A bank reviews who can do what across 15 applications
A bank needed a role and access review across 15 core applications. Ten checks on users, roles and job titles found segregation-of-duties conflicts, dormant access and roles that were near copies of each other.
From our own project and product work. Client names and identifying details are removed, and some figures are rounded.
The situation
A bank runs its operations on many enterprise applications, including customer relationship management, workflow and loan management. Access had grown application by application. The bank wanted to find segregation-of-duties conflicts and dormant accounts, and to standardise its roles, without changing the history of users already disabled or deleted.
What we looked at
- User lists and role matrices from the access team and the application owners
- Account status in the central directory
- Job titles and line managers
- Last-login dates
The checks
| Check | What it flags |
|---|---|
| Same access as the line manager | Access that does not reflect the role |
| Same title, different roles | Inconsistent provisioning |
| No use for more than 6 months | Dormant access to remove |
| Role does not fit the title | Access beyond the job |
| Maker in one application, checker in another | A conflict across systems |
| Maker and checker in one application, with no control at the time of use | A conflict within a system |
| Checker or approver rights inside a maker role | A flaw in the role itself |
| Active in the application, disabled in the directory | Leavers who still have access |
| Roles more than 90% alike | Candidates to merge |
| Managed-services users with create or update rights | Third-party access risk |
How we did it
We compared 523 roles against user entitlements and job titles with Power Query and Python matrix calculations. Disabled and deleted accounts were left as they were, to keep the record intact. Roles were renamed to one standard pattern to make future reviews simpler. Every finding was walked through with the business before it went in the report.
What happened
- 100% of active entitlements mapped, across 15 applications.
- 523 roles analysed, with near-duplicate roles flagged for consolidation.
- One deliverable per application, plus one consolidated file covering all 15.
- Dashboards that show the conflicts and the dormant accounts to clear first.
What changed
- One view across 15 applications. Conflicts that cross systems are visible for the first time.
- Repeatable. The same matrix runs again at the next review, not a new spreadsheet.
- Agreed with the business. Every finding was validated before it was reported.
Products and services
Our digital, cyber and IT risk team ran this work, and CompliBear can monitor access conflicts every day. See financial services.