Forty-Six Percent Attrition and a Leaver List Nobody Owns
Halcyon Support Group runs three contact centres - Manila, Bucharest and Leeds - handling payment-card disputes for 14 banking clients, with 900 agents and 46% annual attrition. Provisioning runs on email approvals: a team leader emails the service desk, which creates an account using a default password derived from the employee number. HR knows exit dates, but the leaver checklist is a shared spreadsheet updated 'when someone remembers'. A reconciliation sample found 61 active accounts belonging to people who had left, the oldest 11 months after departure. Agency contractors get the same access as employees after two days of shadowing, with background verification limited to a self-declaration. Awareness training completion is 51%, and after a fake 'payslip available' campaign the phishing click rate rose from 9% to 23%. One banking client's contractual security schedule requires annual evidence of background screening for everyone with access to cardholder data, and that client's audit is in eight weeks. The service desk manager argues that none of this is a security problem because 'the accounts are only used from our network'.
1. Prioritise the findings. Justify the ordering using threat, exposure and impact rather than severity labels, and address the service desk manager's argument.
Read the worked answer
Ranking, with reasoning:
- Sixty-one live accounts for departed staff. These are credentials that should not exist, tied to identities nobody is monitoring, on a network that handles cardholder data. Exposure is immediate and detection is poor, because a login by a legitimate-looking account generates no anomaly. Impact is high: dispute data plus client trust. The manager's 'only from our network' argument fails because an insider or an ex-employee with a colleague's help, a shared workstation, or a compromised internal host is exactly the threat this control exists for - network location is not an identity control.
- Default passwords derived from employee numbers. This is a predictable credential scheme, so the 61 accounts are not merely dormant - they are guessable by anyone who knows a name and the numbering convention. That converts a dormant-account problem into a live compromise path.
- Screening gap for contractors. Lower direct technical exploitability, but it is a contractual breach with a dated audit, and screening failures in a cardholder-data environment are precisely what the client is buying assurance against. Treat the commercial and compliance impact as part of the risk, not as a separate problem.
- Awareness at 51% and a 23% payslip click rate. This is a genuine risk signal but a slow-moving one, and it is partly a symptom: staff who cannot get a password reset through a coherent process will click anything that promises one.
Ordering rationale: combine blast radius with detectability. Items 1 and 2 are exploitable now and quiet; item 3 is serious but slower; item 4 amplifies the others.
2. Map the findings to the relevant organisational and people controls, and identify the single root cause that makes several of those controls unimplementable.
Read the worked answer
Mapping:
- 61 live accounts → 5.18 (access rights) and 5.16 (identity management): rights are not reviewed or removed on a defined trigger. Also 8.2 if any held elevated rights.
- Default employee-number passwords → 5.17 (authentication information): distribution and reset method is predictable and shared knowledge.
- Email-only provisioning → 5.15 (access control) and 5.3 (segregation of duties): the requester, approver and administrator are effectively the same informal chain.
- Contractor screening → 6.1 (screening), reinforced by 7.1 (terms and conditions of employment, which must extend to agency staff) and 6.6 (confidentiality agreements).
- Leaver checklist → 6.5 (responsibilities after termination) and 5.18.
- Awareness and phishing → 7.3 (awareness, education and training) and 6.8 (reporting of events) - note the phishing report rate is the more useful signal.
- Client evidence requirement → 5.36 (compliance with contractual requirements) and 5.19–5.22 for the staffing agency as a supplier.
The single root cause: there is no authoritative, automated identity feed from HR to the service desk. Provisioning is event-driven by email and deprovisioning by memory, so 5.18 and 6.5 cannot operate as controls no matter how diligent people are. Every other fix is cosmetic until the lifecycle has a system of record. The corollary is that awareness training is being used to compensate for a broken process, which is why completion is low and clicks are high - staff work around a process they do not trust.
3. Design an eight-week remediation that gives the client auditor credible evidence. Be explicit about what you will fix, what you will disclose as residual, and why you will not promise everything.
Read the worked answer
Weeks 1–2 - stop the bleeding. Reconcile the HR roster against the directory, disable the 61 accounts and any other unmatched identities, and record the reconciliation method and counts. Force a credential reset for every agent account, remove the employee-number scheme, and set a minimum authentication standard. Evidence: reconciliation report, disablement log, reset completion figure.
Weeks 2–4 - build the lifecycle. Implement an HR-to-identity feed with a defined leaver trigger and a deprovisioning service level (for example, same day by 18:00 local). Add quarterly access reviews with named approvers by role. Replace email-only provisioning with a role-based request catalogue for the three core agent profiles. Evidence: feed configuration, service-level report for the weeks since go-live, review records.
Weeks 3–6 - screening and agency terms. Backfill screening for all cardholder-data access holders, prioritising contractors; obtain contractual flow-down obligations from the staffing agency including notification of removals; amend terms to include confidentiality and acceptable use. Evidence: screening register with dates and outcomes, agency contract schedule.
Weeks 4–8 - awareness with a real signal. Retarget training at the things that actually get clicked (payslip, password-reset lures), require completion as a condition of system access, and measure both click rate and report rate on a second simulation. Do not promise a click rate target in eight weeks.
What I would disclose rather than claim: awareness completion will not be 100% and the phishing metric is a trend, not an outcome. The audit response should present the root cause, the remediation plan with owners and dates, and the residual risk accepted by a named owner. Claiming full compliance at week eight would be the least credible option available.