User Access Provisioning and Quarterly Access Reviews: ITGC Testing Steps

Access to programs and data is one of the four IT general control areas the SEC's interpretive guidance gives as examples that may be relevant to ICFR, alongside program development, program changes and computer operations. It is also where automated controls and manual controls meet: a three-way match configuration means little if anyone can change it. This post sets out the control set and a test program with a worked review.

Why access matters for ICFR

The SEC guidance says IT general controls alone ordinarily do not adequately address financial reporting risks, but that proper and consistent operation of automated controls often depends on them. Management needs to evaluate only those ITGCs necessary for the proper and consistent operation of other controls that address financial reporting risks. So the scope starts from the key controls and the applications and data they rely on, then moves to who can change them.

NIST's Cybersecurity Framework 2.0 states the expectation in subcategory PR.AA-05: access permissions, entitlements and authorizations are defined in a policy, managed, enforced and reviewed, and incorporate the principles of least privilege and separation of duties. Adjacent subcategories cover managing identities and credentials (PR.AA-01), proofing identities (PR.AA-02), authentication (PR.AA-03) and managing physical access (PR.AA-06).

Control set

Test program

1. Population. Obtain the complete user list directly from the system with a query run or witnessed by the tester, not from the administrator's spreadsheet. Agree record counts to a second source. Standard 14.1 Gathering Information for Analyses and Evaluation says reliability is strengthened when information is obtained directly by an internal auditor or from an independent source.
2. New access. Sample users added in the period; trace to approved request and role.
3. Leavers. Compare the HR termination list to the user list; for each match, compare termination date to deprovisioning date and check for login activity after termination.
4. Privileged access. List admins and super-users; confirm business need and independence from the business users they support.
5. Access review. Obtain the review, confirm it covered the full population and included entitlements, check the reviewer was independent of the access owner, and track each removal request to completion.
6. Re-run the conflicts test.

Worked example

An ERP has 340 active users. The quarterly review was signed by the IT director each quarter.

• Completeness. The user report the reviewers received had 318 users. The system has 340. The 22 missing were service accounts and users created through an integration, none reviewed.
• Leavers. Of 41 terminated employees in the year, 6 retained active accounts for between 12 and 94 days; 2 logged in after termination. One of the two had payment approval authority.
• Privileged access. Seven administrators, three of whom are also business users with posting rights.
• Review quality. Reviewers approved all 318 entitlements with no removals in four quarters.

Conclusions: AC-03 not effective; AC-05 not effective because the review did not cover the full population and produced no actions; AC-04 deficient in design. The post-termination logins are an exception to investigate for transactions, not only a control deficiency. For SEC registrants, the finding is then evaluated for ICFR effect: which automated and IT-dependent controls rely on this system, and whether compensating controls exist. See /us/blog/compensating-controls-precision-and-when-they-reduce-deficiency-severity.

Scoping to the key applications

Not every application needs the full set. Rank applications by the key controls and reports they support: ERP, payroll, banking portals, consolidation tools, the data warehouse behind key reports. See /us/blog/ipe-and-it-dependent-controls-testing-reports-used-in-key-controls for report dependence. Document why lower-risk applications are out of scope.

Cloud and outsourced applications

Where the application runs at a third party, access to the application remains the company's responsibility, while infrastructure controls sit with the provider. The provider's service organization report may cover its side. See /us/blog/third-party-and-service-organization-risk-in-icfr-and-internal-audit.

Related reading

• /us/glossary/user-access-review
• /us/glossary/it-general-controls
• /us/blog/it-audit-guide-itgc-program-and-checklist

Mistakes to avoid

• Reviewing a list produced by the people being reviewed.
• Reviewing users without entitlements.
• Accepting a bulk approval with no removals as evidence of effectiveness.
• Leaving service and integration accounts out of the population.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• SEC, Release No. 33-8810, Section II.A.1.d, Role of Information Technology General Controls: https://www.sec.gov/rules/interp/2007/33-8810.pdf
• NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024), PR.AA-01 to PR.AA-06: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
• The IIA, Global Internal Audit Standards (2024), Standard 14.1 Gathering Information for Analyses and Evaluation: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error