Review access rights

Security and data protection: Review access rights. Starts when: Quarterly. Steps: List roles; Owners confirm; Remove stale; Receipt. Done when: Every role has a confirmation or removal in the review. Rules that apply: FCA SYSC 13; ISO 27001 A.9.