The Vendor Access Renewal That Nobody Owned
Northwind Mutual, a mid-sized insurer, runs an annual access recertification for its 340 third-party vendor accounts. The GRC team sends the campaign on 1 March; business owners must attest by 31 March. This year, 61 accounts (18%) were not attested by the deadline. Of those, 44 belong to a single vendor, Meridian Analytics, whose contract owner left the company in January. Meridian's contractor manager has been emailing the service desk directly to extend access, and the service desk has been doing so, citing a signed 2023 statement of work. Internal audit found the gap during a routine review and flagged it as a high-severity finding. The CISO wants the 44 accounts disabled immediately. The CIO argues that disabling them halts a production data feed that finance depends on for month-end close, which happens in nine days.
1. Identify the governance failure(s) in this scenario and explain why the recertification process did not catch them.
Read the worked answer
The core failure is orphaned accountability. The recertification model assumes every account has a named business owner who can attest. When the contract owner left in January, no one reassigned ownership, so 44 accounts entered the campaign with no valid attester. The process reported them as 'not attested' but had no escalation path for 'no owner exists' - it treated an ownership gap as an ordinary attestation miss.
A second failure is out-of-band change. The service desk extended access based on a 2023 statement of work without routing through the GRC team or the vendor risk register. That means access changes bypassed the control the recertification was meant to enforce. The SOW is also stale: it predates any current risk assessment of the vendor.
Why it wasn't caught: the campaign measures attestation completion, not ownership coverage. A 82% completion rate looks like a process problem, not a governance problem, so it never reached the risk committee. The metric masked the real issue - 18% of the estate had no accountable human.
2. The CISO wants immediate disablement; the CIO cites a nine-day month-end close dependency. Recommend a course of action and justify it against the access-control principle of least privilege and business continuity.
Read the worked answer
Recommend a tiered response, not a binary choice:
- Immediately suspend the 17 non-Meridian unattested accounts. They have no stated dependency and no owner - the default must be deny.
- For the 44 Meridian accounts, apply compensating controls for the nine-day window: read-only access where the feed permits it, enhanced logging, and a named interim owner (the finance data steward) who attests in writing within 48 hours.
- Freeze any new service-desk extensions until GRC approves.
- After month-end close, disable all 44 unless a current risk assessment and renewed SOW are in place.
Justification: least privilege does not require an all-or-nothing switch-off; it requires that access be justified, owned, and minimized. Leaving 44 accounts fully privileged with no owner for nine days violates that. But an uncontrolled cutover that breaks finance close creates a different risk - operational and financial. The tiered approach shrinks the exposure, assigns accountability, and preserves continuity. Document the exception with an expiry date so it does not become permanent.
3. What single process change would most reduce recurrence, and how would you measure whether it worked?
Read the worked answer
The highest-leverage change is a pre-campaign ownership validation gate: before the recertification launches, reconcile the account inventory against the HR/contract-owner system and block the campaign from starting until every account maps to a current, active owner. Any account without an owner is auto-flagged for disablement rather than left to fail attestation.
Measure with ownership coverage rate (percentage of in-scope accounts with a valid active owner at campaign start) rather than attestation completion rate. Target 100% coverage before launch. Secondary measures: number of access changes made outside GRC (should trend to zero), and median time to reassign ownership after an owner departs. The completion-rate metric should be retired or paired with coverage, because on its own it hid the failure.