The Auditor's Finding on Access Reviews
You are the head of compliance for a financial services firm subject to SOC 2 Type II and ISO 27001. During an internal audit, you find that quarterly access reviews for the customer database were not performed for two consecutive quarters (Q3 and Q4 of last year). The reviews are a key control in your SOC 2 system description and ISO 27001 Statement of Applicability. The IT manager responsible says the reviews were skipped due to staff turnover and that no unauthorized access occurred. You have evidence that during that period, three terminated employees still had active database accounts, but logs show they did not access the database after termination. The external auditor is scheduled to begin fieldwork in three weeks. The CEO wants to know if this is a reportable issue and what to do.
1. What are the implications for your SOC 2 and ISO 27001 certifications, and what should you do before the external audit?
Read the worked answer
This is a control failure. For SOC 2 Type II, the auditor will test the operating effectiveness of controls over the audit period. If access reviews were not performed for two quarters, the control failed to operate effectively during that period. The auditor may issue a qualified opinion or an exception in the report. For ISO 27001, the nonconformity could lead to a minor nonconformity if corrected promptly, or a major nonconformity if systemic. You must take corrective action: 1) Immediately perform the access reviews for the current quarter and retrospectively for Q3 and Q4 if possible (using current data, but document that it's a catch-up); 2) Disable the three terminated employees' accounts and document that no access occurred; 3) Conduct a root cause analysis (staff turnover) and implement a compensating control (e.g., automated access review tool, cross-training); 4) Update your risk register and document the incident in your compliance monitoring system; 5) Prepare a corrective action plan with timelines. Before the external auditor arrives, you should self-report the finding and present the corrective actions. This demonstrates transparency and may mitigate the severity. Do not attempt to cover it up. The auditor will likely test the control and find the gap anyway. Also, consider whether this triggers any regulatory notification (e.g., to the FCA if customer data was at risk, but here no access occurred, so likely not). Document everything.
2. How should you communicate this to the CEO and what metrics would you track to prevent recurrence?
Read the worked answer
Communicate clearly and factually: The control failed for two quarters due to staff turnover, but no unauthorized access occurred. The external auditor will likely find an exception, which may affect the SOC 2 report and could lead to a minor ISO nonconformity. We have already taken corrective actions: terminated accounts disabled, access reviews completed, and a new automated tool is being implemented. We will present a corrective action plan to the auditor. The risk is manageable if we act now. To prevent recurrence, track metrics: 1) Percentage of access reviews completed on time (target 100%); 2) Number of terminated employees with active accounts after 24 hours (target 0); 3) Time to remediate access review findings; 4) Staff turnover in IT and training completion. Implement a monthly dashboard for the CEO and audit committee. Also, consider automating the access review process and integrating it with HR offboarding. Conduct a lessons-learned session and update policies to require backup reviewers. This demonstrates a commitment to continuous improvement.