ITGC audit / Workpaper
Workpaper T-16: NS-LOG-02
SIMULATED. Fictional company Northstar Financial Technologies; synthetic data; no real audit.
| Field | Value |
|---|---|
| Control | NS-LOG-02 |
| Objective | Security alerts are reviewed weekly and high-severity alerts are escalated. |
| Audit period | 2026-01-01 to 2026-06-30 |
| Population | 25 weeks (each full week in the audit period) |
| Method | None: 100% of the population tested by script |
| Evidence | EV-006, EV-012, EV-026, EV-027, EV-028, EV-029, EV-030, EV-031 (see evidence register) |
| Rule(s) applied | R-LOG-01, R-LOG-02, R-LOG-03, R-LOG-04 |
| Preparer | Audit analyst (simulated) |
| Reviewer | Audit Manager (simulated role) |
Selection rationale
The full population was tested by script because the evidence is a complete system export and scripted re-performance costs no more than sampling. No sample was drawn, so there is no sampling error and no statistical assurance is claimed. Source tickets and screenshots behind each record were not inspected (synthetic data); in a real engagement a risk-based sample of source records would be inspected as well. Selected records: the whole population; exceptions are listed below.
Pass / fail / inconclusive criteria
Pass: exceptions are within the tolerable deviation rate. Fail: exceptions exceed it. Inconclusive: the evidence is incomplete or unreliable, so a conclusion cannot be supported (does not apply to this test).
Steps
- Obtain weekly alert review records (EV-006). 2. Confirm a review exists for every week. 3. Confirm timeliness (5 business days after week end). 4. Confirm high alerts were escalated. 5. Check for duplicated records.
Expected result
A timely, unique review for every week, with high alerts escalated. Tolerable deviation: 5%.
Result
8 of 25 weeks failed (32.0%). Design review: Escalation of high-severity alerts is left to analyst discretion rather than required, so the control can operate as written and still leave high alerts un-actioned.
Conclusion: Not operating effectively; design deficiency noted
Limitations
The recorded hash of the evidence file does not match its current hash, so the reliability of the records is reduced. Evidence EV-006: Log extract re-saved by the owner after collection.
Exceptions (8)
| Rule | Record | Detail |
|---|---|---|
| R-LOG-01 | 2026-03-02 | No alert review recorded for week starting 2026-03-02 |
| R-LOG-01 | 2026-04-13 | No alert review recorded for week starting 2026-04-13 |
| R-LOG-01 | 2026-04-20 | No alert review recorded for week starting 2026-04-20 |
| R-LOG-02 | LR-006 | Week 2026-02-09 reviewed 2026-03-04, 13 business days after week end (limit 5) |
| R-LOG-02 | LR-021 | Week 2026-05-25 reviewed 2026-06-22, 16 business days after week end (limit 5) |
| R-LOG-03 | LR-012 | Week 2026-03-23: 3 high-severity alerts, 0 escalated |
| R-LOG-03 | LR-023 | Week 2026-06-08: 2 high-severity alerts, 0 escalated |
| R-LOG-04 | LR-004D | Week 2026-01-26: record duplicates another review (same reviewer, counts and completion time) |
Design assessment
Escalation of high-severity alerts is left to analyst discretion rather than required, so the control can operate as written and still leave high alerts un-actioned.
Reviewer notes
Reviewer role is simulated. This workpaper has not been independently reviewed by a human; the 'reviewer' field records who would review it in a real engagement.
Re-performance
Re-run with docker run --rm -v "$PWD":/work assurance-build python scripts/itgc_audit.py. Output is deterministic for the committed data.