Access Review Exceptions in a Retail Bank
A retail bank runs a quarterly access review over its core banking platform. The population is 4,200 active users. The control owner selects a sample of 25 user-role combinations for audit testing. Audit finds three exceptions: (1) a terminated contractor retained active access for 11 days after termination; (2) a branch manager approved a role mismatch because the user “needed to cover” for a colleague; (3) one reviewer approved 60 accounts in four minutes without evidence of checking. The control description says reviews must be performed by role owners with appropriate knowledge and completed within five business days of quarter-end. The bank has a mature identity management tool but no automated reconciliation between HR termination feeds and the core platform. Management argues the exceptions are “human error” and that the control is otherwise effective. The audit committee wants to know whether reliance can be placed on the control for the financial statement audit.
1. Evaluate whether the access review control can be concluded effective based on 25 samples and 3 exceptions.
Read the worked answer
It should not be concluded effective on this evidence. Three exceptions in 25 items is a 12% deviation rate, which is high for a manual key control, and the nature of the exceptions matters more than the count. Retaining terminated contractor access for 11 days is a direct segregation and security failure. A manager approving a role mismatch outside the control description shows the review can be overridden informally. A reviewer approving 60 accounts in four minutes suggests the review was not performed with appropriate diligence.
Management’s “human error” explanation is not sufficient. The control depends on human judgment, so human error is a control risk, not an excuse. The absence of automated reconciliation between HR and the core platform makes timely termination evidence unreliable. Before concluding, expand testing to determine whether the exceptions are isolated or systemic. If the expanded sample continues to show deviations, conclude the control is not operating effectively and assess the impact on the financial statement audit, including whether compensating controls or substantive procedures are needed. Document the deviation rate, root cause, and qualitative factors.
2. What additional procedures would you perform and how would you project the error?
Read the worked answer
Expand the sample to at least 60 items using a risk-based selection: include all terminated users in the quarter, all privileged accounts, all role changes, and a random sample of remaining users. Investigate the three known exceptions to root cause by reviewing HR termination dates, identity management logs, approval trails, and reviewer activity logs. Determine whether the reviewer who processed 60 accounts in four minutes had delegated or rubber-stamped the review, and whether other reviewers show similar patterns.
Project the error using attribute sampling. If the expanded sample of 60 has, say, six deviations, the observed rate is 10%; calculate the upper confidence limit at the desired confidence level to bound the population deviation rate. Do not simply extrapolate the 12% from 25 items without acknowledging sampling uncertainty. Separately assess the terminated-user exception against the full termination population, because it is a critical exception that may require a 100% review. Consider compensating controls, such as detective log monitoring, but do not offset a key control failure unless the compensating control is tested and timely. Report both the projected rate and the qualitative severity.
3. Draft the finding elements: condition, criteria, cause, effect, recommendation.
Read the worked answer
Condition: In a sample of 25 user-role combinations, three access review exceptions occurred: one terminated contractor retained access for 11 days; one manager approved a role mismatch outside the control; one reviewer approved 60 accounts in four minutes without evidence of review. Criteria: the control requires role owners with appropriate knowledge to review access within five business days of quarter-end, and bank policy requires timely removal of terminated users.
Cause: the review is manual, reviewer diligence is not monitored, role owners can approve exceptions informally, and there is no automated reconciliation between HR termination feeds and the core platform. Effect: unauthorized or excessive access may persist, increasing the risk of inappropriate transactions, data exposure, and unreliable financial reporting; the control cannot be relied upon for the audit.
Recommendation: implement automated HR-to-core reconciliation for terminations, require role-based review with system-enforced scope, monitor reviewer activity for anomalous approval speed, require documented justification and security approval for role mismatches, and re-perform the review for the current quarter with evidence retained. Management should report remediation progress to the audit committee.