Privileged Access at a 4,200-User Bank: Nine Orphan Admins, a PAM Bypass, and a 99.6% Approval Rate
An auditor reviews identity and access management at a bank with 4,200 employees. Findings: 38 accounts hold domain administrator rights against a design baseline of 6; 9 of these belong to users terminated between 2 and 11 months ago; the privileged access management vault is deployed but 62% of privileged accounts are excluded through a legacy break-glass group whose membership is never reviewed; database administrator sessions on the core banking platform are not logged; the data loss prevention tool generates about 4,100 alerts per month, triaged by 2 analysts, and 78% are closed as expected business activity without a documented reason. Access recertification ran last year with 97% completion, but managers approved 99.6% of entitlements with an average review time of 40 seconds per user.
1. Rank the findings by risk and justify the ranking by consequence and exploitability rather than by count.
Read the worked answer
1. Nine enabled accounts belonging to terminated staff with domain administrator rights. This is the only finding where compromise may already have occurred and requires immediate containment, not a project plan. A domain admin account is a credential path to the entire estate, and a terminated holder has motive, time, and possibly retained knowledge of the environment. Disabling these accounts is an operational action this week, and the auditor should request confirmation before closing fieldwork. Risk: critical.
2. The unlogged database administrator sessions on the core banking platform. The effect is not merely missing evidence; it is that activities with the greatest potential for financial manipulation leave no trace and therefore cannot be detected or reconstructed. Where logging is absent, the auditor cannot conclude anything about the integrity of the data, which pushes reliance onto substantive testing. Risk: high.
3. The 62% PAM exclusion via an unreviewed break-glass group. This is a large-scale bypass of the principal control, with an obvious path from standard user to full privileged access. It ranks below the top two because it requires a bad actor to take steps, whereas orphan accounts are already sitting open. Risk: high.
4. The DLP programme at 4,100 alerts per month with undocumented closures. The tool is not detecting; it is generating noise that is dispositioned in bulk. The control exists on paper and provides little real protection, but no evidence of actual data loss has emerged. Risk: medium-high, trending up.
5. The recertification process producing 99.6% approvals in 40 seconds per user. This is the weakest control in the chain and the one that lets items 1 to 3 persist. It is not the highest-risk finding but it is the most important to fix structurally, because it is the reason the others keep recurring. Risk: medium, with high remediation leverage.
2. Conclude on the effectiveness of the access recertification control, and explain why the 97% completion figure is misleading.
Read the worked answer
Conclusion. The control is not operating effectively. It is a rubber stamp with a high completion rate, and the 97% figure measures activity rather than assurance.
Why the completion statistic is misleading. Completion measures whether a form was returned. The purpose of recertification is to determine whether each entitlement is still required. At 40 seconds per user, a manager cannot read an entitlement list, let alone evaluate it; that timeframe supports opening the report and clicking approve. A 99.6% approval rate is not plausible in an environment where this audit independently found 38 domain administrators against a baseline of 6 and nine orphaned accounts. The decisions and the facts are inconsistent, and where they conflict, the reviewed evidence wins over the reviewer's signature.
What the auditor can rely on. The control cannot be relied upon as designed for any key control purpose. The population approved by managers cannot be assumed appropriate; the auditor must obtain direct evidence through independent reconciliation against HR records and role definitions.
Why this matters more than the individual exceptions. This is the generative control. Every orphaned admin account, every break-glass exclusion, and every accumulated entitlement passed through recertification unchallenged. Fixing the nine accounts treats the symptom; the next departure will recreate it within a month unless this control changes.
What would make it effective. Risk-tiered review where privileged and sensitive entitlements require explicit justification and a second reviewer; removal of default approval; system-enforced review time and sampling by the security team; and reporting the number of entitlements revoked as a key measure, since zero revocations is itself the red flag.
3. Which metrics should go to the board, and what should the auditor insist on before the next review cycle?
Read the worked answer
Board metrics. Choose measures that show whether residual risk is shrinking and whether the control chain is working, and resist reporting activity volume.
- Count of enabled privileged accounts by tier, with additions and removals in the period. The current position is 38 against a baseline of 6; the trajectory matters more than the snapshot.
- Privileged accounts outside the PAM vault, as a percentage. Today that is 62% through the break-glass group. This single measure captures the bypass problem and cannot be gamed by adding accounts to a report.
- Accounts disabled within 24 hours of termination, as a percentage, tested by sampling. This is a direct, verifiable measure of joined-up identity lifecycle management.
- Coverage of privileged session logging on tier-1 systems, stated as an explicit list of which systems are logged and which are not. A percentage hides which one is missing.
- DLP alerts with a documented disposition and analyst hours per 1,000 alerts. The second half is the useful part: it shows whether the queue is sized to the tool's output.
- Entitlements revoked at recertification, and median review time per user. Zero revocations and 40 seconds tell the board more than 97% completion ever will.
Insist on before the next cycle. Written acceptance of risk for the nine orphaned accounts with containment evidence; a remediation plan and date for the break-glass group, including whether it can be eliminated rather than reviewed; and a re-designed recertification with a risk-based approach for privileged access, tested by the auditor before it is relied upon. Do not accept a commitment to improve DLP tuning as a substitute for addressing the two access findings.