User access provisioning
How new and changed access to financially significant systems is requested, approved and granted, and how auditors test that access matched an authorized request.
Access to programs and data
IT general controls that keep access to financially significant applications, databases and infrastructure limited to authorized people with appropriate duties.
User access removal
Timely removal of access to financial applications and infrastructure when employees and contractors leave or change roles, and how auditors compare termination lists with access records.
Periodic user access reviews
Periodic recertification of who holds access to in-scope applications, databases and operating systems, including the completeness of the listings reviewed and follow-up on removals.
Privileged access management
Restricting and monitoring administrator, superuser and database owner accounts on financial systems, including shared and service accounts and logging of privileged activity.
Authentication and password settings
Authentication configuration for in-scope applications, databases, operating systems and directories, such as password parameters, single sign-on and multi-factor authentication, and how auditors inspect system settings.
Segregation of duties in IT systems
Preventing conflicting access, for example the same person creating and approving journal entries or developing and deploying code, through role design, conflict rules and monitoring.
Direct data and database access
Controls over direct changes to financial data and master files outside the application, such as database administrator access, data fix procedures and logging of direct updates.
