ITGC audit / Workpaper
Workpaper T-03: NS-IAM-03
SIMULATED. Fictional company Northstar Financial Technologies; synthetic data; no real audit.
| Field | Value |
|---|---|
| Control | NS-IAM-03 |
| Objective | Access follows role changes. |
| Audit period | 2026-01-01 to 2026-06-30 |
| Population | 13 mover accounts (active accounts of employees with a recorded department transfer) |
| Method | None: 100% of the population tested by script |
| Evidence | n/a (see evidence register) |
| Rule(s) applied | R-IAM-08 |
| Preparer | Audit analyst (simulated) |
| Reviewer | Audit Manager (simulated role) |
Selection rationale
The full population was tested by script because the evidence is a complete system export and scripted re-performance costs no more than sampling. No sample was drawn, so there is no sampling error and no statistical assurance is claimed. Source tickets and screenshots behind each record were not inspected (synthetic data); in a real engagement a risk-based sample of source records would be inspected as well. Selected records: the whole population; exceptions are listed below.
Pass / fail / inconclusive criteria
Pass: exceptions are within the tolerable deviation rate. Fail: exceptions exceed it. Inconclusive: the evidence is incomplete or unreliable, so a conclusion cannot be supported (does not apply to this test).
Steps
- List employees with a transfer date. 2. For transfers more than 30 days before 2026-07-15, compare each active account's system with the entitlement map for the new department. 3. Check for a documented exception reference.
Expected result
No access remains that belongs only to the previous department, unless a documented exception exists. Tolerable deviation: 5%.
Result
2 of 13 mover accounts failed (15.4%)
Conclusion: Not operating effectively
Limitations
The entitlement map is the fictional policy in data/reference/policy-parameters.json. A real audit would confirm it with role owners.
Exceptions (2)
| Rule | Record | Detail |
|---|---|---|
| R-IAM-08 | A-0039 | SYS-01 access retained after move Customer Support to Finance on 2026-03-23; no exception reference |
| R-IAM-08 | A-0102 | SYS-02 access retained after move Operations to Risk and Compliance on 2026-04-17; no exception reference |
Reviewer notes
Reviewer role is simulated. This workpaper has not been independently reviewed by a human; the 'reviewer' field records who would review it in a real engagement.
Re-performance
Re-run with docker run --rm -v "$PWD":/work assurance-build python scripts/itgc_audit.py. Output is deterministic for the committed data.