Access review findings with a month-end deadline
A quarterly access review at a 900-person insurer found three things. Forty-one accounts on the claims system belong to leavers; twelve of those hold admin rights and show activity in the last 30 days. A shared account named claims_admin is used interactively by seven people, so individual actions cannot be attributed. A 2019 exception lets the claims team bypass MFA for a batch integration; the exception's owner has left the company. The audit committee meets in three weeks and the regulator expects evidence of remediation this quarter. Month-end processing, which depends on claims admin rights, is in 10 days. The claims director says removing admin rights now will stop month-end.
1. In what order do you remediate, and why that order rather than the order the findings are listed?
Read the worked answer
Order by evidence of live misuse, not by audit aesthetics
- The twelve leaver admin accounts with recent activity. This is the only finding with an active, unexplained access path. Investigate the activity before disabling, because the answer changes the remediation: if it is a person, you have a possible insider issue and a disciplinary route; if it is a scheduled job authenticating as a departed user, disabling it breaks a process and you need the service account ready first. Snapshot the logs either way - evidence disappears with the account.
- Then the remaining 29 leaver accounts. Lower risk (no admin, no activity) but cheap to close and it clears the bulk of the finding.
- Then the unowned MFA exception. An exception with no owner is an exception nobody is managing. It is fast to fix and it removes a standing authentication bypass, which no auditor will accept as "temporary" in its sixth year.
- The shared account last, because it is the one with a real dependency on month-end.
The listed order (41 / shared / exception) would put the cheapest work first and the active risk third.
2. The claims director says removing admin rights before month-end will break processing. How do you handle the shared account without either accepting the risk or causing an outage?
Read the worked answer
First, separate two different things hiding in one account:
- Interactive human use by seven people - the attribution problem.
- Batch/automated use for month-end - the dependency the director is worried about, and possibly the reason the account exists.
Then propose the smallest change that resolves attribution without touching the batch path:
- Identify what the seven actually do through claims_admin. Usually it is one or two privileged operations, not the whole admin surface. Grant those specific rights to their named accounts - that may be a permission change taking days, not a redesign.
- If that cannot be done in 10 days, do not force it. Instead: move the password into a vault with checkout and session recording, so every use is attributable and attributable now. That is a real control, not a promise.
- Freeze password changes and permission changes on that account until month-end completes, with a dated removal booked the week after.
What you must not do is accept "seven people need it" as a reason to leave it unmonitored through the deadline. Attribution can be achieved without changing who can do the work.
3. How do you present residual risk to the audit committee so it survives regulator scrutiny?
Read the worked answer
Split the report three ways, because collapsing them is what makes these reports unconvincing:
- Closed, with evidence. Accounts disabled, dates, counts, log extracts. Not "we have addressed" - artefacts.
- In progress, with dates and named owners. The shared account, with the vault control live now and full remediation dated after month-end. State the compensating control and how it will be verified.
- Residual, with an accepting owner and an expiry. Anything still open, signed by the person whose business carries the consequence - the claims director for the claims-system items - not by the security team.
Two things to get right:
- Do not present "41 leaver accounts" as a single finding. Split by whether there is evidence of misuse; the twelve with recent admin activity are a different conversation from the twenty-nine dormant ones, and lumping them together makes the whole report look inflated.
- Show the control that prevents recurrence, not just the cleanup: an automated HR-to-identity leaver feed and an exception register with mandatory expiry. The regulator is asking whether this will happen again, and 41 accounts is a symptom of a missing feed, not of a bad quarter.