Access management controls
Access management controls require that an organization ensures only authorized individuals have access to systems and data affecting financial reporting. The goal is to prevent unauthorized changes, fraud, or errors by restricting system permissions to the minimum necessary for a user's job function.
What it means
In practice, these controls focus on the lifecycle of a user's identity within "in-scope" systems—those that house financial data or impact the integrity of financial statements. This includes everything from the initial request for access to the final removal of permissions upon termination.
The primary intent is to enforce the principle of least privilege and segregation of duties (SoD). For example, a person who can initiate a payment should not also be the person who approves it within the same system.
Scope typically extends beyond just software applications; it includes the underlying databases, operating systems, and network infrastructure that support those financial applications. If an administrator can bypass application controls via the database, that access must also be managed and monitored.
How to meet it
- Establish a formal request and approval process for all new access or changes to existing permissions, requiring sign-off from both the manager and the system owner.
- Implement a standardized offboarding process that triggers the immediate revocation of all system access upon an employee's termination or role change.
- Conduct periodic user access reviews (typically quarterly or semi-annually) where managers certify that current access levels remain appropriate for their staff.
- Enforce strong authentication mechanisms, such as Multi-Factor Authentication (MFA), particularly for privileged administrative accounts and remote access.
- Maintain a matrix of roles and permissions to ensure segregation of duties is maintained across financial processes.
- Limit the number of users with "Super User" or Administrative privileges and require these accounts to be used only for specific maintenance tasks.
Evidence an auditor asks for
- A sample of new hire or transfer tickets showing the request, the business justification, and the timestamped approval from management.
- Completed user access review logs (certifications) signed by managers proving they reviewed and validated permissions during the audit period.
- A "termination report" from HR cross-referenced against system disablement timestamps to prove access was revoked in a timely manner.
- Current lists of users with administrative privileges, along with evidence that these accounts are periodically audited.
Common pitfalls
- Failure to remove access for terminated employees promptly, leading to "ghost accounts."
- Performing access reviews as a "rubber stamp" exercise without actual verification, which is often detectable via timestamps or lack of changes.
- Lack of documentation for emergency access (firecall IDs), where temporary high-level permissions are granted but never revoked or logged.
- Over-reliance on generic or shared accounts, making it impossible to attribute specific actions to a single individual.