SOX · Azure Cloud Platform
ITGC-017 — Terminated user access removed within 3 business days
HR termination feed triggers access revocation; IT Operations disables accounts within three business days of the termination date.
Control attributes
- Type
- ITGC
- Nature
- Manual
- Frequency
- Ongoing
- Key control
- Yes
- Assertions
- All
- System
- Azure AD
- Owner
- IT Operations Lead
- SOX scope
- In scope
- Last tested
- Sep 10, FY26
- Testing status
- Deficiency
- Samples tested
- 35
- Exceptions
- 3
AI scoping reasoning
Morgan · Audit Manager Agent
In scope — 14 standing admin roles detected
Linked risk
R-02High
Cybersecurity breach affecting manufacturing systems
Standing privileged access in cloud tenant; OT/IT segmentation untested since FY24.
Evidence
1 requests
EV-2049Overdue
September HR termination report
Second follow-up sent. Testing of 8 samples blocked pending receipt.
Exceptions
1 identified
EX-117Concluded
Three terminated users retained access for 4, 9 and 11 days after termination.
Root cause: HR termination feed excludes contractor terminations processed outside Workday.
Population impact: 11 of 214 terminations in FY26 exceeded the 3-day standard.
Review notes
0 on this control
No open review notes.