ITGC audit / Workpaper
Workpaper T-02: NS-IAM-02
SIMULATED. Fictional company Northstar Financial Technologies; synthetic data; no real audit.
| Field | Value |
|---|---|
| Control | NS-IAM-02 |
| Objective | Access of leavers is removed within 2 business days. |
| Audit period | 2026-01-01 to 2026-06-30 |
| Population | 35 leaver accounts (accounts held by employees with employment status Terminated) |
| Method | None: 100% of the population tested by script |
| Evidence | EV-002, EV-009 (see evidence register) |
| Rule(s) applied | R-IAM-01, R-IAM-02 |
| Preparer | Audit analyst (simulated) |
| Reviewer | Audit Manager (simulated role) |
Selection rationale
The full population was tested by script because the evidence is a complete system export and scripted re-performance costs no more than sampling. No sample was drawn, so there is no sampling error and no statistical assurance is claimed. Source tickets and screenshots behind each record were not inspected (synthetic data); in a real engagement a risk-based sample of source records would be inspected as well. Selected records: the whole population; exceptions are listed below.
Pass / fail / inconclusive criteria
Pass: exceptions are within the tolerable deviation rate. Fail: exceptions exceed it. Inconclusive: the evidence is incomplete or unreliable, so a conclusion cannot be supported (does not apply to this test).
Steps
- Obtain terminations from HR (EV-002) and the identity extract (EV-001). 2. Match accounts to terminated employees. 3. Compare the disable date with the termination date in business days. 4. For accounts still active, compare last login with the termination date.
Expected result
Every leaver account disabled within 2 business days of termination. Tolerable deviation: 0%.
Result
8 of 35 leaver accounts failed (22.9%)
Conclusion: Not operating effectively
Limitations
The HR termination list (EV-002) is stated to exclude terminations before 2026-02-01. Accounts of earlier leavers that appear in the employee master were still tested, but completeness of the early-2026 leaver population cannot be confirmed. Evidence EV-002: HR states the list excludes terminations before 2026-02-01.
Exceptions (8)
| Rule | Record | Detail |
|---|---|---|
| R-IAM-01 | A-0132 | SYS-02 Payments Console Admin account still Active; employee E0360 terminated 2026-04-24; last login 2026-04-30 is 6 days AFTER termination |
| R-IAM-01 | A-0171 | SYS-03 Ledger Accountant account still Active; employee E0199 terminated 2026-05-29 |
| R-IAM-01 | A-0218 | SYS-04 Reviewer account still Active; employee E0022 terminated 2026-03-20 |
| R-IAM-01 | A-0329 | SYS-04 Developer account still Active; employee E0354 terminated 2026-02-13 |
| R-IAM-02 | A-0038 | SYS-01 account disabled 2026-02-10, 7 business days after termination 2026-01-30 (limit 2) |
| R-IAM-02 | A-0106 | SYS-02 account disabled 2026-03-23, 11 business days after termination 2026-03-06 (limit 2) |
| R-IAM-02 | A-0286 | SYS-04 account disabled 2026-05-01, 15 business days after termination 2026-04-10 (limit 2) |
| R-IAM-02 | A-0397 | SYS-05 account disabled 2026-05-01, 15 business days after termination 2026-04-10 (limit 2) |
Reviewer notes
Reviewer role is simulated. This workpaper has not been independently reviewed by a human; the 'reviewer' field records who would review it in a real engagement.
Re-performance
Re-run with docker run --rm -v "$PWD":/work assurance-build python scripts/itgc_audit.py. Output is deterministic for the committed data.