Finding · F-IAQ2-JML-01

Leaver de-provisioning occasionally exceeds 24 hours

ClosedJML-01 · Leavers are de-provisioned within 24 hoursJoiner/Mover/LeaverQ2 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low

Requirement to validation

Requirement
ISO-A.5.18 · ISO-A.6.5 · ITGC-AM-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.2 · SOC2-CC6.3
mapped
Policy
Access Control Policy
pol-access
Control
JML-01
Leavers are de-provisioned within 24 hours
Application
Darwinbox HRMS · Microsoft Entra ID · SAP S/4HANA
mapped
Evidence · Q3
6 items
6 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-ITGC-JML-01 · High confidence
Finding
F-IAQ2-JML-01 · Medium
Closed
Action
Neha Iyer
REM-F-IAQ2-JML-01 · Closed
Validation
Validated
as recorded
Observation
Raised 2026-06-24 in the Q2 2026 internal audit baseline. 3 of 25 leavers were disabled between 26 and 31 hours after their last working day; no access was used after exit.
Applications: Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA.
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
Darwinbox exit events processed in a nightly batch rather than in real time.
Agreed action plan

Remediate: leaver de-provisioning occasionally exceeds 24 hours.

Management response: Management agreed and committed to remediate before the Q3 review.

Action
REM-F-IAQ2-JML-01
Owner (FPR)
Neha Iyer
Target date
31 Jul 2026
Priority
Medium
Status
Closed
Validation
Validated · planned 26 Sep 2026

Evidence for this control (8)

Open list →
EvidenceTitleControlSource systemCollectedStatus
ITGC-REQ-010Darwinbox HRMS: Terminations feed reconciled to IdPJML-01Darwinbox HRMS6 Oct 2026Accepted
ITGC-REQ-011Microsoft Entra ID: No sign-ins after terminationJML-01Microsoft Entra ID5 Oct 2026Accepted
ITGC-REQ-012SAP S/4HANA: Terminated users locked in SAPJML-01SAP S/4HANA4 Oct 2026Accepted
Q2-EV-009Darwinbox HRMS · screenshot (Q2)JML-01Darwinbox HRMS24 Jun 2026Accepted
Q2-EV-010Microsoft Entra ID · system export (Q2)JML-01Microsoft Entra ID5 Jun 2026Accepted
SOC2-REQ-013Darwinbox HRMS: Terminations feed reconciled to IdPJML-01Darwinbox HRMS5 Oct 2026Accepted
SOC2-REQ-014Microsoft Entra ID: No sign-ins after terminationJML-01Microsoft Entra ID4 Oct 2026Accepted
SOC2-REQ-015SAP S/4HANA: Terminated users locked in SAPJML-01SAP S/4HANA9 Oct 2026Accepted

Tests of this control (3)

Open list →
TestControlCycleTestedByResultConfidence
TST-ITGC-JML-01JML-01 · Leavers are de-provisioned within 24 hoursQ3 2026 Unified Program Review3 Oct 2026Vikram Mehta, Farah Khan · Meridian Internal AuditPassHigh
TST-SOC2-JML-01JML-01 · Leavers are de-provisioned within 24 hoursQ3 2026 Unified Program Review3 Oct 2026Laura Bennett · Kestrel Assurance LLPPassHigh
TST-Q2-JML-01JML-01 · Leavers are de-provisioned within 24 hoursQ2 2026 Unified Program Review20 Jun 2026Farah Khan, Vikram Mehta · Meridian Internal AuditPass with ObservationHigh