Faster, More Transparent, and Centrally Managed: A New IAM Solution at IBB

The Challenge: Manual Recertification Had Reached Its Limits

Identity and Access Management was not new to IBB. As early as 2000, the bank was already using an IAM solution from another provider to manage access rights, including those in Microsoft Active Directory and the Novell eDirectory system in use at the time.

However, not all relevant applications were centrally integrated. SAP access rights, in particular, had to be reviewed manually on a regular basis. This created a considerable workload for the unit responsible for monitoring IT access rights and supporting compliance requirements.

Administrators exported access-rights information from individual systems and forwarded it to the respective managers. They then had to verify whether employees were still working in the relevant department, had changed roles, or required new access rights. The results were subsequently returned to the administrators, who implemented the necessary changes in the respective systems.

As regulatory requirements increased, it became clear that IBB needed a centralized, transparent, and more efficient solution for recertification.

The Search for a Centralized Identity Management and Recertification Solution 

In 2015, IBB therefore issued a tender for a new IAM system. One of the key drivers was a requirement arising from monitoring by an auditing company: The bank needed to provide an up-to-date, daily overview of its access rights. At the same time, IBB wanted to standardize its recertification processes, which until then had been partly manual. 

IBB selected Garancy. Key factors included the vendor’s experience in the banking sector and the ability to handle recertification through an integrated portal without having to develop a separate solution. Preconfigured role profiles and standard workflows also made implementation easier. It took only around six months from implementation to production use.

Centralized Access Management Instead of Manual Coordination

The introduction of Garancy fundamentally changed IBB’s existing process. Instead of requesting access rights information individually from different sources, the IAM solution can centrally consolidate data from connected systems and automatically prompt managers to perform recertification at defined intervals. 

The Garancy Identity Manager enables identities, groups, and roles to be administered and managed centrally. The actual review of access rights takes place in the web-based Recertification Center. 

There, the responsible managers can view the rights and roles assigned to their employees and decide whether they should remain in place. If access rights are not reconfirmed, they can be automatically revoked. This transformed a process dominated by manual coordination into a centrally managed and traceable IAM process. 

40 Systems Connected in Six Months

Within the first six months alone, 40 systems were connected to Garancy. Using the uConnect technology, even custom applications could be integrated via flexible interfaces such as CSV.

The HR system transmitted up-to-date master data to Garancy every day. The solution processed the information and provisioned the corresponding users. For this purpose, IBB used a standard Garancy workflow that was extended with additional approval steps.

As part of its IAM transformation, IBB also introduced a more role-based approach to identity management. Access rights typically associated with a particular department – such as email distribution lists, drive directories, or access to specific applications – were bundled into roles and represented in the Garancy Identity Manager.

Instead of reviewing numerous individual access rights separately, IBB was able to structure access more effectively around organizational roles.

First Recertification: Approximately 850 Users Reviewed Centrally 

At the beginning of 2017, IBB conducted its first recertification using the new portal. A total of 60 managers reviewed the access rights of around 850 users. Features such as delegation, quick actions, and clear, structured views made it easier for managers to complete their reviews. At the same time, campaign administrators could centrally monitor progress.

On average, a manager had to review the access rights of ten to 20 employees across different systems. Due to his management responsibilities, for example, Percy Frahm had around 1,400 access rights to review.

The clear overview in the Recertification Center showed which roles each individual held, which systems they used, and why the respective access rights had been granted. This enabled managers to make faster decisions about whether access should be confirmed or revoked. 

In Frahm’s case, around one-third of the reviewed access rights could be removed immediately. His entire recertification was completed within half a working day.

Entire Recertification Completed in Six Weeks

The centralized solution also enabled the other managers to complete their reviews more quickly. The entire recertification cycle was completed within six weeks.

Garancy’s monitoring capabilities also helped provide transparency into the current processing status. The responsible control unit could identify outstanding recertifications and follow up with the relevant managers. 

Garancy therefore improved not only the access review itself, but also the management of the entire recertification process. 

Greater Transparency and Higher-Quality Access Management

According to IBB, the introduction of the new solution improved not only the speed of its processes but also the quality of the access rights granted. The centralized view made it possible to identify, among other things, obsolete roles and access rights requiring further cleanup.

Instead of viewing access rights only in isolation within individual systems, IBB was able to further centralize its identity management and manage information from different systems in a consistent manner.

Positive Assessment in the Readiness Check

The improvements were also evident during an IT audit conducted at the time by the auditing firm. The firm carried out a readiness check in preparation for an audit pursuant to Section 44 of the German Banking Act (KWG). IBB's identity management and recertification processes received a "highly recommended" rating.

For the bank, this provided important confirmation that the new IAM structure not only simplified internal processes but also supported the requirements for traceable and controlled access management.

IAM as the Foundation for Efficient Recertification

The IBB case demonstrates how a complex recertification process characterized by extensive manual coordination can be transformed with a centralized IAM solution.

Garancy consolidates access rights information from different systems, supports role-based structures, and enables managers to review permissions through a centralized workflow. At the same time, the responsible control unit gains transparency into overall progress and can systematically follow up on outstanding recertifications.