A regional financial institution engaged Kimly Hong to help develop a remediation roadmap for its identity and access management platform after rising authentication incidents, internal audit findings, and regulatory pressure under SOX and GLBA converged into a program-level problem. The twelve-month engagement addressed entitlement drift, weak access certification, privileged account sprawl, and years of authentication configuration debt without disrupting customer-facing operations. The program delivered a clean SOX testing cycle with no IAM-related deficiencies, a greater than fifty percent reduction in authentication incidents, and substantially complete privileged access coverage. This case study documents the full assessment, remediation roadmap, governance model, and lessons learned.