Test · TST-SOC2-ACC-02
ACC-02 · User access provisioning is approved before grant
PassQ3 2026 Unified Program ReviewTested 3 Oct 2026 by Laura Bennett · Kestrel Assurance LLP
Requirement to validation
Requirement
ISO-A.5.15 · ISO-A.5.18 · ITGC-AM-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.2
mapped
Policy
Access Control Policy
pol-access
Control
ACC-02
User access provisioning is approved before grant
Application
Microsoft Entra ID · SAP S/4HANA · ServiceNow ITSM
mapped
Evidence · Q3
6 items
6 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-ITGC-ACC-02 · High confidence
Finding
F-IAQ2-ACC-02 · High
Closed
Action
Ananya Rao
REM-F-IAQ2-ACC-02 · Closed
Validation
Validated
as recorded
Procedure and result
- Procedure
- Entra access packages with approval stages; SAP GRC access request workflow. Tests: Microsoft Entra ID: Access package assignments have approval; SAP S/4HANA: SAP role assignments trace to approved request; ServiceNow ITSM: Access request tickets approved. Frequency on-demand.
- Sample
- 25 items sampled (reperformance)
- Expected
- Access to in-scope applications is provisioned only after line-manager and application-owner approval recorded in ServiceNow / Entra access packages.
- Observed
- Operating effectiveness confirmed for Microsoft Entra ID, SAP S/4HANA, ServiceNow; no exceptions in 25 sample(s).
- Confidence
- High