BANK X · ILLUSTRATIVE DATA

Bank X: illustrative data Fictional entity. Every figure below is invented for illustration. العربية

Technology-Risk Decision Brief: Privileged Access to the Payment and Core Banking Estate

Bank X · mid-size SAMA-regulated bank (illustrative) · prepared by the Head of Technology Risk (second line)

ToBoard Risk Committee

Agenda item4(b): decision required

Meeting date12 Aug 20X1

Data as at30 Jun 20X1 (Q2 close)

1Risk statement & appetite position

Risk statement Fourteen privileged accounts on the core banking and payment-switch estate can change production configuration without session recording, so an unauthorised or erroneous change could go undetected beyond one business day.

Appetite position Residual 12 against a Committee ceiling of 8 for payment-integrity risk, outside appetite for two consecutive quarters, with no movement between them (Q1: 12, Q2: 12).

2Control posture summary

Control domain	In scope	Effective	Partial	Not effective	Direction (6 mo.)	What moved
Identity & privileged access	34	26	6	2	▲ Improving	Joiner-leaver revocation moved to same-day. Session recording remains the open gap.
Change & release management	21	19	2	0	▶ Stable	Pre-approval control holds. The emergency route is the weak point (KRI-2).
Third-party & outsourced hosting	18	11	5	2	▼ Deteriorating	Two attestations lapsed since the Q1 report. No new control failures found. Coverage fell, not performance.

Scope of this paper: 73 controls across three domains, selected because they sit on the path of the risk above. The full technology control set is reported in the quarterly dashboard.

3KRI interpretation

KRI-1 Privileged accounts without session recording 14 of 212 (6.6%) tolerance 2% (4 accounts) · Q1: 11 accounts

What it means: Fourteen named administrators can change production on core banking and the payment switch without a reconstructable record. The count rose by three during the Q2 core upgrade: two vendor-support accounts and one database administrator.

So what: This KRI alone holds residual at 12 (likelihood 3 × impact 4 on the register's 1–25 scale). Recording the 12 in-house accounts is what re-bands likelihood to 2, returning residual to 8 (at the ceiling, not below it). The two vendor-support accounts do not move the band on their own, but they must close for the re-test to evidence it and to stop the count climbing back through the next upgrade. They close only through a contract amendment, which is why the ask below is scoped to the Q4 renewals and not to the technical work alone.

KRI-2 Emergency changes as a share of production changes 43 of 457 (9.4%) tolerance 5% · retrospective approval inside 3 days: 32 of 43 (74%) against a 95% standard

What it means: Nearly one production change in ten bypasses pre-approval, and a quarter of those are not documented inside the window. The emergency route is functioning as a bypass, not as an evidence-producing control.

So what: The two gaps compound: emergency changes are executed by exactly these privileged accounts, so activity that misses its approval window is currently unapproved and unrecorded at once. Any "accept and monitor" position would lean on process discipline that is itself performing at 74%. Recorded here so that Option A is declined on evidence rather than on preference.

KRI-3 Material outsourced providers with a current control attestation 4 of 11 mean attestation age 16 months · standard 12 months

What it means: For seven providers, including the two holding disaster-recovery capacity for the payment switch, the bank is reporting control effectiveness it has not independently confirmed this year.

So what: This is the deteriorating arrow in section 2, and it sets the date on the decision. Three of the seven contracts renew between October and December; audit-rights and session-recording clauses are negotiable at renewal and not afterwards. A decision taken in February arrives after that window has closed.

4Decision required

The ask: one decision

Approve SAR 1.4m from the approved FY technology contingency (within this Committee's delegated expenditure limit of SAR 2.0m) to close the privileged-access recording gap, with the vendor-support element delivered through the Q4 contract renewals. Target: residual risk 12 → 8 by 15 December 20X1.

Option A: not recommended

Accept residual 12 until the FY-end review (10 Feb 20X2)

Cost: nil this financial year.
Exposure unchanged for approximately six months.
Leaves unrecorded privileged activity covered only by after-the-fact reviews, while the change discipline behind them runs at 74% (KRI-2).
Q4 renewal window passes; the two vendor-support accounts remain unrecorded into the next financial year, with no contractual lever until the following renewal.

Option B: recommended

Fund remediation now

SAR 1.4m: two contract engineers for five months (0.90), privileged-access licence uplift for 90 accounts (0.35), second-line re-test (0.15).
12 of 14 accounts recorded by 30 Nov 20X1.
Contract amendments signed at renewal; recording then enabled on the two vendor-support accounts and confirmed in the re-test.
Residual 8, at the ceiling, evidenced by re-test on 15 Dec 20X1.

Not being asked for: no change to the appetite ceiling; no new tooling procurement (the uplift sits on the existing licence); no permanent headcount (contract resource, time-boxed). Residual at 8 sits at the ceiling, not comfortably below it. Moving it lower depends on the payment-switch network-segmentation work already scheduled in the FY 20X2 plan, which is not part of this decision.

Accountability	Owner	Date
Decision	Board Risk Committee	12 Aug 20X1 (this meeting)
Delivery of session recording	Chief Information Officer	30 Nov 20X1
Audit-rights and recording clauses at renewal	Head of Procurement	At each renewal, latest 15 Dec 20X1
Re-test and residual re-score	Head of Technology Risk (second line)	15 Dec 20X1
Report back to the Committee	Head of Technology Risk	20 Jan 20X2

5Evidence lineage

Data point	Source system	As at / period	Prepared & challenged
212 privileged accounts; 14 unrecorded	Privileged access management console: account export, reconciled to HR joiner-leaver extract	30 Jun 20X1	First line (identity ops); second-line reconciliation 9 Jul 20X1
73 controls; effectiveness split (section 2)	GRC risk register: second-line test results	Quarter ended 30 Jun 20X1	Second line; sample-based, not full population
457 production changes; 43 emergency	Service management tool: change module	1 Apr – 30 Jun 20X1	First line (change management)
Retrospective approval 32 of 43 (74%)	Service management tool: all 43 emergency records	Tested 8–12 Jul 20X1	Second line; full check, no sampling
11 material providers; 4 current attestations; 16-month mean age	Supplier register and contract repository	30 Jun 20X1	Vendor management; materiality per outsourcing policy
Residual 12, and 8 post-remediation	Risk register scoring model v3.1 (likelihood × impact, 1–25)	Scored 3 Jul; challenged 15 Jul 20X1	First line scored; second line challenged; no open disagreement
SAR 1.4m cost	CIO planning estimate; vendor day-rate card	Rate card dated 2 Jul 20X1	Planning estimate ±15%; not a tendered price

Stated limitation: the two lapsed attestations covering disaster-recovery capacity are carried from the providers' prior-year reports. A current attestation is a deliverable of the Q4 renewals, not of this paper.

Illustrative artifact. All data fictional. Structure: Mohammed AlYahya (how I frame technology-risk decisions for a risk committee).