LensReading which lens this session carries.
All controls

CTL-004 · Access and authority

Leaver access is removed within one business day

A departure recorded in the directory removes every platform right within one business day.

Ineffective
Domain
Access and authority
Scope
enterprise
Frequency
monthly
Operation
Manual
Control owner
Acme Identity and Access Management · customer
Tester of record
internal-audit
Last tested
Aug 06, 2026
Next due
Sep 05, 2026 · in 18d

What counts as evidence for this control

Written before the test, so a tester cannot choose the evidence that suits the result

Leaver events with a removal timestamp and the elapsed time between them.

Test history

3 tests on record

97 items sampled
TestPeriodSample methodSizePassFailResultTesterTested
CT-004-01Q3 month 2 2026random attribute sample16115FailR. Whitfield
Internal Audit
Aug 06, 2026
CT-004-02Q3 month 1 2026random attribute sample30291Pass with findingsS. Nakamura
Internal Audit
Jul 06, 2026
CT-004-03Q2 2026random attribute sample51510PassD. Okoye
Internal Audit
Jun 05, 2026

Exceptions raised against this control

2 still open of 2

EXC-001Two leavers retained access beyond one business dayhighopen · due Sep 05, 2026

One approver kept queue rights for five days and one function leader kept enterprise override rights for three days after departure. Both were removed once found, neither was found by the control.

Owner
Acme Identity and Access Management · customer
Remediation
Move leaver processing off the manual ticket path and onto the directory feed. Until that is done the control cannot pass.
EXC-011A mover accumulated two approval queues for four daysmediumin-remediation · due Sep 03, 2026

A move between functions added the new queue without removing the old one. Nothing was approved incorrectly in the window, which is luck rather than control.

Owner
Acme Identity and Access Management · customer
Remediation
Make the mover path a remove-then-add transaction rather than an add.

What this page is, and what it is not

Read this before quoting a result

The test results on this page are a modeled test history for a modeled estate. They demonstrate the shape of independent control testing — a named tester outside the operating team, a stated sample method, a sample size, a pass and fail count, and evidence citations that resolve into the chain — not the audited results of a live enterprise.

12 of 12 evidence citations on this control resolve to a record in the evidence spine. Every citation resolves; each one links through to the sealed record it refers to.

A control shown as untested has no result at all. Coverage on this platform counts controls that were actually tested; it never counts a control as passing because it was designed.