Test · TST-Q2-JML-02
JML-02 · Mover access is recertified on role change
PassQ2 2026 Unified Program ReviewTested 12 Jun 2026 by Farah Khan, Vikram Mehta · Meridian Internal Audit
Requirement to validation
Requirement
ISO-A.5.18 · ISO-A.6.5 · ITGC-AM-01 · ITGC-SOD-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.2 · SOC2-CC6.3
mapped
Policy
Access Control Policy
pol-access
Control
JML-02
Mover access is recertified on role change
Application
Darwinbox HRMS · Microsoft Entra ID · SAP S/4HANA
mapped
Evidence · Q3
9 items
9 approved · 0 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-JML-02 · High confidence
Finding
F-SOC2-02 · Medium
Open
Action
Neha Iyer
REM-F-SOC2-02 · Open
Validation
Pending
as recorded
Procedure and result
- Procedure
- Continuous Monitoring HR-drift compares Darwinbox role to SAP/Entra entitlements and raises exceptions. Tests: Darwinbox HRMS: Role changes detected from HR feed; SAP S/4HANA: Previous-role SAP roles removed after move; Microsoft Entra ID: Previous-role groups removed after move. Frequency on-demand.
- Sample
- 25 items sampled (Q2 baseline)
- Expected
- When Darwinbox records a department or job change, access tied to the previous role is reviewed by the former manager and removed within 5 business days unless re-approved by the new manager.
- Observed
- No exceptions in the sample; removal of previous-role access on transfer operated as designed.
- Confidence
- High