Northbridge Mutual: Certification Fatigue After Acquisition
Northbridge Mutual, a 4,200-employee insurer, closed an acquisition that added 1,800 contractor identities and 2,300 new entitlements. Quarterly access certifications now cover 11,000 entitlements and take managers three weeks. Last quarter, 38% of manager decisions were 'approve all' completed in under 90 seconds. Internal audit found 14 users holding both claims adjudication and payment release rights for seven months, a segregation-of-duties conflict the ERP flags but nobody reviews. Orphaned accounts average 120 at any time. The IAM team proposes buying a new certification tool; the CISO has $150,000 and two engineers for 90 days and wants the audit finding closed, not a tool demo. HR data feeds are 30 days stale for contractors, and application owners cannot name who approves access to two core claims systems.
1. The IAM team argues the audit finding is a tooling gap. Evaluate that claim and identify the two interventions most likely to change the auditor's conclusion within 90 days, with your reasoning.
Read the worked answer
The tooling claim is weak. A new certification tool would accelerate campaign delivery but would not fix the three conditions the auditor actually tested: stale identity data, undefined accountable owners, and decisions made without context. Those are governance design failures, and automating them would produce faster but still unreliable evidence.
Intervention one: rescope certification by risk rather than certify all 11,000 entitlements. Put privileged access, payment release, claims adjudication, and any entitlement carrying an SoD flag into a quarterly Tier 1 campaign of roughly 1,500-2,000 items. Give reviewers last-login data, role context, the SoD flag, and a mandatory justification field. This directly addresses the 90-second bulk approvals because volume and ambiguity, not laziness alone, drive rubber-stamping.
Intervention two: make SoD preventive, not just reported. Add an SoD check to the provisioning workflow for the two conflicting rights, remediate the 14 users with documented compensating controls where removal breaks operations, and assign named application owners for the two claims systems within 30 days. A tool can support both, but the design decision and accountability sit with the business.
Supporting fixes: daily contractor HR feed and a 5-day removal SLA for leavers. Success evidence is fewer certifications with higher-quality decisions, not more campaigns.
2. Design the next quarterly certification campaign. Specify population, reviewers, evidence presented, and pass thresholds, and explain the trade-offs in your scoping choice.
Read the worked answer
Population: Tier 1 covers all privileged accounts, all entitlements in the claims and payment systems, all contractor access, and every entitlement with an SoD flag. Estimate about 2,000 entitlements rather than 11,000. Tier 2, covering remaining high-risk applications, is certified semi-annually; low-risk standard roles move to annual attestation with analytics on unused access.
Reviewers: the line manager certifies business need; the application owner co-certifies for Tier 1 systems because managers cannot judge technical entitlement risk alone. Contractor access requires both the sponsoring manager and the vendor manager. This dual sign-off is slower but creates the accountability the audit found missing.
Evidence per line item: entitlement description in business language, mapped role, last authentication date, SoD conflict indicator, employment or contract status, and prior decision. Reviewers must select approve, revoke, or modify and enter a justification; bulk approval is disabled for Tier 1.
Thresholds: 100% of Tier 1 decisions completed by the deadline; no more than 5% of decisions left without justification; 100% of revocations executed within five business days; 100% of SoD items either remediated or covered by an approved compensating control; manager completion above 95% with escalation at day 10.
Trade-off: narrower scope can miss slow accumulation of low-risk access. Mitigate with quarterly analytics for dormant and unused entitlements and a risk score that promotes anything anomalous into Tier 1. The design trades breadth for defensible decisions.
3. What evidence pack would you give the auditor to support closing the finding, and what residual risk would you disclose?
Read the worked answer
The evidence pack should map to the finding's criteria rather than to project activity. Include: the revised access certification standard showing risk tiering and reviewer roles; the Tier 1 campaign report with population counts, completion, justification rates, and a random sample of 25 decisions traced from reviewer input to provisioning change; remediation tickets for the 14 SoD users with removal dates or signed compensating controls; the provisioning workflow configuration showing the preventive SoD rule; orphan-account cleanup reports before and after; the contractor HR feed SLA and leaver-removal metrics for the quarter; and a management assertion naming accountable owners for the claims systems.
Add a walkthrough: pick three entitlements, show the hire or transfer event, approval, provisioning, certification decision, and later revocation. Auditors test operating effectiveness, so a clean sample with timestamps and named approvers matters more than a tool screenshot.
Residual risk to disclose: application ownership for two claims systems may remain part-time; HR data quality outside the contractor feed is inconsistent; low-risk entitlements certified annually could hide accumulated access; the 14 remediated users may need temporary compensating controls that must be revalidated quarterly; and tooling limitations mean a small number of legacy entitlements lack reliable last-login data. State the monitoring plan and the date of the next independent sample. Disclosing these is stronger than claiming zero residual risk.