DRAFT. Classification: Internal. Prepared with corp-audit-evidence v1.0.0. Not signed off.
Privileged access audit. Internal Audit. Period 1 January to 30 June. Coordinator: Technology Risk Partner.
Summary
Four items: two located, one partial, one not located. Evidence due to auditor 14 November [S1].
Checklist
| Ref | Control | Evidence needed | Type | Period | Owner | Location | Status |
|---|---|---|---|---|---|---|---|
| R1 | AC-04 Access policy | Current approved policy | Policy | In force in period | Head of IAM | Controls Library | Located |
| R2 | AC-07 Monthly access review | Six signed reviews | Approval | Jan to Jun | IAM Manager | Access Review Records | Partial: May not located |
| R3 | AC-09 Admin account list | List with extraction detail | System report | At 30 June | Platform Lead | Unknown | Not located |
| R4 | AC-11 Joiner and leaver records | Population for auditor to sample | Population | Jan to Jun | HR Systems Lead | HR Records | Located |
Completeness and accuracy
R3: no extraction method supplied [UNVERIFIED: Platform Lead to state query, date and who ran it].
Sampling
Internal Audit selects samples. R4 provides the full population only.
Gaps
- R2 May review: not located. It matters because the control is monthly. Do not recreate it. IAM Manager to search, then Technology Risk Partner decides how to tell Internal Audit.
- R3: as above.
Questions for the auditor
R1: does "current" mean the version at 30 June, or today?
Change log
1 November, first version, Technology Risk Partner.
Sources. S1 Audit request list. S2 Control matrix. S3 Owners' notes on locations.
Sign-off. Technology Risk Partner: ____