Test · TST-Q2-ACC-04
ACC-04 · Quarterly user access review of in-scope applications
FailQ2 2026 Unified Program ReviewTested 18 Jun 2026 by Farah Khan, Vikram Mehta · Meridian Internal Audit
Requirement to validation
Requirement
ISO-A.5.18 · ITGC-AM-03 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.2 · SOC2-CC6.3
mapped
Policy
Access Control Policy
pol-access
Control
ACC-04
Quarterly user access review of in-scope applications
Application
Microsoft Entra ID · Salesforce (Sales + Financial Services Cloud) · SAP S/4HANA
mapped
Evidence · Q3
5 items
0 approved · 5 pending · 0 rejected
Test · Q3
Not tested
Finding
F-IAQ2-ACC-04 · Medium
Closed
Action
Ananya Rao
REM-F-IAQ2-ACC-04 · Closed
Validation
Pending
as recorded
Procedure and result
- Procedure
- Entra ID Access Reviews for SSO apps; SAP and Salesforce review via Prismet form evidence. Tests: SAP S/4HANA: Q3 SAP access review signed off; Salesforce (Sales + Financial Services Cloud): Q3 Salesforce access review signed off; Microsoft Entra ID: Entra access review campaign status. Frequency quarterly.
- Sample
- 4 items sampled (Q2 baseline)
- Expected
- Application owners review all user and privileged access to SAP, Salesforce, AWS, GitHub and the Customer Portal admin console quarterly (privileged monthly); removals are completed within 10 business days.
- Observed
- The Q1 user access review for Salesforce, including Northstar BPO accounts, was not signed off by the application owner.
- Confidence
- Medium