Access Control Review

Access Control Review

Overview

Evaluate access control risks including user access management, privileged access governance, segregation of duties (SoD) conflicts, and access certification effectiveness. This skill applies the FFIEC IT Examination Handbook (Information Security booklet), NIST Cybersecurity Framework (PR.AC), SOX Section 302/404 requirements for IT general controls, and COSO Principle 11 (general controls over technology) to assess the adequacy of logical access controls in financial institutions.

When to Use

• Reviewing user access provisioning and de-provisioning processes
• Assessing privileged access management programs (PAM)
• Identifying and remediating segregation of duties conflicts
• Evaluating access certification/recertification campaigns
• Analyzing access-related audit findings or regulatory examination results
• Assessing access controls as IT general controls (ITGCs) supporting SOX-relevant applications

Required Inputs

• Access data: User access listings, role assignments, entitlement details, privileged account inventories
• SoD matrix: Defined conflict rules, toxic combinations, mitigating controls
• Application inventory: In-scope applications, criticality classification, SOX relevance
• Process documentation: Access provisioning workflows, approval chains, certification procedures
• Audit/exam findings: Prior access-related findings, remediation status, MRA/MRIA tracking
• Organizational data: Org charts, job descriptions, reporting hierarchies, recent transfers/terminations

Methodology

Step 1: Access Governance Framework Assessment

Evaluate governance against FFIEC and NIST expectations: policy framework comprehensiveness, RBAC implementation with roles aligned to job functions, least privilege enforcement, application and data owner accountability, risk committee reporting, and alignment to NIST CSF PR.AC subcategories (PR.AC-1 through PR.AC-7).

Step 2: Access Lifecycle Management Review

Assess the end-to-end access lifecycle:

Provisioning: Documented business justification, application/data owner approval, role-based grants (not ad-hoc), automated provisioning where feasible, and pre-grant SoD conflict checking.

Modification: Role changes trigger access reviews, accumulated access from prior roles reviewed and revoked (access creep prevention), temporary/emergency access has defined expiration.

De-provisioning: Termination triggers same-day revocation, HR system feeds drive automated de-provisioning, shared accounts transferred or disabled, contractor access revoked on engagement end.

Key KPIs: Provisioning ≤3 days, termination revocation same-day, orphan accounts 0%, transfer completion ≤5 days.

Step 3: Privileged Access Management (PAM) Assessment

Evaluate per FFIEC and NIST SP 800-53 (AC-6): complete privileged account inventory and classification, documented justification and ownership, MFA and session recording requirements, activity logging with anomaly detection, quarterly review frequency, service account password rotation, and documented break-glass procedures with post-use review.

Step 4: Segregation of Duties (SoD) Analysis

Define toxic combinations for key processes:

Extract entitlements, map to SoD rules, identify cross-application conflicts, assess compensating controls, and quantify conflicts by severity (Critical=no controls, High=weak, Medium=adequate, Low=strong).

Step 5: Access Certification Review

Evaluate certification effectiveness: scope covers all in-scope and SOX-relevant applications, frequency commensurate with risk (critical=quarterly, standard=semi-annual), certifiers are application/data owners, certifiers receive sufficient information (entitlements in business terms, last login dates), rubber-stamping indicators analyzed (100% approval, minimal review time), revocation follow-through confirmed, and results retained for audit.

Step 6: SOX ITGC Access Control Assessment

Evaluate: all SOX-relevant applications in scope, separation of dev/test/production access, direct database access controls and monitoring, administrator OS access review, design adequacy testing, and operating effectiveness test results for provisioning, de-provisioning, and certification controls.

Step 7: Findings, Risk Rating, and Recommendations

Classify findings by severity, map to regulatory requirements (FFIEC, NIST, SOX), provide actionable recommendations with effort estimates, distinguish quick wins from strategic improvements, and estimate residual risk from unmitigated gaps.

Output Specification

# Access Control Review Report

## Executive Summary
[Maturity assessment, key findings, critical recommendations]

## Access Governance Maturity
| Domain | Maturity (1-5) | Key Gaps |

## Detailed Findings
[Critical, High, Medium/Low findings with risk impact, regulatory reference, remediation]

## SoD Conflict Summary
| Process | Conflicts Identified | With Compensating Controls | Unmitigated |

## Privileged Access Summary
| Account Type | Count | Compliant | Non-Compliant | Key Issues |

## Access Certification Effectiveness
| Application | Certification Rate | Revocation Rate | Rubber-Stamp Indicators |

## Remediation Roadmap
| Finding | Priority | Remediation | Owner | Target Date | Effort |

Analysis Framework

Examples

Example 1 — SoD Conflict Finding: "Analysis of SAP entitlements identified 23 users in Finance with concurrent access to FB01 (Post Journal Entry), FB02 (Change Journal Entry), and FBRA (Reset Cleared Items) — allowing a single user to create, modify, and reverse journal entries without approval. 18 of 23 users have no compensating controls. This represents a significant deficiency in COSO Principle 10 and a SOX ITGC gap. Recommend: immediate remediation for unmitigated users, compensating detective controls (daily exception report reviewed by Controller) for those requiring dual access with documented justification."

Example 2 — Privileged Access Finding: "The core banking platform (FIS Horizon) has 47 system admin accounts: 12 are shared/generic without individual accountability, and 3 belong to employees terminated 30-90 days ago. No session recording or just-in-time elevation is implemented. Recommend: (1) deactivate orphaned accounts immediately, (2) eliminate shared accounts within 60 days, (3) deploy PAM solution within 180 days."

Guidelines

• Prioritize systems processing customer PII and financial data
• Consider cross-application SoD conflicts, not just within-application entitlements
• 100% SoD elimination may not be feasible; focus on adequate compensating controls
• Consider system integration and SSO impacts on access control boundaries
• Evaluate service account proliferation as a growing attack vector
• Document assessments for regulatory examination readiness

Validation Checklist

• Access governance assessed against FFIEC and NIST requirements
• Full access lifecycle evaluated: provisioning, modification, de-provisioning
• Privileged account inventory complete with ownership and justification
• SoD analysis performed for all critical business processes
• Compensating controls assessed for effectiveness
• Certification effectiveness analyzed with rubber-stamping indicators
• SOX ITGC access controls assessed for design and operating effectiveness
• Findings mapped to regulatory requirements and COSO principles
• Remediation roadmap includes priorities, owners, timelines, and effort