Control · ACC-02
User access provisioning is approved before grant
Access ControlSOC 2 · ISO 27001 · ITGC · RBIRisk High
Requirement to validation
Requirement
ISO-A.5.15 · ISO-A.5.18 · ITGC-AM-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.2
mapped
Policy
Access Control Policy
pol-access
Control
ACC-02
User access provisioning is approved before grant
Application
Microsoft Entra ID · SAP S/4HANA · ServiceNow ITSM
mapped
Evidence · Q3
6 items
6 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-ITGC-ACC-02 · High confidence
Finding
F-IAQ2-ACC-02 · High
Closed
Action
Ananya Rao
REM-F-IAQ2-ACC-02 · Closed
Validation
Validated
as recorded
What should be true
Access to in-scope applications is provisioned only after line-manager and application-owner approval recorded in ServiceNow / Entra access packages.
- Requirements
- ISO-A.5.15 A.5.15 · Access controlISO-A.5.18 A.5.18 · Access rightsITGC-AM-01 ITGC-AM-01 · Access provisioning and de-provisioning is authorized and timelyRBI-ITGRCA-2023-7.1 RBI-ITGRCA-2023 §7.1 · Access control — least privilege, privileged access management, periodic review (RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023)SOC2-CC6.2 CC6.2 · User registration and authorization prior to issuing credentials
- Applications
- Microsoft Entra IDSAP S/4HANAServiceNow ITSM
- Third parties
- —
- Testing procedure
- Entra access packages with approval stages; SAP GRC access request workflow. Tests: Microsoft Entra ID: Access package assignments have approval; SAP S/4HANA: SAP role assignments trace to approved request; ServiceNow ITSM: Access request tickets approved. Frequency on-demand.
Findings (1)
| Finding | Observation | Control | Applications | Severity | Status | Owner | Action | Validation |
|---|---|---|---|---|---|---|---|---|
| F-IAQ2-ACC-02 | Access granted in SAP without recorded approval | ACC-02 | Microsoft Entra ID, SAP S/4HANA, ServiceNow ITSM | High | Closed | Ananya Rao | REM-F-IAQ2-ACC-02 · Closed | Validated |
Evidence (8)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-001 | Microsoft Entra ID: Access package assignments have approval | ACC-02 | Microsoft Entra ID | 9 Oct 2026 | Accepted |
| ITGC-REQ-002 | SAP S/4HANA: SAP role assignments trace to approved request | ACC-02 | SAP S/4HANA | 8 Oct 2026 | Accepted |
| ITGC-REQ-003 | ServiceNow: Access request tickets approved | ACC-02 | 7 Oct 2026 | Accepted | |
| Q2-EV-003 | Microsoft Entra ID · ticket sample (Q2) | ACC-02 | Microsoft Entra ID | 18 Jun 2026 | Accepted |
| Q2-EV-004 | SAP S/4HANA · access review (Q2) | ACC-02 | SAP S/4HANA | 23 Jun 2026 | Rejected |
| SOC2-REQ-004 | Microsoft Entra ID: Access package assignments have approval | ACC-02 | Microsoft Entra ID | 8 Oct 2026 | Accepted |
| SOC2-REQ-005 | SAP S/4HANA: SAP role assignments trace to approved request | ACC-02 | SAP S/4HANA | 7 Oct 2026 | Accepted |
| SOC2-REQ-006 | ServiceNow: Access request tickets approved | ACC-02 | 6 Oct 2026 | Accepted |
Tests (3)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-ITGC-ACC-02 | ACC-02 · User access provisioning is approved before grant | Q3 2026 Unified Program Review | 7 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit | Pass | High |
| TST-SOC2-ACC-02 | ACC-02 · User access provisioning is approved before grant | Q3 2026 Unified Program Review | 3 Oct 2026 | Laura Bennett · Kestrel Assurance LLP | Pass | High |
| TST-Q2-ACC-02 | ACC-02 · User access provisioning is approved before grant | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | High |