CTL-004 · Access and authority
Leaver access is removed within one business day
A departure recorded in the directory removes every platform right within one business day.
What counts as evidence for this control
Written before the test, so a tester cannot choose the evidence that suits the result
Leaver events with a removal timestamp and the elapsed time between them.
Test history
3 tests on record
| Test | Period | Sample method | Size | Pass | Fail | Result | Tester | Tested |
|---|---|---|---|---|---|---|---|---|
| CT-004-01 | Q3 month 2 2026 | random attribute sample | 16 | 11 | 5 | Fail | R. Whitfield Internal Audit | Aug 06, 2026 |
| CT-004-02 | Q3 month 1 2026 | random attribute sample | 30 | 29 | 1 | Pass with findings | S. Nakamura Internal Audit | Jul 06, 2026 |
| CT-004-03 | Q2 2026 | random attribute sample | 51 | 51 | 0 | Pass | D. Okoye Internal Audit | Jun 05, 2026 |
CT-004-01 · findings
Q3 month 2 2026 · random attribute sample
5 items failed the attribute test. Detail carried into the exception register.
CT-004-02 · findings
Q3 month 1 2026 · random attribute sample
1 item failed the attribute test. Detail carried into the exception register.
CT-004-03 · findings
Q2 2026 · random attribute sample
No exceptions in the sample. Evidence attached for every item tested.
Exceptions raised against this control
2 still open of 2
One approver kept queue rights for five days and one function leader kept enterprise override rights for three days after departure. Both were removed once found, neither was found by the control.
A move between functions added the new queue without removing the old one. Nothing was approved incorrectly in the window, which is luck rather than control.
What this page is, and what it is not
Read this before quoting a result
The test results on this page are a modeled test history for a modeled estate. They demonstrate the shape of independent control testing — a named tester outside the operating team, a stated sample method, a sample size, a pass and fail count, and evidence citations that resolve into the chain — not the audited results of a live enterprise.
12 of 12 evidence citations on this control resolve to a record in the evidence spine. Every citation resolves; each one links through to the sealed record it refers to.
A control shown as untested has no result at all. Coverage on this platform counts controls that were actually tested; it never counts a control as passing because it was designed.