# How We Build a Joiner-Mover-Leaver Process That Passes SAMA CSF Domain 1 Control 1-3-1: From HR Trigger to 24-Hour Revocation Evidence
The Saudi Central Bank's Cyber Security Framework requires regulated institutions to provision and de-provision access in a timely manner. SAMA CSF Domain 1, Control 1-3-1, specifically addresses user access management throughout the employment lifecycle. Yet when SAMA examiners review joiner mover leaver SAMA CSF 1-3-1 access governance during an assessment, they consistently find the same gap: institutions have identity and access management systems, and they have HR processes, but the two operate in separate orbits. A resignation is recorded in the HR system on Monday; the Active Directory account remains active on Friday. A transfer to a new department is approved, but the employee retains access to the previous team's sensitive folders. The technical capability exists, but the workflow that connects HR events to identity lifecycle actions—and produces timestamped evidence of each step—does not.
This article describes how we build that workflow. Our Identity & Access Governance service strengthens how access is granted, reviewed and removed through structured joiner-mover-leaver processes, privileged access controls, segregation of duties and periodic access reviews. Over six to ten weeks, we work with your HR, IT and business stakeholders to map every HR trigger, define approval chains for each role type, automate revocation for critical systems within 24 hours, generate audit logs that timestamp every step, and produce the quarterly access-review evidence SAMA examiners request. The result is not a policy document filed in SharePoint; it is an operating process that your teams execute every week, with evidence packs ready when the next regulatory review arrives.
Why SAMA CSF Control 1-3-1 Focuses on Timely Provisioning and De-Provisioning
SAMA's Cyber Security Framework treats identity and access management as a foundational control domain. Control 1-3-1 requires institutions to establish and maintain processes for granting, modifying and revoking user access based on business need and role. The control's emphasis on timeliness reflects a simple risk: every hour a terminated employee retains system access is an hour of potential data exfiltration, fraud or sabotage. Every day a transferred employee holds dual access to segregated functions is a day of undetected segregation-of-duties violations.
During regulatory assessments, SAMA examiners test this control by requesting evidence for a sample of recent joiners, movers and leavers. They ask to see the HR termination notice, the IT ticket that disabled the account, the timestamp proving revocation occurred within the institution's defined window, and the log showing which systems were touched. Institutions that cannot produce this chain of evidence—or that show revocation delays of weeks rather than hours—receive findings that trigger formal remediation programs.
The challenge is not technical. Most institutions run Active Directory, an IAM platform or a privileged access solution. The challenge is process integration: ensuring that the moment an HR event occurs, a structured workflow begins, roles are evaluated, approvals are routed, access is provisioned or revoked in the correct sequence, and every action is logged in a format an auditor will accept.
Our Five-Phase Method: From HR System to Audit Evidence
We deliver Identity & Access Governance as a project that runs six to ten weeks, depending on the number of systems in scope and the maturity of your current processes. The engagement follows four phases—Baseline, Design, Review and Embed—and produces a set of deliverables that include an IAM policy and procedures, a role catalog for key systems, a privileged access standard, and an access review evidence pack. Within those phases, we execute five specific work streams to build your joiner-mover-leaver process.
Phase One: Mapping HR System Triggers and Current Workflow
We begin by documenting every HR event that should trigger an identity lifecycle action. Working with your HR and IT teams, we map four core triggers:
- Joiner: New hire, contractor onboarding, temporary staff.
- Mover: Department transfer, role change, promotion, secondment.
- Leaver: Resignation, termination, contract end, retirement.
- Leave: Maternity leave, sabbatical, suspension.
For each trigger, we trace the current workflow: which HR system records the event, how IT is notified, who approves access requests, which systems are provisioned, and how long each step takes. We review a sample of recent cases and collect any existing logs, tickets or email threads. Most institutions discover that joiners follow a semi-structured process—often because delays are visible and painful—but movers and leavers rely on informal notifications, manual spreadsheets or the memory of a single IT administrator.
We also identify your critical systems: core banking, payment platforms, customer databases, financial reporting tools and privileged infrastructure. These are the systems where access must be revoked within 24 hours of a leaver event, and where segregation-of-duties rules apply to movers.
At the end of this phase, you hold a current-state process map that shows every gap, delay and manual handoff. This map becomes the baseline against which we design the target workflow.
Phase Two: Defining Approval Chains and Access Matrices
Next, we design the target joiner-mover-leaver process. This phase produces three artifacts:
1. Role catalog for key systems. We define a set of standard roles—teller, relationship manager, credit analyst, IT administrator—and map each role to the systems and access levels it requires. The role catalog is not an abstract RBAC model; it is a practical lookup table that your service desk uses to provision a new joiner in 30 minutes instead of three days.
2. Approval chain matrix. For each HR trigger and role type, we specify who must approve access. A standard joiner may require only line-manager approval. A mover to a credit function may require both the receiving manager and the head of risk. A privileged access request may require IT security sign-off. We document these chains in a matrix that your workflow tool or ticketing system can enforce.
3. Revocation timeline. We define the maximum time allowed between the HR event and access revocation for each system category. Critical systems: 24 hours. Standard business applications: 48 hours. Non-sensitive collaboration tools: one week. These timelines are documented in your IAM policy and become the performance standard your IT team is measured against.
We also design the audit log requirements: which fields must be captured (user ID, system, timestamp, approver, ticket number), where logs are stored, and how they are extracted for quarterly reviews.
This phase involves workshops with HR, IT, business unit heads and your information security team. We facilitate the conversations that resolve competing priorities—speed versus control, flexibility versus auditability—and document the decisions in procedures that your teams will actually follow.
Phase Three: Automating Revocation and Building the Workflow
With the design complete, we move to implementation. This phase focuses on embedding the joiner-mover-leaver process into your operational systems.
Workflow automation. We work with your IT team to configure your ticketing system, IAM platform or HR system to trigger the workflow automatically. When HR records a termination, a ticket is created, routed to IT, and tracked until closure. When a mover is recorded, the workflow evaluates the old and new roles, identifies access to be revoked and access to be granted, and routes approvals accordingly. We do not require you to purchase new software; we configure the tools you already have—ServiceNow, Active Directory, SAP SuccessFactors, or even a structured Excel process if that is your current state.
Revocation scripts. For critical systems, we help your IT team build or refine scripts that disable accounts, revoke privileges and log the action with a timestamp. The goal is to reduce manual steps and ensure that a leaver's access to core banking or payment systems is revoked within the 24-hour window, even if the ticket is opened at 4:00 PM on a Thursday.
Segregation-of-duties rules. For movers, we implement checks that flag when a proposed role change would violate segregation-of-duties rules—for example, a user gaining both payment initiation and payment approval rights. These rules are encoded in your workflow so that approvers are alerted before access is granted.
At the end of this phase, your joiner-mover-leaver process is operational. HR events trigger workflows, approvals are routed, access is provisioned or revoked, and every step is logged.
Phase Four: Generating Quarterly Access-Review Evidence
SAMA CSF requires periodic access reviews to confirm that users retain only the access they need. We design and execute your first access review campaign during the engagement, then hand over the process for recurring cycles.
Access review evidence pack. We extract current access data from your key systems, compare it against your role catalog, and generate a review pack that shows each user, their assigned roles, their actual system access, and any discrepancies. Business unit heads review and certify their teams' access. We collect the signed certifications, document any access revocations resulting from the review, and compile the evidence pack that SAMA examiners request.
Recurring schedule. We document the quarterly or semi-annual schedule for access reviews, assign ownership, and define the evidence format. Your information security or IAM team takes ownership of running future campaigns using the process we have embedded.
This phase produces the access review evidence pack, one of the four core deliverables of the engagement.
Phase Five: Handover and Embedding the Recurring Cycle
The final phase ensures your team can operate the process independently. We conduct handover sessions with your HR, IT and information security teams, walking through the workflow, the role catalog, the approval matrix and the audit log extraction process. We deliver the IAM policy and procedures document, which codifies every decision made during the design phase, and the privileged access standard, which governs high-risk accounts.
We also define the metrics your team will track: average time from HR event to access revocation, percentage of leavers revoked within 24 hours for critical systems, number of segregation-of-duties violations detected during mover workflows, and quarterly access review completion rates. These metrics become part of your regular reporting to the risk committee or CISO.
At the end of the engagement, you hold four deliverables: an IAM policy and procedures, a role catalog for key systems, a privileged access standard, and an access review evidence pack. More importantly, you hold an operating process that your teams execute every week, and an audit trail that demonstrates compliance with SAMA CSF Control 1-3-1.
What You Receive: Deliverables and Operating Capability
Our Identity & Access Governance engagement produces the following:
- IAM policy and procedures: The governance document that defines your joiner-mover-leaver process, approval chains, revocation timelines and audit log requirements.
- Role catalog for key systems: A practical mapping of roles to system access, used by your service desk to provision new joiners and evaluate mover requests.
- Privileged access standard: Controls and procedures for high-risk accounts, including approval requirements, session logging and periodic recertification.
- Access review evidence pack: The first quarterly access review, including user access reports, business unit certifications and revocation logs, ready for regulatory examination.
Beyond these documents, you receive an embedded process: workflows configured in your systems, scripts that automate revocation, approval chains that enforce segregation of duties, and a team trained to execute the cycle every quarter.
When to Engage: Three Scenarios
Institutions typically engage us for Identity & Access Governance in three situations. First, when preparing for a SAMA Cyber Security Framework assessment and the current joiner-mover-leaver process relies on informal notifications and manual tracking. Second, when a recent regulatory review has identified findings related to untimely access revocation, lack of access review evidence or missing segregation-of-duties controls, and a formal remediation program is required. Third, when the institution is implementing a new IAM platform or upgrading its HR system, and leadership recognizes the opportunity to embed structured identity lifecycle processes from the outset rather than retrofitting them later.
In each case, the challenge is the same: connecting HR events to identity actions with a workflow that produces audit evidence. Our method delivers that workflow in six to ten weeks, using the systems you already have, and hands over a process your teams can sustain.
How We Support Identity & Access Governance
We strengthen how access is granted, reviewed and removed through joiner-mover-leaver processes, privileged access controls, segregation of duties and periodic access reviews. The engagement runs six to ten weeks and produces an IAM policy and procedures, a role catalog for key systems, a privileged access standard, and an access review evidence pack. We work within the SAMA Cyber Security Framework and the NCA Essential Cybersecurity Controls, ensuring that the process we build meets the requirements your examiners will test.
If your institution needs to mature its joiner-mover-leaver process, prepare for a SAMA assessment, or remediate findings from a recent regulatory review, we can help. Reach out to discuss your current state and the evidence you need to produce.
