Report Shows Full Compliance While Exceptions Persist
A logistics company's monthly compliance report, generated from Password Safe, states that 98% of managed accounts rotated within policy and that all privileged access had approvals. The external auditor samples 25 accounts and finds seven whose last rotation was over 120 days ago despite a 90-day policy, and three checkouts with no approval record. Investigation shows: (a) the rotation report counts an account as compliant if any rotation succeeded in the period, ignoring accounts whose rotation failed and were retried; (b) 14 accounts are 'excluded' from the report by a filter added six months ago by a former administrator, with no change record; (c) the three unapproved checkouts used a service account's API, which bypasses the interactive approval workflow by design. Management wants to publish the 98% figure again next month.
1. Break down each discrepancy: is it a reporting defect, a control defect, or both?
Read the worked answer
All three are both, but the weighting differs.
(a) Rotation counting logic - reporting defect masking a control defect. Counting an account as compliant if any rotation succeeded in the period hides accounts whose current credential is stale because the latest rotation failed. An account that rotated on day 1 and failed on day 91 is reported compliant while carrying a 120-day-old password. The report is measuring 'did something happen' rather than 'is the credential currently within policy.' The control (rotation) is also failing for those accounts; the report simply conceals it.
(b) Hidden exclusion filter - control defect with a reporting cover-up. An undocumented filter silently removing 14 accounts from the population is the most serious finding. It means the reported denominator is wrong and the excluded accounts are unaudited. Whether or not the former administrator acted maliciously, the absence of a change record means the report cannot be trusted as a population. This is a governance and integrity failure.
(c) API checkouts bypassing approval - control defect, possibly by design but undocumented. If the service account's API path intentionally skips interactive approval, then the claim 'all privileged access had approvals' is false as stated. Either the API path should enforce an equivalent approval/authorization check, or the report must exclude and separately disclose API-originated access. Presenting it as approved access is a misstatement.
2. The auditor asks management to republish the 98% figure. What is your recommendation, and what should the corrected report contain?
Read the worked answer
Recommendation: do not republish the 98% figure. Publishing a number known to be computed from a filtered population, a flawed compliance test, and an unapproved access path would be a knowing misstatement to an external auditor. That converts a control gap into an integrity problem.
Corrected report should contain:
- A reconciled population. Remove or formally document the 14-account exclusion filter; disclose who added it, when, and why (or state that no record exists). Report the full managed population and any exclusions with justification.
- A point-in-time compliance test. Count an account as compliant only if its current credential's age is within policy. Separately report accounts with failed rotations and their retry status.
- Segmented access reporting. Report interactive checkouts and API/service-account access separately. For API access, state whether an approval-equivalent control exists; if not, disclose it as a gap with a remediation date.
- Exception detail. List the seven stale accounts and three unapproved checkouts by ID with root cause and remediation owner.
- A remediation plan with dates: fix the report logic, remove undocumented filters, add change control on report definitions, and either enforce approval on the API path or formally risk-accept it.
A lower, accurate number with a credible remediation plan is defensible. A high, unverifiable number is not - and once an auditor has found the discrepancy, republishing it invites a qualified opinion.