite roles, how to document business justification per role, and the change-control process that keeps the document current. Includes the worked-example template for a wholesale banking line of business with mainframe and cloud entitlements.

Module 3. The certification sampling plan that survives second-line review

Walks through writing a statistically defensible sampling plan for quarterly certifications. Covers the population definition, sampling rate calculation for high-risk versus standard entitlements, the documentation that needs to live with the plan, and the second-line and external auditor questions the plan needs to anticipate. Includes a comparison of three sampling approaches with the trade-offs explicit.

Module 4. Approver attestation that produces real evidence

Teaches structuring the approver workflow so that each certification decision produces a defensible attestation, not a rubber stamp. Covers the wording of the approver question, the supporting context the approver needs at the moment of decision, the escalation path for unsupported entitlements, and the attestation log structure that gets pulled during an audit. Includes the approver training script and the manager-review handoff.

Module 5. Segregation of duties for banking entitlements

Walks through identifying toxic combinations specific to a bank: wire initiator plus approver, trade booker plus settlement, loan officer plus credit-line adjuster, customer-account viewer plus payment initiator. Covers the SoD ruleset build inside SailPoint or Saviynt, the exception register that documents accepted residual risk, and the recertification cadence for accepted exceptions. Includes a worked SoD matrix for a regional bank.

Module 6. Privileged access reviews with CyberArk

Teaches the differentiated review process for privileged accounts versus standard user accounts. Covers the CyberArk safe-and-platform structure, the privileged session review evidence, the just-in-time access logging, and the dual-control requirement for break-glass accounts. Includes the privileged access certification script and the evidence pack structure the OCC expects to see.

Module 7. AD and directory hygiene as a control

Walks through the Active Directory cleanup that has to happen before a credible access review. Covers stale account identification, nested group resolution, service account inventory and ownership, and the orphan account remediation process. Includes the directory hygiene scorecard that gets reviewed at the security council and the evidence the auditor pulls.

Module 8. Joiner-mover-leaver feed integrity

Teaches reconciling the HR joiner-mover-leaver feed against actual access state. Covers the leaver lag problem, the mover-with-stale-entitlement problem, the contractor-end-date problem, and the reconciliation report the IAM team owns. Includes the SLA structure that ties the IAM team to HR data quality and the escalation path when the feed breaks.

Module 9. Application owner engagement that actually works

Walks through structuring the application owner relationship so that certifications are taken seriously. Covers the application owner onboarding pack, the per-application review briefing, the office-hours model for unfamiliar entitlements, and the escalation when an application owner refuses to engage. Includes the application owner scorecard reviewed quarterly by the CISO office.

Module 10. Evidence pack assembly for OCC and FRB exam

Teaches assembling the evidence pack the OCC and FRB ask for during the access management exam. Covers the entitlement-to-role mapping snapshot, the sampling plan and execution evidence, the approver attestation log, the SoD exception register, the privileged review evidence, and the remediation log for prior findings. Includes the cover memo structure that lets the examiner navigate the pack in one read.

Module 11. Continuous monitoring between quarterly reviews

Walks through the access posture monitoring that runs between formal quarterly cycles. Covers the daily SoD ruleset run, the new-entitlement alert flow, the privileged session anomaly review, and the management dashboard that surfaces drift before the next cycle starts. Includes the metric set the CISO presents to the audit committee and the escalation thresholds.

Module 12. Findings register, remediation, and cycle close

Teaches closing out a review cycle properly. Covers the findings register structure, the remediation owner assignment, the validation evidence that closes a finding, the carry-forward log for findings still open at next cycle start, and the lessons-learned conversation that improves the next cycle. Includes the cycle-close memo to the CISO and the audit committee briefing slide.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

If the OCC examiner asked for your sampling plan and you produced a paragraph instead of a document, modules 3 and 10 build the plan and the evidence pack the examiner expects.

If your approvers are rubber-stamping certifications because they do not understand the entitlements, modules 4 and 9 fix the approver workflow and the application owner relationship.

If your last cycle had a finding on segregation of duties, modules 5 and 11 build the SoD ruleset and the continuous monitoring that prevents the same finding next cycle.

If your evidence pack takes two weekends to assemble, modules 7, 8, and 12 fix the directory hygiene, the JML feed integrity, and the cycle-close process so the evidence is already assembled when the cycle ends.

What you get with this course

Twelve written modules covering the full quarterly access review lifecycle for a US bank environment.
Downloadable templates for the entitlement-to-role mapping, the sampling plan, the approver attestation log, the SoD exception register, and the OCC evidence pack cover memo.
Worked examples sized for a regional bank with SailPoint or Saviynt as the IGA tool, CyberArk for privileged access, and Active Directory as the directory.
A hand-built implementation playbook tailored to your specific tooling stack, delivered alongside course access.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Modules 1 through 4 cover the access review universe, entitlement-to-role mapping, sampling plan, and approver workflow, designed to be worked through in the first two weeks.

Modules 5 through 8 build the SoD ruleset, privileged access review, directory hygiene, and JML feed integrity, designed for weeks three through five.

Modules 9 through 12 cover application owner engagement, evidence pack assembly, continuous monitoring, and cycle close, designed for weeks six through eight, aligned to a quarterly review cycle.

Before and after

Before

Quarterly user access reviews produce the same three audit findings every cycle, approvers rubber-stamp certifications without context, evidence assembly takes two weekends of spreadsheet work, and the OCC examiner letter sits in your folder waiting for a real response.

After

The entitlement-to-role mapping, sampling plan, approver attestation log, and SoD exception register are living documents the team maintains. Cycle close produces the evidence pack as a pull rather than a build. Examiner letters get answered with documents, not promises.

What happens if you do not address this

Each cycle that ships with rubber-stamped approvals and spreadsheet-built evidence widens the gap between what the regulator expects and what the bank can produce. The next OCC or FRB exam finding is the lever that forces the work anyway, but under a remediation deadline and with the CISO office watching.

Who it is for

A bank security administrator running or contributing to the quarterly user access review program in a US regional or national bank. Sits inside the identity and access management team, reports up through information security, works daily with SailPoint or Saviynt, CyberArk, Active Directory, and the application owner community. Has lived through at least one regulator-driven access review finding and is tired of the spreadsheet reconciliation cycle.

Who this is NOT for. Not for general IT helpdesk staff, not for application developers who do not own access controls, not for compliance staff who only consume access review evidence rather than produce it.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly six to eight hours per module, scoped so a working security administrator can fit a module into a week without breaking the day job. Full course completes inside a quarterly review cycle.

Why $199 is the right number

Vendor training from SailPoint or Saviynt teaches the tool but does not teach the bank-specific evidence pack, the OCC and FRB examiner expectations, or the application owner relationship work. Big-four consulting engagements deliver a report and leave; this course leaves the artefacts as yours. Internal training programmes inside the bank cover policy but rarely produce the working templates.

FAQ

Do I need to be using SailPoint specifically?

The worked examples reference SailPoint and Saviynt because they dominate the regional and national bank market, but the artefacts and the process apply to any IGA tool. The implementation playbook is hand-built for your specific stack.

Is this aligned to the OCC and FRB exam expectations?

Yes. The evidence pack module is built around the documents these examiners pull, and the sampling plan module is written to anticipate the second-line and external auditor questions.

How is this different from a vendor certification?

Vendor certifications teach the tool. This course teaches the bank-specific control process, the evidence the regulator expects, and the artefacts that survive a real exam.

What does the implementation playbook include?

A version of every template in the course tuned to your specific tooling stack, your bank size, and the regulatory expectations for your charter. Hand-built after purchase, delivered alongside course access.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.