User access provisioning and reviews
How do we provision, change, remove and certify user access to bank systems with the manager's approval and the evidence kept for the exam?
Run access as one process across hire, move, exit and review. Callvu starts the case from the HR event or the review date, classifies the access the role allows in each system, routes the manager's and the system owner's approvals in the Decision Desk, sends the approved request to IT security or the provisioning tool, confirms the change, removes access on exit the same day, runs the periodic certification with each manager attesting to their people's access, and keeps the evidence for each user, system and date.
In scopeComplex: multi-party handoffsCallvu moves: classify, decide, write back
Last updated November 7, 2026.
The problem today
The terminated employee's core access was removed a month later, and the access review was a spreadsheet nobody signed.
A new hire needs access to the core, the loan system, online banking administration and email. The manager emails IT. IT grants what the last person in the role had. When the employee moves to another department, nothing is removed. When they leave, HR tells IT eventually. The quarterly access review is a spreadsheet sent to managers, half returned.
The FFIEC's information security expectations are specific: access based on least privilege and the role, approved by the right people, removed promptly on termination, and reviewed periodically with evidence. Examiners sample terminated employees against system access and ask for the review attestations. Segregation of duties conflicts (a person who can both originate and approve a wire) are a finding on their own.
The events are in the HR system; the access is in each application; the approvals are in email. The process is what connects them.
How it runs
From the requestto the system of record.
An HR event (hire, transfer, role change, leave, termination), a manager's request, or the certification date opens the case. Callvu reads the employee, the role and the manager from the HR system.
- Manager
- Approves the access for their people, requests exceptions with a reason, and certifies access at review.
- IT security
- Provisions, changes and removes access from the approved request, or oversees the provisioning tool that does.
- System owners
- Approve access to the systems they own where the policy requires, and confirm removals.
- Callvu
- Classifies the role's entitlements, routes approvals, drives provisioning and removal, runs certification and keeps the evidence.
Classify the access
The role and department map to the entitlement set per system (the role-based access model), and the request is classified: standard (inside the role's set), exception (beyond it, needing a reason and the system owner), or removal. Segregation of duties rules are tested against the combined access, and a conflict is flagged.
Decide
The manager approves the standard set, or the exception with its reason, in the Decision Desk; the system owner approves exceptions and conflicts where the policy requires; a conflict without a compensating control is declined by rule. Each approval is recorded with the person and the time.
Provision, change or remove
The approved request goes to IT security or the provisioning tool for each system; the change is confirmed back to the case, and the employee is told what they have. On a termination, removal across every system runs the same day from the HR event, with each system's confirmation recorded.
Certify on the cycle
On the review date, each manager receives the access of their people per system in the Decision Desk and certifies each as needed or marks it for removal; removals run from the certification. Segregation of duties conflicts and dormant accounts are listed for decision. The certification with each attestation is the evidence.
Write back
Every grant, change, removal and certification is written for each user, system and date to the access record, and the reports (terminations against removals, exceptions, conflicts, certification completion) are produced from it.
Where it ends: Every user's access matches an approved role or a recorded exception, terminations were removed the same day, and the certifications show each manager's attestation per person and system. The Decision Trace shows the classification, the conflicts and the approvals; the Audit Trace shows each event, approval, provisioning confirmation and certification.
Runtime enforcement
What is enforcedwhile the work runs.
The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.
The handoff
Between the front doorand the back office.
The front door
The HR system's events, a manager's request, or the certification date. Employees see what they have; managers act in the Decision Desk.
The back office
IT security provisions from approved requests and never from email; system owners approve exceptions; the evidence is produced, not assembled.
The Decision Desk
- The manager approves standard access and exceptions with reasons; the system owner approves exceptions and conflicts; at certification each manager attests per person and system, with removals as an outcome.
Proof
In scope.Proof at scale, not one process at a time.
The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.
Questions
What buyers ask next,answered plainly.
How fast is access removed when someone leaves?
The same day, across every system, from the HR termination event, with each system's confirmation on the record.
What about a person who can both originate and approve?
The combined access is tested against the bank's segregation of duties rules; a conflict is declined unless a compensating control is recorded by the system owner.
How is the access review done?
Each manager certifies their people's access per system in the Decision Desk on the cycle, and removals run from the certification. The attestations are the evidence.
Related processes
Bring this process, or the one that costs you most.
We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.