Last updated: 5/14/24

G-Invoicing SailPoint Identity IIQ “AppApprover” Form

As a result of the GINV migration to CAIA (multifactor authentication), the existing GINV agency “Primary Master

Administrators” (PMA), “Master Administrators” (MA) and “User Admins” (UA) for each Agency were imported to 

the new CAIA-SailPoint “AppApprover” group(s).

The CAIA-SailPoint “AppApprover” group members are those authorized to approve agency user requests to be

added to the GINV agency account. The first access approver is the user’s “Manager” assigned in SailPoint. The 

“AppApprover” groups replaced the former PMA, MA, and UA roles in ISIM.

After a user submits their access requests in SailPoint IIQ, the user’s “Manager” (1st approver) will receive an email 

to approve the access request. Once approved, a second email is sent to the “AppApprover” (2nd approval) group 

members to approve the access request. User’s Manager (1st Approver) and SailPoint AppApprover (2nd Approver) 

cannot be the same person. Once both approvals are complete, the user will be able to access the GINV agency

account and role-based access will still be managed within the GINV application.

This form is completed for the following requests. 

1. User to be added to the agency “AppApprover” group for the Agency listed below and signed by an 

active agency SailPoint “AppApprover” group member. 

2. User to be removed from the “AppApprover” group. No “AppApprover” signature is required. 

GINV Agency(s) Name

(Service Providers can add users to multiple Agencies if needed)

SailPoint “AppApprovers”

Name Title Email Address

ADD Remove* **Digital Signature of 

user being added

(PIV, PIV-I, CAC) QA Prod QA Prod

*No signature required to remove user.

**All new “AppApprovers” must digitally sign the form to indicate they have read and agree to the “AppApprover” 

Responsibility Agreement below. DO NOT LOCK THE FORM AFTER EACH SIGNATURE. This will prevent others from being 

able to sign the form.
Last updated: 5/14/24

G-Invoicing SailPoint IIQ “AppApprover” Responsibility Agreement

The information you provide on this form will be used principally to aid in the completion of your accessrequest to the Bureau

of the Fiscal Service systems. All or part of thisinformation may be furnished to Federal, State, local and public agencies

in the event a violation of law are disclosed. More information on Privacy Policy and Legal Notices is available at 

www.fiscal.treasury.gov/privacy.html.

Completion of thisform is voluntary; however, failure to complete the form requested will result in no consideration for 

accessto the Bureau of the Fiscal Service systems. Although no penalties are authorized if you do not provide the

requested information, failure to supply information will result in your not receiving access to the Bureau of the Fiscal 

Service systems.

SailPoint “AppApprover” Responsibilities:

I am aware that the Bureau of the Fiscal Service’s policy is to treat all information as an asset, whether it is computer 

programs,software, data, or other information collected, stored, and generated in the conduct of its business. To the best 

of my ability, I will protect information from unauthorized use, modification, destruction, or disclosure, whether

accidental or intentional.

• I am aware of the policies and requirements of the Bureau of the Fiscal Service and agree to abide by them.

• I will NOT attempt to circumvent any of the security mechanisms within SailPoint IdentityIQ and G-Invoicing system.

• I will ensure that proper authorizations on requests are checked.

• I will ensure that all fields on the requests are complete and correct.

• I will ensure proper record keeping of all information processed.

• I will comply with all security-related polices, standards, procedures, and practices.

• I will notify the Treasury Support Center at 877-440-9476 of any known or suspected violation of information security 

policy, procedures, or threat to G-Invoicing resources.

By signing this form, I acknowledge I have read and understand the “AppApprover” Responsibility Agreement and

agree to abide by it.

*Existing SailPoint “AppApprover” Signature

*Name:

*Email Address:

*Date:

*Approver’s Signature: 

Digital signature (PIV,PIV-I,CAC)

* Required information - An active agency SailPoint “AppApprover” signature is required to add a new “AppApprover”

to the agency SailPoint “AppApprover” group. 

*Official Agency Authorized Approver to setup initial AppApprover(s)

*Name:

*Title:

*Email Address:

*Date:

*Approver’s Signature: 

Digital signature (PIV,PIV-I,CAC)

* Required information - Official Agency Authorized Approver signature is ONLY REQUIRED when there is no 

active agency “AppApprover” in the agency SailPoint “AppApprover” group. By signing as an Agency Authorized 

Approver, the officer (Chief Financial Officer, Deputy Financial Officer, Director of the Office of Finance, Office of 

Accounting or other comparable title) certifies that he/she is duly authorized by the agency/organization to designate

who may serve as an agency “AppApprover” for the above-named agency(s).

 
Last updated: 5/14/24

1. The Federal Program Agency will provide a name of two G-Invoicing “AppApprovers” per agency account

designated with the authority to determine whether an End User should be authorized as an “AppApprover”

and/or End User for the G-Invoicing application. This is to ensure there is at minimum one backup to 

approve G-Invoicing user’s access requests. The agency can identify additional “AppApprovers”, if necessary. 

2. The “AppApprover” will receive an email after the End User’s SailPoint “Manager” approved the 1st access 

request submitted via SailPoint IdentityIQ. The “AppApprover” is responsible to provide the final approval 

(2nd approval) for all agency user access requests. The “AppApprover” is responsible to confirm the End User 

submitting the access is authorized to access the functionality in application for the roles being requested. 

When the “Manager” and “AppApprover” receives the pending access request email, they must login to

SailPoint IdentityIQ and approve/reject the request. If the request is not fully approved within 14 calendar 

days, the user must reinitiate the request. 

Federal Program Agency – business entity requiring accessto the G-Invoicing application.

AppApprover - term for the individual(s) identified by other “AppApprovers” or the “Official Agency Authorized 

Approver” who are authorized to approve a user access request thereby granting them access to the G-Invoicing

application.

End User – person employed by a Federal Program Agency who has a business need to access the G-Invoicing

application.

 COMMENTS:

11.5.5.1 Write and Maintain a Privacy Act Statement

Pursuant to 5 U.S.C. §552a (e) (3) agencies are required to provide what is commonly referred to as a Privacy Act 

Statement to all persons asked to provide personal information about themselves, which will go into a system of 

records (i.e., the information will be stored and retrieved using the individual’s name or other personal identifier 

such as a Social Security Number). Department of the Treasury (Treasury) policy is to provide a Privacy Act 

Statement regardless of whether the collection is part of a system of records or not. All Privacy Act statements 

must be reviewed by the Chief Privacy Officer or Privacy Act Officer.

Please completed the required information and return the completed form to the Treasury

Support Center email (ginvoicing@stls.frb.org). If this is an expedited request, please 

specify in the email.