Fictional educational IAM governance simulation
Northstar HealthTech
Identity & Access Management Governance and Control Testing
An independent IAM governance portfolio simulation for a fictional healthcare technology organization of approximately 250 employees. The project demonstrates governance design, employee identity lifecycle procedures, access approval processes, risk assessment, control testing, evidence analysis, and remediation planning.
- IAM Governance
- Identity Lifecycle
- Access Reviews
- Risk Management
- Control Testing
- GRC
The business problem
Problem
The fictional organization needs a consistent way to govern employee access, manage joiners, movers and leavers, authorize privileged access, review permissions, measure IAM control effectiveness and address weaknesses.
Approach
Design a governance model with lifecycle procedures, approval rules, access certification, risk scoring and documented control tests, then analyze simulated evidence.
Deliverables
Eight portfolio-reviewed documents covering charter, procedures, risk register, dashboard, evidence matrix and a control-testing simulation.
Proposed IAM Governance Model
A proposed design, not a deployed production architecture. Select an activity for details.
Establish governance ownership: Charter defines roles, accountability and decision rights.
Employee Offboarding — Simulated Control Testing
SimulatedControl objective: departing employees' accounts are disabled no later than their authorized departure time. All values are from a fictional scenario and do not represent real organizational performance.
Initial finding · simulated
Disabled 45 min after departure
Finding ref · simulated
SIM-FIND-001
Risk ref · simulated
IAM-001
Inherent risk · simulated
High · 16/25
Corrective action · simulated
SIM-CAP-001
Remaining exception · simulated
6 min late
Fictional retest · 5 accounts evaluated
4 passed · 1 failed · 80% simulated pass rate
Control conclusion (simulated): timing criterion failed. Corrective action SIM-CAP-001: Open — the fictional retest still had one account disabled 6 minutes late, so the required timing criterion was not met and closure is not supported.
Portfolio deliverables
Final portfolio-reviewed versions. Each opens on GitHub in a new tab.
- 01
IAM Governance Charter
Governance structure, ownership and accountability.
View Document - 02
Joiner, Mover, Leaver Procedure
Identity lifecycle process design for employee changes.
View Document - 03
Access Request and Approval Matrix
Access authorization and least-privilege approval rules.
View Document - 04
IAM Risk Assessment and Register
Risk identification, scoring and treatment planning.
View Document - 05
Access Review and Certification Procedure
Access certification and revocation processes.
View Document - 06
IAM Metrics and Governance Dashboard
KPIs, formulas and management reporting.
View Document - 07
IAM Control Testing and Evidence Matrix
Control objectives, test procedures and evidence requirements.
View Document - 08
IAM Control Testing Simulation
Fictional evidence analysis, failed retest and escalation.
View Document
IAM skills demonstrated
- Identity governance
- Employee onboarding and offboarding
- Least privilege
- Access approvals
- Access certification
- Risk assessment
- Audit evidence management
- Control testing design
- Corrective action planning
- Governance metrics and reporting
Documentation-based skills. No Microsoft Entra ID configurations were deployed or tested in a real tenant.
Project methodology
- 01 Governance charter
- 02 Identity lifecycle procedures
- 03 Access authorization and reviews
- 04 Risk assessment
- 05 Control testing and evidence design
- 06 Simulated remediation analysis
Project status and limitations
Status: Portfolio Documentation Complete — Educational Simulation
Completed in this portfolio
- ✓ Governance documentation designed
- ✓ Dashboard formulas checked using fictional examples
- ✓ Control-testing procedures documented
- ✓ Offboarding evidence simulated
Not performed
- ✕ No production IAM controls tested
- ✕ No actual remediation implemented