I suppose this question could go in this forum or ebanking/technology, so if it needs to be moved I apologize in advance.

Can someone smarter than me direct me to a guidance or regulation addressing management's review of user access levels to the institution's system devices and programs? I have located the FFIEC guidance as part of the IT Booklet, but I want to make sure I'm not missing anything. Thanks in advance!

You are not. It is covered in there

Excellent, thanks osucpa!