ITGC audit / Workpaper
Workpaper T-04: NS-IAM-04
SIMULATED. Fictional company Northstar Financial Technologies; synthetic data; no real audit.
| Field | Value |
|---|---|
| Control | NS-IAM-04 |
| Objective | Inappropriate access is detected and removed through quarterly user access reviews. |
| Audit period | 2026-01-01 to 2026-06-30 |
| Population | 10 quarterly reviews (5 in-scope systems x 2 quarters) |
| Method | None: 100% of the population tested by script |
| Evidence | EV-014, EV-015, EV-016, EV-017, EV-018, EV-019, EV-020, EV-021 (see evidence register) |
| Rule(s) applied | R-REV-01, R-REV-02, R-REV-03, R-REV-04, R-REV-05 |
| Preparer | Audit analyst (simulated) |
| Reviewer | Audit Manager (simulated role) |
Selection rationale
The full population was tested by script because the evidence is a complete system export and scripted re-performance costs no more than sampling. No sample was drawn, so there is no sampling error and no statistical assurance is claimed. Source tickets and screenshots behind each record were not inspected (synthetic data); in a real engagement a risk-based sample of source records would be inspected as well. Selected records: the whole population; exceptions are listed below.
Pass / fail / inconclusive criteria
Pass: exceptions are within the tolerable deviation rate. Fail: exceptions exceed it. Inconclusive: the evidence is incomplete or unreliable, so a conclusion cannot be supported (does not apply to this test).
Steps
- Obtain the review register (EV-014 to EV-018). 2. Confirm each review was completed by the due date. 3. Confirm the reviewer is independent of the access reviewed. 4. Re-perform completeness of the review population at quarter end. 5. Check that reviews that attested clean did not miss known leaver accounts.
Expected result
All reviews complete, on time, independent, complete in population and effective. Tolerable deviation: 5%.
Result
8 of 10 quarterly reviews failed (80.0%). Design review: The control does not require the reviewer to be independent of the access being reviewed, so a user can review (and attest) their own access.
Conclusion: Not operating effectively; design deficiency noted
Limitations
Review attestations were tested against data; the quality of the reviewers' individual decisions was not re-performed.
Exceptions (8)
| Rule | Record | Detail |
|---|---|---|
| R-REV-01 | UAR-SYS-03-2026-Q1 | UAR-SYS-03-2026-Q1: due 2026-04-30, not completed by extract date 2026-07-15 |
| R-REV-02 | UAR-SYS-01-2026-Q2 | UAR-SYS-01-2026-Q2: reviewer E0357 holds Admin access on SYS-01 (reviewed own access) |
| R-REV-03 | UAR-SYS-01-2026-Q1 | UAR-SYS-01-2026-Q1: completed 2026-07-10, 71 days after due 2026-04-30 |
| R-REV-04 | UAR-SYS-02-2026-Q2 | UAR-SYS-02-2026-Q2: attested 2026-07-07 but at least one terminated user's account remained Active (review did not detect it) |
| R-REV-04 | UAR-SYS-03-2026-Q2 | UAR-SYS-03-2026-Q2: attested 2026-07-07 but at least one terminated user's account remained Active (review did not detect it) |
| R-REV-04 | UAR-SYS-04-2026-Q1 | UAR-SYS-04-2026-Q1: attested 2026-04-08 but at least one terminated user's account remained Active (review did not detect it) |
| R-REV-04 | UAR-SYS-04-2026-Q2 | UAR-SYS-04-2026-Q2: attested 2026-07-14 but at least one terminated user's account remained Active (review did not detect it) |
| R-REV-05 | UAR-SYS-05-2026-Q1 | UAR-SYS-05-2026-Q1: reviewed 49 accounts; population at quarter end differs (incomplete review population) |
Design assessment
The control does not require the reviewer to be independent of the access being reviewed, so a user can review (and attest) their own access.
Reviewer notes
Reviewer role is simulated. This workpaper has not been independently reviewed by a human; the 'reviewer' field records who would review it in a real engagement.
Re-performance
Re-run with docker run --rm -v "$PWD":/work assurance-build python scripts/itgc_audit.py. Output is deterministic for the committed data.