👁️User Access Review
🧭 Planning:
Quarterly access reviews assessed across high-risk systems (finance, HR).
🎯 Objectives:
-
Ensure periodic user access validation
-
Validate manager sign-offs and exception handling
📌 Procedures:
-
Reviewed Q1/Q2 access review logs
-
Verified reviewer identity and sign-off
-
Sampled 10 users per system for appropriateness
📑 Working Papers:
-
WP-ITGC-AR001: Access recertification control -
Access review calendars, approval logs
📊 Findings:
-
❗ Missed sign-offs in 2 of 4 departments
-
❗ Reviews conducted without system owner input
-
⚠️ Limited audit trail of post-review remediation
🧰 Tools Used:
Excel, email approvals, manager review sheets
✅ Recommendations:
-
Enforce system owner accountability
-
Use automated certification platforms
-
Establish escalation path for late reviews
