Finding · F-ITGC-02
Standing privileged access in production AWS
In ProgressACC-03 · Privileged access is just-in-time and reviewedAccess ControlQ3 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.8.2 · ITGC-AM-02 · RBI-CSF-NBFC-Annex-1-2 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.1 · SOC2-CC6.3
mapped
Policy
Access Control Policy
pol-access
Control
ACC-03
Privileged access is just-in-time and reviewed
Application
Amazon Web Services (ap-south-1) · Microsoft Entra ID · SAP S/4HANA
mapped
Evidence · Q3
7 items
3 approved · 4 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-ACC-03 · Medium confidence
Finding
F-ITGC-02 · Medium
In Progress
Action
Rahul Nair
REM-F-ITGC-02 · In Progress
Validation
Pending
as recorded
Observation
Raised 2026-09-30 in the ITGC Q3 FY2026-27 Controls Testing (Meridian Internal Audit). Two platform engineers had permanent AdministratorAccess assignment in the prod-payments account. One removed 2026-10-02; one pending migration to TEAM just-in-time elevation.
Applications: Amazon Web Services (ap-south-1), Microsoft Entra ID, SAP S/4HANA.
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
AWS just-in-time elevation (TEAM) rollout incomplete for the payments account.
Agreed action plan
Migrating to TEAM just-in-time elevation; 1 of 2 assignments removed. Tracked as T-005 in Prismet Tasks.
Management response: Migrating to TEAM just-in-time elevation; 1 of 2 assignments removed.
- Action
- REM-F-ITGC-02
- Owner (FPR)
- Rahul Nair
- Target date
- 16 Oct 2026
- Priority
- Medium
- Status
- In Progress
- Validation
- Pending · planned 16 Oct 2026
Evidence for this control (9)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-004 | Microsoft Entra ID: No permanent Global Administrator assignments | ACC-03 | Microsoft Entra ID | 8 Oct 2026 | Accepted |
| ITGC-REQ-005 | AWS: No standing AdministratorAccess permission sets | ACC-03 | 7 Oct 2026 | Accepted | |
| ITGC-REQ-006 | SAP S/4HANA: Firefighter sessions reviewed | ACC-03 | SAP S/4HANA | 6 Oct 2026 | Accepted |
| Q2-EV-005 | Microsoft Entra ID · access review (Q2) | ACC-03 | Microsoft Entra ID | 4 Jun 2026 | Rejected |
| Q2-EV-006 | Amazon Web Services (ap-south-1) · policy document (Q2) | ACC-03 | Amazon Web Services (ap-south-1) | 9 Jun 2026 | Rejected |
| RBI-REQ-006 | Microsoft Entra ID: No permanent Global Administrator assignments | ACC-03 | Microsoft Entra ID | 6 Oct 2026 | Under review |
| RBI-REQ-007 | AWS: No standing AdministratorAccess permission sets | ACC-03 | 5 Oct 2026 | Under review | |
| SOC2-REQ-008 | AWS: No standing AdministratorAccess permission sets | ACC-03 | 6 Oct 2026 | Under review | |
| SOC2-REQ-009 | SAP S/4HANA: Firefighter sessions reviewed | ACC-03 | SAP S/4HANA | 5 Oct 2026 | Under review |
Tests of this control (2)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-ITGC-ACC-03 | ACC-03 · Privileged access is just-in-time and reviewed | Q3 2026 Unified Program Review | 2 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit | Fail | Medium |
| TST-Q2-ACC-03 | ACC-03 · Privileged access is just-in-time and reviewed | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | High |