ITGC audit / Workpaper
Workpaper T-06: NS-IAM-06
SIMULATED. Fictional company Northstar Financial Technologies; synthetic data; no real audit.
| Field | Value |
|---|---|
| Control | NS-IAM-06 |
| Objective | Unused access is removed. |
| Audit period | 2026-01-01 to 2026-06-30 |
| Population | 396 active accounts (accounts with status Active) |
| Method | None: 100% of the population tested by script |
| Evidence | n/a (see evidence register) |
| Rule(s) applied | R-IAM-09 |
| Preparer | Audit analyst (simulated) |
| Reviewer | Audit Manager (simulated role) |
Selection rationale
The full population was tested by script because the evidence is a complete system export and scripted re-performance costs no more than sampling. No sample was drawn, so there is no sampling error and no statistical assurance is claimed. Source tickets and screenshots behind each record were not inspected (synthetic data); in a real engagement a risk-based sample of source records would be inspected as well. Selected records: the whole population; exceptions are listed below.
Pass / fail / inconclusive criteria
Pass: exceptions are within the tolerable deviation rate. Fail: exceptions exceed it. Inconclusive: the evidence is incomplete or unreliable, so a conclusion cannot be supported (does not apply to this test).
Steps
- Compute days since last login at 2026-07-15. 2. For human accounts of current employees idle over 90 days, check for a documented exception. 3. Exclude employees on approved leave.
Expected result
No account idle over 90 days without a documented exception. Tolerable deviation: 5%.
Result
4 of 396 active accounts failed (1.0%)
Conclusion: Operating effectively with exceptions (within tolerance)
Limitations
Last login is taken from the extract and may not reflect non-interactive use.
Exceptions (4)
| Rule | Record | Detail |
|---|---|---|
| R-IAM-09 | A-0232 | SYS-04 account idle 194 days (limit 90); no exception reference |
| R-IAM-09 | A-0309 | SYS-04 account idle 193 days (limit 90); no exception reference |
| R-IAM-09 | A-0315 | SYS-04 account idle 161 days (limit 90); no exception reference |
| R-IAM-09 | A-0398 | SYS-05 account idle 124 days (limit 90); no exception reference |
Reviewer notes
Reviewer role is simulated. This workpaper has not been independently reviewed by a human; the 'reviewer' field records who would review it in a real engagement.
Re-performance
Re-run with docker run --rm -v "$PWD":/work assurance-build python scripts/itgc_audit.py. Output is deterministic for the committed data.