Hi David,
did you check whether GRC synced correctly? Please see table GRACUSERROLE if the assignments are correct for user and connector. The USERROLEID field can be linked with ROLEID from table GRACROLE.
Just for my information: do you use business roles or technical roles? There are several notes regarding deprovisioning of business roles which doesn't work properly.
Regards
Alessandro