Home/Resources/NCUA exam readiness checklist
Free checklist · PDF

NCUA IAM exam readiness checklist.

Eight categories to find orphaned access before the examiner does, for credit unions and community banks.

What’s inside

Eight categories, and what examiners expect in each.

Examiners ask more than whether you ran an annual access review. They ask how you find orphaned accounts, handle internal role changes, and prove third-party access is tied to active contracts. Each category sets out the expectation and the checklist items that show you meet it.

  • The mover gapInternal role changes that leave permissions behind, from formal transfer triggers to the segregation-of-duties conflicts that build up across several moves.
  • Ghost profiles & orphaned accountsReconciling HR terminations against the directory, the core, and legacy systems, plus service accounts owned by departed IT staff and dormant-account thresholds.
  • Third-party, vendor & fintech accessEvery external account tied to an active contract or SOW, with expiration dates and immediate revocation when a contract or fintech partnership ends.
  • Privileged & break-glass accountsShared and generic logins eliminated, privileged access tied to named individuals, and a documented break-glass procedure with post-incident review.
  • Application-specific blind spotsThe SaaS apps, loan origination systems, and shared drives that Active Directory does not see, and whether SSO or SCIM actually manages them.
  • The user access review processRisk-based review frequency, enough context for reviewers to decide, documented remediation deadlines, and evidence that changes were made.
  • Evidence & audit trail readinessThe reconciliation reports, revocation timestamps, and access logs an examiner may ask for, ready before the request arrives.
  • Sustainable automationMoving off spreadsheet tracking to provisioning driven by HR attributes and role changes, so orphaned access stops coming back once it has been cleaned up.

Built for the exam conference room

The evidence category lists the reports examiners ask for, from HR-versus-directory reconciliations to vendor accounts against active contracts, so you can check what you can produce today.

Solution

Exam & audit readiness

What NCUA and FDIC examiners look for, mapped to the evidence Provision produces, exportable as PDF and CSV.

Solution

User access reviews

One scheduled, documented review workflow with proof on every decision, so orphaned access surfaces in the review instead of in the exam.