Finding · F-RBI-05
Privileged access to production previously standing (MD-ITGRCA §7.1)
ClosedACC-03 · Privileged access is just-in-time and reviewedAccess ControlQ3 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.8.2 · ITGC-AM-02 · RBI-CSF-NBFC-Annex-1-2 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.1 · SOC2-CC6.3
mapped
Policy
Access Control Policy
pol-access
Control
ACC-03
Privileged access is just-in-time and reviewed
Application
Amazon Web Services (ap-south-1) · Microsoft Entra ID · SAP S/4HANA
mapped
Evidence · Q3
7 items
3 approved · 4 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-ACC-03 · Medium confidence
Finding
F-RBI-05 · Medium
Closed
Action
Ananya Rao
REM-F-RBI-05 · Closed
Validation
Validated
as recorded
Observation
Raised 2026-07-28 in the RBI Regulatory Controls — Q4 2026 Periodic Internal Audit (Meridian Internal Audit (IS Audit cell)). Privileged access to production previously standing (MD-ITGRCA §7.1).
Applications: Amazon Web Services (ap-south-1), Microsoft Entra ID, SAP S/4HANA.
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
Entra Global Administrator role was assigned permanently before PIM was enabled.
Agreed action plan
Entra Global Administrator moved to PIM-only; retest 2026-09-29 passed (AWS item tracked separately under F-ITGC-02).
Management response: Entra Global Administrator moved to PIM-only; retest 2026-09-29 passed (AWS item tracked separately under F-ITGC-02).
- Action
- REM-F-RBI-05
- Owner (FPR)
- Ananya Rao
- Target date
- 27 Aug 2026
- Priority
- Medium
- Status
- Closed
- Validation
- Validated · planned 29 Sep 2026
Evidence for this control (9)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-004 | Microsoft Entra ID: No permanent Global Administrator assignments | ACC-03 | Microsoft Entra ID | 8 Oct 2026 | Accepted |
| ITGC-REQ-005 | AWS: No standing AdministratorAccess permission sets | ACC-03 | 7 Oct 2026 | Accepted | |
| ITGC-REQ-006 | SAP S/4HANA: Firefighter sessions reviewed | ACC-03 | SAP S/4HANA | 6 Oct 2026 | Accepted |
| Q2-EV-005 | Microsoft Entra ID · access review (Q2) | ACC-03 | Microsoft Entra ID | 4 Jun 2026 | Rejected |
| Q2-EV-006 | Amazon Web Services (ap-south-1) · policy document (Q2) | ACC-03 | Amazon Web Services (ap-south-1) | 9 Jun 2026 | Rejected |
| RBI-REQ-006 | Microsoft Entra ID: No permanent Global Administrator assignments | ACC-03 | Microsoft Entra ID | 6 Oct 2026 | Under review |
| RBI-REQ-007 | AWS: No standing AdministratorAccess permission sets | ACC-03 | 5 Oct 2026 | Under review | |
| SOC2-REQ-008 | AWS: No standing AdministratorAccess permission sets | ACC-03 | 6 Oct 2026 | Under review | |
| SOC2-REQ-009 | SAP S/4HANA: Firefighter sessions reviewed | ACC-03 | SAP S/4HANA | 5 Oct 2026 | Under review |
Tests of this control (2)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-ITGC-ACC-03 | ACC-03 · Privileged access is just-in-time and reviewed | Q3 2026 Unified Program Review | 2 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit | Fail | Medium |
| TST-Q2-ACC-03 | ACC-03 · Privileged access is just-in-time and reviewed | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | High |