Quarterly Access Review with a Nine-Day Orphan Account
Helio Health Cloud has 1,400 employees and 12,000 customer users. Its SOC 2 Security control A-4 states: 'Management reviews privileged access to production quarterly and removes inappropriate access within two business days.' For Q3, the IAM team generated a report of 86 privileged accounts. The review was performed by the platform director, but the only evidence is an email saying 'looks good' and a spreadsheet with no reviewer sign-off or date. In a sample of 25 terminations, one contractor's production admin account remained active for nine days after termination; the deprovisioning ticket shows the manager approved removal on day 2, but the IAM engineer missed it. The control owner wants to treat the nine-day gap as an isolated exception and issue the report without mention. The audit period ends in five weeks, and the control has operated this way for three quarters.
1. Evaluate the design and operating effectiveness of control A-4, including whether the evidence is sufficient.
Read the worked answer
The design is plausible but incomplete as written. The control combines two activities: a quarterly privileged-access review and timely removal of inappropriate access. The evidence does not show who reviewed the 86 accounts, what criteria were applied, whether the account listing was complete and accurate, or when the review was completed. An email saying 'looks good' and an unsigned spreadsheet do not demonstrate that a reviewer compared the population to approved access or followed up on exceptions. The population itself needs a system-generated source and a reconciliation to the identity provider.
Operating effectiveness is also weak. The termination sample found a nine-day orphan account against a two-business-day standard. That is an exception in operation, not merely a documentation gap. The control owner cannot decide to leave it out of the report. The auditor should evaluate the cause, whether the control objective was still met, and whether the exception is isolated or systemic. Because the same pattern has existed for three quarters, the auditor should expand testing rather than accept a single sample result. If the control is not operating effectively, management needs to remediate and the auditor may test the remediated control; a qualified opinion is possible if the deficiency is not fixed and pervasive.
2. How should the nine-day exception be treated in the report, and what remediation would you recommend?
Read the worked answer
The exception should be documented and evaluated, not suppressed. The first question is whether the control objective was achieved: a production admin account stayed active for nine days after termination, so the stated two-day objective was not met. The second question is pervasiveness: one contractor out of 25 is a single exception in the sample, but the manual handoff and the lack of monitoring suggest a control design weakness. The auditor should consider whether other terminations were missed, whether the account was used, and whether the contractor's access could reach customer data.
The report treatment depends on the auditor's conclusion. If the control is operating effectively despite an isolated exception, the exception may be described without qualification. If the control is not operating effectively, the opinion may be qualified, or management may remediate before period end and ask the auditor to test the new control. Remediation should include automated deprovisioning tied to the HR termination feed, a day-two reconciliation of terminated users to active accounts, and a named owner for exceptions. A spreadsheet of manual reminders is weaker. Management should also correct the control description so it does not promise a two-day removal that the process cannot reliably deliver.
3. What evidence should Helio collect for the next quarter to support A-4?
Read the worked answer
Helio should retain a system-generated privileged-account population with a timestamp and a reconciliation to the identity provider. The review evidence should show the reviewer, the review date, the criteria, the disposition of each account, and the approver. If the reviewer sampled accounts, the sample selection and population should be retained. Removal evidence should include the deprovisioning ticket, the timestamp of access removal, and confirmation from the system of record. For terminations, the population should come from HR, and the evidence should show the termination date, the ticket date, the removal date, and any exception.
The control owner should also maintain an exception log with root cause and corrective action. A quarterly review that only produces an email is not auditable. A short, signed review memo with attachments is better, and an automated workflow that blocks sign-off until every account is dispositioned is stronger. Finally, management should test the control itself before the auditor does, so it can fix gaps rather than discover them during fieldwork.