Finding · F-SOC2-02

Mover access not removed timely (deviation in CC6.2 testing)

OpenJML-02 · Mover access is recertified on role changeJoiner/Mover/LeaverQ3 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low

Requirement to validation

Requirement
ISO-A.5.18 · ISO-A.6.5 · ITGC-AM-01 · ITGC-SOD-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.2 · SOC2-CC6.3
mapped
Policy
Access Control Policy
pol-access
Control
JML-02
Mover access is recertified on role change
Application
Darwinbox HRMS · Microsoft Entra ID · SAP S/4HANA
mapped
Evidence · Q3
9 items
9 approved · 0 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-JML-02 · High confidence
Finding
F-SOC2-02 · Medium
Open
Action
Neha Iyer
REM-F-SOC2-02 · Open
Validation
Pending
as recorded
Observation
Raised 2026-10-07 in the 2026 SOC 2 Type II Audit (Kestrel Assurance LLP). Rohan Gupta moved Finance -> Operations effective 2026-09-15. 8 business days later SAP still assigns Z_FI_PAY_APPROVER (payments approval) and Z_FI_GL_POST (general ledger posting); Concur expense admin and vendor portal access also retained. Payments approval + GL posting is an unmitigated SoD conflict.
Applications: Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA.
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
HR-drift alerts on role changes went to the new manager, who could not act on Finance roles.
Agreed action plan

Access removal in progress (T-001); HR-drift alerting now routed to former manager automatically.

Management response: Access removal in progress (T-001); HR-drift alerting now routed to former manager automatically.

Action
REM-F-SOC2-02
Owner (FPR)
Neha Iyer
Target date
31 Oct 2026
Priority
Medium
Status
Open
Validation
Pending · planned 31 Oct 2026

Evidence for this control (11)

Open list →
EvidenceTitleControlSource systemCollectedStatus
ITGC-REQ-013Darwinbox HRMS: Role changes detected from HR feedJML-02Darwinbox HRMS5 Oct 2026Accepted
ITGC-REQ-014SAP S/4HANA: Previous-role SAP roles removed after moveJML-02SAP S/4HANA4 Oct 2026Accepted
ITGC-REQ-015Microsoft Entra ID: Previous-role groups removed after moveJML-02Microsoft Entra ID9 Oct 2026Accepted
Q2-EV-011Darwinbox HRMS · system export (Q2)JML-02Darwinbox HRMS10 Jun 2026Accepted
Q2-EV-012SAP S/4HANA · configuration report (Q2)JML-02SAP S/4HANA15 Jun 2026Accepted
RBI-REQ-009Darwinbox HRMS: Role changes detected from HR feedJML-02Darwinbox HRMS5 Oct 2026Accepted
RBI-REQ-010SAP S/4HANA: Previous-role SAP roles removed after moveJML-02SAP S/4HANA4 Oct 2026Accepted
RBI-REQ-011Microsoft Entra ID: Previous-role groups removed after moveJML-02Microsoft Entra ID9 Oct 2026Accepted
SOC2-REQ-016Darwinbox HRMS: Role changes detected from HR feedJML-02Darwinbox HRMS4 Oct 2026Accepted
SOC2-REQ-017SAP S/4HANA: Previous-role SAP roles removed after moveJML-02SAP S/4HANA9 Oct 2026Accepted
SOC2-REQ-018Microsoft Entra ID: Previous-role groups removed after moveJML-02Microsoft Entra ID8 Oct 2026Accepted

Tests of this control (4)

Open list →
TestControlCycleTestedByResultConfidence
TST-ITGC-JML-02JML-02 · Mover access is recertified on role changeQ3 2026 Unified Program Review4 Oct 2026Vikram Mehta, Farah Khan · Meridian Internal AuditFailHigh
TST-RBI-JML-02JML-02 · Mover access is recertified on role changeQ3 2026 Unified Program Review4 Oct 2026Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell)FailHigh
TST-SOC2-JML-02JML-02 · Mover access is recertified on role changeQ3 2026 Unified Program Review3 Oct 2026Laura Bennett · Kestrel Assurance LLPFailHigh
TST-Q2-JML-02JML-02 · Mover access is recertified on role changeQ2 2026 Unified Program Review12 Jun 2026Farah Khan, Vikram Mehta · Meridian Internal AuditPassHigh