ITGC audit / Workpaper
Workpaper T-05: NS-IAM-05
SIMULATED. Fictional company Northstar Financial Technologies; synthetic data; no real audit.
| Field | Value |
|---|---|
| Control | NS-IAM-05 |
| Objective | Service accounts are accountable to a named, current owner. |
| Audit period | 2026-01-01 to 2026-06-30 |
| Population | 14 service accounts (all service accounts in the identity extract) |
| Method | None: 100% of the population tested by script |
| Evidence | n/a (see evidence register) |
| Rule(s) applied | R-IAM-03 |
| Preparer | Audit analyst (simulated) |
| Reviewer | Audit Manager (simulated role) |
Selection rationale
The full population was tested by script because the evidence is a complete system export and scripted re-performance costs no more than sampling. No sample was drawn, so there is no sampling error and no statistical assurance is claimed. Source tickets and screenshots behind each record were not inspected (synthetic data); in a real engagement a risk-based sample of source records would be inspected as well. Selected records: the whole population; exceptions are listed below.
Pass / fail / inconclusive criteria
Pass: exceptions are within the tolerable deviation rate. Fail: exceptions exceed it. Inconclusive: the evidence is incomplete or unreliable, so a conclusion cannot be supported (does not apply to this test).
Steps
- List service accounts. 2. Confirm an owner is recorded. 3. Confirm the owner is a current employee.
Expected result
Every service account has a named owner who is still employed. Tolerable deviation: 0%.
Result
4 of 14 service accounts failed (28.6%). Design review: The owner is recorded at creation only; there is no periodic owner recertification and no process to reassign accounts when an owner leaves, so ownership decays by design.
Conclusion: Not operating effectively; design deficiency noted
Limitations
Population is small; one exception is a large percentage.
Exceptions (4)
| Rule | Record | Detail |
|---|---|---|
| R-IAM-03 | A-0146 | SYS-02 service account A-0146: no owner recorded |
| R-IAM-03 | A-0147 | SYS-02 service account A-0147: owner E0024 is terminated (2026-06-03) |
| R-IAM-03 | A-0211 | SYS-03 service account A-0211: no owner recorded |
| R-IAM-03 | A-0424 | SYS-05 service account A-0424: no owner recorded |
Design assessment
The owner is recorded at creation only; there is no periodic owner recertification and no process to reassign accounts when an owner leaves, so ownership decays by design.
Reviewer notes
Reviewer role is simulated. This workpaper has not been independently reviewed by a human; the 'reviewer' field records who would review it in a real engagement.
Re-performance
Re-run with docker run --rm -v "$PWD":/work assurance-build python scripts/itgc_audit.py. Output is deterministic for the committed data.