Privileged Access After an Acquisition
Meridian Group acquired a 900-person logistics firm eight months ago and absorbed its identity estate. An internal audit has issued a finding with a 90-day remediation deadline. The findings: 47 active accounts hold domain administrator rights across the combined environment, of which 22 belong to staff at the acquired firm who have never logged in from a Meridian-managed device; 130 orphaned accounts remain enabled for departed contractors, including 9 service accounts with interactive logon permitted; and in the accounts payable workflow, 14 users can both create a vendor in the master file and approve payment runs, a segregation-of-duties conflict that predates the acquisition but was never remediated. The acquired firm's IT lead argues that removing administrator rights will break month-end close, which is 12 days away, and asks to defer.
1. Sequence the 90-day remediation and explain the ordering.
Read the worked answer
Order by time-to-exploit and reversibility, not by finding number.
Days 1–10: orphaned accounts and interactive service accounts. These require no negotiation and cannot break month-end - nobody owns them. Disabling 130 accounts plus removing interactive logon from 9 service accounts is reversible, auditable, and removes standing access that no business process needs. Highest return per hour of effort.
Days 10–30: the 22 dormant domain admins at the acquired firm. Not a blanket removal on day one: confirm ownership with the acquired IT lead, convert to just-in-time elevation for those with a genuine need, disable the rest. The 12-day month-end constraint is real, so pair the change with a tested break-glass path and rehearse it before cutover.
Days 30–90: the remaining 25 admins and the SoD conflict. Tier the admin model - domain admin only for directory work, delegated rights for everything else - and fix accounts payable by splitting the create and approve entitlements.
Deferring the whole finding for month-end is the wrong trade: three of the four sub-findings carry no close-related risk at all.
2. How should the segregation-of-duties conflict be resolved without halting payments?
Read the worked answer
The conflict is that one person can both create a vendor and approve payment to it - the classic fictitious-vendor path. Removing the entitlement outright from all 14 users risks close.
Workable sequence:
- Detect first. Run a report of payments in the last 12 months where the same user created the vendor and approved the run. This establishes whether the conflict has been exploited and converts a theoretical risk into a known quantity for the audit committee.
- Split by role. Determine which of the 14 genuinely need vendor creation (usually procurement or master-data) and which need approval (usually finance). Most can lose one side without any process impact.
- Compensating control where a split is impossible - typically a small team: mandatory second-person review of every new vendor before first payment, logged and sampled monthly.
- Detective backstop: quarterly duplicate-bank-detail and new-vendor screening until the design fix is in place.
The trade to state explicitly: a compensating review is slower and error-prone, so it is acceptable as a bridge with a dated end, not as a permanent answer.
3. What should the audit committee see at day 45 to judge whether this is on track?
Read the worked answer
They need evidence of closure and evidence of durability, not a percentage complete.
- Closed findings with counts: orphaned accounts disabled (target 130), interactive logon removed from service accounts (9), dormant admin accounts converted or disabled (22).
- Break-glass test result: date last tested, time to restore admin access, who holds the credentials. This is what the "it will break month-end" objection actually hinges on.
- Residual admin population: 47 trending to a stated target, with a justification on file for each retained admin.
- SoD exposure: number of payments historically made under conflicting entitlements, and the count of new vendors created since day 1 that have passed independent review.
- Recurrence control: is there an automated rule that flags re-creation of an orphaned account or a reintroduced conflict? Without it the finding will return in the next cycle, and the committee should be told that explicitly.