Access Review Control Fails Testing at a Shared Service Center
A financial-services shared service center runs quarterly access reviews for 1,200 users across three core systems. The control owner emails spreadsheets to line managers, who have five business days to confirm access. Last quarter, 98% of reviews were returned within two days, and internal audit selected 25 user-access changes for testing. It found three terminated contractors with active accounts, five reviews with no evidence of manager approval, and two cases where a manager approved their own access. Group policy requires quarterly review before quarter-end and retention of evidence for three years. The control owner proposes mandatory annual training and a reminder email. The audit committee asks whether the control can be relied upon and whether this is a significant deficiency.
1. Evaluate the test results and determine whether the control can be relied upon and whether the deficiency is significant. Show your reasoning.
Read the worked answer
The control cannot be relied upon as designed or operating effectively. The sample of 25 produced three terminated contractors with active accounts, five reviews without evidence of approval, and two self-approvals. That is ten exceptions, or 40% of the sample, if all are treated as control deviations. Even counting only the three terminated-user cases, the error rate is 12%, which is high for a key access control. The 98% on-time return rate is misleading: speed of return does not show that access was appropriate or that approval was independent. The missing evidence also means the control cannot be re-performed for those users.
The deficiency is likely significant, not merely a housekeeping issue, because access review is a primary detective control over inappropriate access in a financial-services environment. Terminated contractors retaining active accounts creates a potential unauthorized-access path, and self-approval removes segregation of duties. Whether it rises to a material weakness depends on compensating controls, such as an HR termination feed, automated de-provisioning, or authentication monitoring. The audit committee should require an assessment of those compensators. Until they are tested, the control should be treated as ineffective, with an interim manual review of terminated users and privileged accounts.
2. Identify the root causes and design remediation that addresses the process rather than only training.
Read the worked answer
The root causes are process design and accountability, not lack of awareness. Email spreadsheets create no enforced workflow, no identity-owner validation, and no automatic evidence retention. Managers can approve their own access because the tool does not check for conflicts. Terminated contractors remain active because the review is disconnected from HR and contractor termination data. The five missing approvals suggest that returns were counted without completeness checks. Annual training and a reminder email would not fix any of these; they assume the problem is knowledge when the control lacks enforcement.
Remediation should move the review into the identity and access management system or a workflow tool that assigns each user to a current manager, blocks self-approval, requires a decision for every user, timestamps approvals, and stores evidence for three years. Integrate HR and contractor termination feeds to disable accounts within a defined period, independent of the quarterly review. Add exception reports for users without a valid manager, dormant accounts, and privileged access. Define roles: system owners certify access, line managers confirm business need, and the control owner monitors completion and evidence. Set an escalation path for non-response. Track metrics such as percentage of users reviewed, exceptions cleared, and terminated users disabled within 24 hours.
3. Define validation testing and interim reliance steps before the audit committee accepts closure.
Read the worked answer
Validation should not rely on the control owner’s assurance. Internal audit or an independent control function should re-perform at least one full quarter after remediation. Test a sample of 25 to 30 users, including terminated employees and contractors, privileged accounts, and users who changed roles. Pass criteria should be zero active accounts for terminated users beyond the defined de-provisioning window, zero self-approvals, evidence of approval for 100% of sampled users, and evidence retained in the system. Also test the automated manager assignment and the termination feed interface, because those are the points where the old process failed.
In the interim, apply a compensating control: a monthly manual review of all terminated users and a sample of privileged accounts, performed by someone independent of the access-review process. Document the review and report exceptions to the audit committee monthly. The control owner should not close the finding until two consecutive quarters pass, or one quarter plus a successful re-performance, depending on the risk tolerance. The audit committee should receive the remediation plan with dates, the compensating-control results, and a clear statement that the original control was ineffective. If the compensating control also fails, escalate the deficiency severity and consider whether access to core systems should be restricted.