Access Review at the Subsidiary
A group internal audit team reviews a manufacturing subsidiary that uses a shared ERP instance with the parent. The subsidiary's IT manager holds the security administrator role for the whole instance, including the parent's company code, because 'someone has to fix things at night'. There are 340 active user accounts against 290 employees; 22 accounts belong to contractors whose contracts ended in the last year. The quarterly access review is performed by the same IT manager, who prints a user list, signs it, and files it. Change management requires a ticket and a second approver, but the second approver is the IT manager's deputy, who reports to him. Last year's audit finding on contractor deprovisioning was marked 'closed' after the subsidiary produced the signed review sheets.
1. Identify the segregation-of-duties failures and explain why the signed review sheets did not constitute evidence of a working control.
Read the worked answer
There are at least four conflicts. First, the IT manager can grant access to the parent's company code, so a subsidiary employee can create or alter access affecting group financial data - a cross-entity conflict, not just a local one. Second, he performs the review of his own access and of accounts he provisions, so the reviewer and the reviewee are the same person. Third, change approval is nominally dual but the second approver is his subordinate, which is dual control in form only; a subordinate cannot refuse a manager's change. Fourth, the same individual who creates accounts also holds the emergency access that bypasses the process.
The review sheets prove that a list was printed and signed, not that access was evaluated. Evidence of a control's operation must show the reviewer had the competence, independence and information to detect an exception, and that exceptions were acted on. Here the population was never reconciled to HR, so the 22 terminated contractors could not surface, and no exceptions were recorded - a review that never finds anything is itself a red flag. 'Closed' should have required a re-test of the population, not production of the artefact.
2. The subsidiary argues that removing the IT manager's parent-company access will cause unacceptable night-time delays. How should audit respond?
Read the worked answer
Separate the two needs being conflated: emergency access and standing access. The business need is to restore service quickly at night; the control need is that no single person can silently change access to group data. Both can be met.
Options: a break-glass account held in a sealed or vaulted process, checked out with automatic alerting to the parent's security function and a mandatory post-hoc review within one business day; or delegated administration scoped so the subsidiary admin can manage subsidiary accounts only, with parent-code changes routed to a group administrator on call. The first is faster to implement; the second is structurally cleaner and should be the target state.
Audit should accept a documented, time-bound compensating arrangement with monitoring, and should test the break-glass logs in the next cycle. What audit should not accept is the argument as stated, because 'someone has to fix things at night' justifies unlimited standing privilege for one person indefinitely, and the risk sits with the parent, which did not consent to it.
3. Design the population test you would run to determine whether deprovisioning actually works, and state what result would change your conclusion.
Read the worked answer
Obtain the HR master list of leavers and contractor end dates for the period, and the complete ERP account list with creation and last-logon dates, both as raw extracts rather than filtered reports. Match on a stable identifier, not name. The exception population is every account with no active employment or contract record, plus every account whose last logon precedes its owner's leaving date (which suggests shared or transferred credentials).
For each exception, determine whether the account was disabled within the policy window and who disabled it. Then test the other direction: sample new joiners and confirm access was granted only after authorisation, because a process that never removes access often also grants it too freely.
My conclusion would change if the reconciliation showed a clean population - zero active accounts without a matching active person - and if a sample of the 22 known contractor accounts showed timely, evidenced disablement with the delay explained. A single clean quarter would not be enough; I would want two consecutive cycles, because the finding was previously closed on paperwork and the process has a demonstrated history of appearing to work.