The Sample That Proved Nothing
A 900-user benefits system uses manual account provisioning: two administrators maintain a spreadsheet and receive a weekly HR termination feed by email. The control statement requires accounts be disabled within 24 hours of termination. The assessor is given a policy, a walkthrough, and a group membership screenshot dated eight months ago. Testing 12 terminated users finds 3 still active, one for 41 days. The system owner argues the control is 'substantially met' - 9 of 12 passed - and asks the assessor to record it as satisfied with a note, pointing out that re-testing costs two weeks and the authorization deadline is in 10 days.
1. Is the control satisfied? How do you record it?
Read the worked answer
Not satisfied. The control has a measurable requirement - disable within 24 hours - and the sample shows three failures, one at 41 days. A 25% failure rate in a small sample points to a process that does not operate, not to isolated error, and the weekly manual feed almost certainly explains it.
'Substantially met' is not an assessment status. The assessor records the control as other than satisfied, with a finding that states:
- what was tested and how (population, sample size, selection method);
- the observed result (3 of 12 active, maximum 41 days);
- the root cause as understood at the time (weekly manual feed, no reconciliation);
- the risk consequence (terminated users retained access to benefits data).
The eight-month-old screenshot is corroborating documentation at best; it is too stale to support any conclusion about current operation, and the assessor should say so.
2. What would change your conclusion, and what would you accept as interim mitigation?
Read the worked answer
The conclusion would change with evidence that the process, not just the outcomes, was fixed: an automated HR-to-directory feed with a documented 24-hour service level, a reconciliation report showing disablement timestamps, and a larger sample - including terminations from the most recent month - passing. Re-testing a fresh sample is the only way to demonstrate the fix; the deadline pressure is a scheduling problem, not evidence.
Interim mitigation is worth documenting even though it does not make the control satisfied: daily reconciliation against the HR roster, supervisor attestation for pending terminations, immediate disable-on-notice procedure, and a targeted review of the three accounts found active. These reduce exposure and may support an authorization with conditions, but the assessor should be explicit that mitigation lowers risk without changing the finding.
3. Does this single finding block authorization?
Read the worked answer
Not automatically. The AO weighs the finding's severity against the system's impact level, the data involved, and the credibility of the remediation plan. Terminated users retaining access to benefits data on a Moderate system is a real risk, but it is bounded and mitigable, and it is one control among many.
The realistic options are authorize with conditions and a POA&M milestone for the automated feed, a shortened authorization period, or denial if the AO judges the exposure unacceptable given the population served. The assessor's duty is to report the finding accurately and describe its magnitude; negotiating the status to hit a date corrupts the only input the AO has. If the report says 'satisfied with a note,' the AO is accepting a risk nobody described.