ITGC audit / Workpaper
Workpaper T-01: NS-IAM-01
SIMULATED. Fictional company Northstar Financial Technologies; synthetic data; no real audit.
| Field | Value |
|---|---|
| Control | NS-IAM-01 |
| Objective | Access is granted only after documented approval. |
| Audit period | 2026-01-01 to 2026-06-30 |
| Population | 408 non-Admin accounts (all non-Admin accounts on SYS-01 to SYS-05 in the 2026-07-15 extract; Admin accounts are tested once, in T-08, so no account is counted in two tests) |
| Method | None: 100% of the population tested by script |
| Evidence | EV-001, EV-007 (see evidence register) |
| Rule(s) applied | R-IAM-06, R-IAM-07 |
| Preparer | Audit analyst (simulated) |
| Reviewer | Audit Manager (simulated role) |
Selection rationale
The full population was tested by script because the evidence is a complete system export and scripted re-performance costs no more than sampling. No sample was drawn, so there is no sampling error and no statistical assurance is claimed. Source tickets and screenshots behind each record were not inspected (synthetic data); in a real engagement a risk-based sample of source records would be inspected as well. Selected records: the whole population; exceptions are listed below.
Pass / fail / inconclusive criteria
Pass: exceptions are within the tolerable deviation rate. Fail: exceptions exceed it. Inconclusive: the evidence is incomplete or unreliable, so a conclusion cannot be supported (does not apply to this test).
Steps
- Obtain the identity extract (EV-001). 2. For every account confirm an approval ticket, approver and approval date exist. 3. Confirm the approval date is not later than the grant date.
Expected result
Every account has approval recorded on or before the grant date. Tolerable deviation: 5%.
Result
5 of 408 non-Admin accounts failed (1.2%)
Conclusion: Operating effectively with exceptions (within tolerance)
Limitations
The extract shows accounts that exist on 2026-07-15. Accounts created and deleted inside the period are not in the population. Approval tickets were not inspected in the ticketing system; existence of the reference was tested, not its content. Admin accounts are excluded here because T-08 tests their approval (NS-PAM-01).
Exceptions (5)
| Rule | Record | Detail |
|---|---|---|
| R-IAM-06 | A-0209 | SYS-03 access granted 2026-05-19 before approval 2026-05-20 |
| R-IAM-06 | A-0358 | SYS-04 access granted 2026-04-14 before approval 2026-04-16 |
| R-IAM-06 | A-0359 | SYS-04 access granted 2026-05-04 before approval 2026-05-05 |
| R-IAM-07 | A-0352 | SYS-04 Standard access has no approval ticket/approver/date |
| R-IAM-07 | A-0360 | SYS-04 Standard access has no approval ticket/approver/date |
Reviewer notes
Reviewer role is simulated. This workpaper has not been independently reviewed by a human; the 'reviewer' field records who would review it in a real engagement.
Re-performance
Re-run with docker run --rm -v "$PWD":/work assurance-build python scripts/itgc_audit.py. Output is deterministic for the committed data.