Raised 2026-06-20 in the Q2 2026 internal audit baseline. The Q1 user access review for Salesforce, including Northstar BPO accounts, was not signed off by the application owner.

Applications: Microsoft Entra ID, Salesforce (Sales + Financial Services Cloud), SAP S/4HANA.

Potential risk

The control may not operate consistently, weakening reliance by auditors and the regulator.

Root cause

Review ownership unclear after the Operations reorganisation.

Agreed action plan

Remediate: salesforce user access review not completed.

Management response: Management agreed and committed to remediate before the Q3 review.

Action: REM-F-IAQ2-ACC-04
Owner (FPR): Ananya Rao
Target date: 31 Jul 2026
Priority: Medium
Status: Closed
Validation: Pending · planned 20 Oct 2026

Evidence for this control (7)

Open list →

Evidence	Title	Control	Source system	Collected	Status
ITGC-REQ-007	SAP S/4HANA: Q3 SAP access review signed off	ACC-04	SAP S/4HANA	7 Oct 2026	Under review
ITGC-REQ-008	Salesforce: Q3 Salesforce access review signed off	ACC-04		6 Oct 2026	Under review
ITGC-REQ-009	Microsoft Entra ID: Entra access review campaign status	ACC-04	Microsoft Entra ID	5 Oct 2026	Under review
Q2-EV-007	SAP S/4HANA · policy document (Q2)	ACC-04	SAP S/4HANA	14 Jun 2026	Rejected
Q2-EV-008	Salesforce (Sales + Financial Services Cloud) · screenshot (Q2)	ACC-04	Salesforce (Sales + Financial Services Cloud)	19 Jun 2026	Rejected
SOC2-REQ-010	SAP S/4HANA: Q3 SAP access review signed off	ACC-04	SAP S/4HANA	6 Oct 2026	Under review
SOC2-REQ-011	Salesforce: Q3 Salesforce access review signed off	ACC-04		5 Oct 2026	Under review

Tests of this control (1)

Open list →

Test	Control	Cycle	Tested	By	Result	Confidence
TST-Q2-ACC-04	ACC-04 · Quarterly user access review of in-scope applications	Q2 2026 Unified Program Review	18 Jun 2026	Farah Khan, Vikram Mehta · Meridian Internal Audit	Fail	Medium