Test · TST-Q2-ACC-02
ACC-02 · User access provisioning is approved before grant
FailQ2 2026 Unified Program ReviewTested 18 Jun 2026 by Farah Khan, Vikram Mehta · Meridian Internal Audit
Requirement to validation
Requirement
ISO-A.5.15 · ISO-A.5.18 · ITGC-AM-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.2
mapped
Policy
Access Control Policy
pol-access
Control
ACC-02
User access provisioning is approved before grant
Application
Microsoft Entra ID · SAP S/4HANA · ServiceNow ITSM
mapped
Evidence · Q3
6 items
6 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-ITGC-ACC-02 · High confidence
Finding
F-IAQ2-ACC-02 · High
Closed
Action
Ananya Rao
REM-F-IAQ2-ACC-02 · Closed
Validation
Validated
as recorded
Procedure and result
- Procedure
- Entra access packages with approval stages; SAP GRC access request workflow. Tests: Microsoft Entra ID: Access package assignments have approval; SAP S/4HANA: SAP role assignments trace to approved request; ServiceNow ITSM: Access request tickets approved. Frequency on-demand.
- Sample
- 25 items sampled (Q2 baseline)
- Expected
- Access to in-scope applications is provisioned only after line-manager and application-owner approval recorded in ServiceNow / Entra access packages.
- Observed
- 6 of 25 SAP role grants sampled in May had no approval in ServiceNow; access had been added directly by Basis administrators during a month-end freeze.
- Confidence
- High