Test · TST-ITGC-JML-02
JML-02 · Mover access is recertified on role change
FailQ3 2026 Unified Program ReviewTested 4 Oct 2026 by Vikram Mehta, Farah Khan · Meridian Internal Audit
Requirement to validation
Requirement
ISO-A.5.18 · ISO-A.6.5 · ITGC-AM-01 · ITGC-SOD-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.2 · SOC2-CC6.3
mapped
Policy
Access Control Policy
pol-access
Control
JML-02
Mover access is recertified on role change
Application
Darwinbox HRMS · Microsoft Entra ID · SAP S/4HANA
mapped
Evidence · Q3
9 items
9 approved · 0 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-JML-02 · High confidence
Finding
F-SOC2-02 · Medium
Open
Action
Neha Iyer
REM-F-SOC2-02 · Open
Validation
Pending
as recorded
Procedure and result
- Procedure
- Continuous Monitoring HR-drift compares Darwinbox role to SAP/Entra entitlements and raises exceptions. Tests: Darwinbox HRMS: Role changes detected from HR feed; SAP S/4HANA: Previous-role SAP roles removed after move; Microsoft Entra ID: Previous-role groups removed after move. Frequency on-demand.
- Sample
- 25 items sampled (reperformance)
- Expected
- When Darwinbox records a department or job change, access tied to the previous role is reviewed by the former manager and removed within 5 business days unless re-approved by the new manager.
- Observed
- Mover retained Finance access after transfer to Operations (EXC-001).
- Confidence
- High