Complete each section with your organization's actual process — system names, responsible roles, and specific steps. A documented process that matches real practice is what auditors and new IT staff both need; an idealized process that isn't followed is worse than no documentation.

• Trigger: [HR system event / manager request / other]
• Responsible role: [who provisions access]
• Access template location: [where role-based templates are documented]
• Target time to full access: [target, e.g. "day one"]

• Trigger: [role change event source]
• Responsible role: [who reviews and adjusts access]
• Prior-role access removal step: [explicitly documented, not implied]

• Trigger: [HR termination event]
• Target revocation time: [same day / same hour]
• Systems checklist reference: [link to your offboarding systems checklist]
• Shared credential rotation owner: [responsible role]

• Access review frequency: [quarterly / semi-annual]
• Review owner: [responsible role]
• Documentation location for review outcomes: [where records are kept]

• Identity Lifecycle and Joiner-Mover-Leaver Governance — /knowledge-center/cybersecurity/identity-access-management/identity-lifecycle-governance
• Download: Identity Governance Checklist — /knowledge-center/cybersecurity/identity-access-management/downloads/identity-governance-checklist