Test · TST-Q2-JML-01
JML-01 · Leavers are de-provisioned within 24 hours
Pass with ObservationQ2 2026 Unified Program ReviewTested 20 Jun 2026 by Farah Khan, Vikram Mehta · Meridian Internal Audit
Requirement to validation
Requirement
ISO-A.5.18 · ISO-A.6.5 · ITGC-AM-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.2 · SOC2-CC6.3
mapped
Policy
Access Control Policy
pol-access
Control
JML-01
Leavers are de-provisioned within 24 hours
Application
Darwinbox HRMS · Microsoft Entra ID · SAP S/4HANA
mapped
Evidence · Q3
6 items
6 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-ITGC-JML-01 · High confidence
Finding
F-IAQ2-JML-01 · Medium
Closed
Action
Neha Iyer
REM-F-IAQ2-JML-01 · Closed
Validation
Validated
as recorded
Procedure and result
- Procedure
- Darwinbox -> Entra lifecycle workflow; SCIM to downstream apps; SAP lock job. Tests: Darwinbox HRMS: Terminations feed reconciled to IdP; Microsoft Entra ID: No sign-ins after termination; SAP S/4HANA: Terminated users locked in SAP. Frequency continuous.
- Sample
- 25 items sampled (Q2 baseline)
- Expected
- When Darwinbox records a termination, the Entra ID account is disabled and downstream application access removed within 24 hours of the last working day.
- Observed
- 3 of 25 leavers were disabled between 26 and 31 hours after their last working day; no access was used after exit.
- Confidence
- High