In any large organisation there are more open doors than people. Email, the ERP, the billing system, the tool one team bought for a project and nobody decommissioned. Doors pile up on their own with every new application, every joiner and every supplier granted access. Opening them is rarely the problem. The problem is that closing them has no owner.
That is why the access lifecycle is the area where findings repeat cycle after cycle. It does not ask for investment, it asks for order. And the order fits in four rules the auditor can test one by one.
- One account per person. If several people share a user, nobody answers for what is done with it and the trail cannot reconstruct who did what. Generic accounts that survive are a finding with a name on it.
- Second factor where it hurts. Email, remote access and anything reachable from outside the network need more than a password. The test is not the policy, it is real coverage across the user population.
- Leavers are revoked the same day. When someone goes, access closes that day, not when somebody remembers. A former employee's live account is the most avoidable door there is.
- Know who holds the master key. Privileged accounts should be countable, have an owner and be reviewed on a written cadence.
The question is not technical. Who can get in today, and who checks when somebody leaves.
The tests that leave evidence
The four rules fit on one page. What convinces a committee is the evidence that they hold.
- Joiners and leavers against HR. Take the period's leavers and check the revocation date in every critical system. The gap between the two dates is the metric, not a yes or no.
- Full population, not a convenient sample. The user census comes from the corporate directory, not from the list each manager sends. If the two do not reconcile, that difference is already the finding.
- Recertification with a traceable decision. Who reviewed, what they decided and what happened next. A campaign closed at a hundred per cent where nobody removed a single permission deserves a second look.
- Service and supplier accounts. They usually fall outside scope and they are the ones open the longest. Ask for owner, last rotation date and justification of the privileges.
None of those tests is hard. They are laborious, which is different, and that is why they end up at the end of the cycle or get settled with a small sample. That is exactly where the work becomes genuinely reviewable, when the whole population is cross-checked between systems and every exception keeps its source, as in what teams are going to audit this cycle.
An access control that works is not demonstrated with a signed policy. It is demonstrated with the date the last leaver was closed and the name of whoever checked it.
