Test · TST-ITGC-JML-01
JML-01 · Leavers are de-provisioned within 24 hours
PassQ3 2026 Unified Program ReviewTested 3 Oct 2026 by Vikram Mehta, Farah Khan · Meridian Internal Audit
Requirement to validation
Requirement
ISO-A.5.18 · ISO-A.6.5 · ITGC-AM-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.2 · SOC2-CC6.3
mapped
Policy
Access Control Policy
pol-access
Control
JML-01
Leavers are de-provisioned within 24 hours
Application
Darwinbox HRMS · Microsoft Entra ID · SAP S/4HANA
mapped
Evidence · Q3
6 items
6 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-ITGC-JML-01 · High confidence
Finding
F-IAQ2-JML-01 · Medium
Closed
Action
Neha Iyer
REM-F-IAQ2-JML-01 · Closed
Validation
Validated
as recorded
Procedure and result
- Procedure
- Darwinbox -> Entra lifecycle workflow; SCIM to downstream apps; SAP lock job. Tests: Darwinbox HRMS: Terminations feed reconciled to IdP; Microsoft Entra ID: No sign-ins after termination; SAP S/4HANA: Terminated users locked in SAP. Frequency continuous.
- Sample
- 2 items sampled (reperformance)
- Expected
- When Darwinbox records a termination, the Entra ID account is disabled and downstream application access removed within 24 hours of the last working day.
- Observed
- Operating effectiveness confirmed for Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA; no exceptions in 2 sample(s).
- Confidence
- High