CTL-004 · Access and authority

Leaver access is removed within one business day

A departure recorded in the directory removes every platform right within one business day.

Ineffective

Domain

Access and authority

Scope

enterprise

Frequency

monthly

Operation

Manual

Control owner

Acme Identity and Access Management · customer

Tester of record

internal-audit

Last tested

Aug 06, 2026

Next due

Sep 05, 2026 · in 18d

What counts as evidence for this control

Written before the test, so a tester cannot choose the evidence that suits the result

Leaver events with a removal timestamp and the elapsed time between them.

Test history

3 tests on record

97 items sampled

Test	Period	Sample method	Size	Pass	Fail	Result	Tester	Tested
CT-004-01	Q3 month 2 2026	random attribute sample	16	11	5	Fail	R. Whitfield Internal Audit	Aug 06, 2026
CT-004-02	Q3 month 1 2026	random attribute sample	30	29	1	Pass with findings	S. Nakamura Internal Audit	Jul 06, 2026
CT-004-03	Q2 2026	random attribute sample	51	51	0	Pass	D. Okoye Internal Audit	Jun 05, 2026

CT-004-01 · findings

Q3 month 2 2026 · random attribute sample

5 items failed the attribute test. Detail carried into the exception register.

Evidence cited (4)

FI7A-1030#3VP Tax · Cleared tax director reviewCleared2fec9d71...ae9f2e HR1A-1008#3Skills Taxonomy Agent · Holding at map skills gapIn progresscdc286bf...20aa94 GB3B-1047#5Order Validation Agent · Holding at postIn progress9d61e72d...c16c75 HR8A-1046#4Equity Administration Agent · Holding at equity scanIn progress1d7ccfe9...864972

CT-004-02 · findings

Q3 month 1 2026 · random attribute sample

1 item failed the attribute test. Detail carried into the exception register.

Evidence cited (4)

AD5C-1000#4Director, Corporate Events · Holding at ratifyIn progress12644049...375d55 IT1B-1024#4Knowledge Retrieval Agent · Cleared notifyCleared90857e02...100ff2 EN9B-1038#5Platform Roadmap Agent · Holding at measureIn progress6c0e5a1a...9e0193 GB3C-1004#1Order Validation Agent · Cleared age ledgerCleared612a278a...c69f35

CT-004-03 · findings

Q2 2026 · random attribute sample

No exceptions in the sample. Evidence attached for every item tested.

Evidence cited (4)

FI5C-1041#1Controllership Orchestrator · Cleared detect changeClearedea87f649...10a339 AD9C-1019#3Director, Business Continuity · Cleared activateClearedbf6f88a2...ffaaf4 FI3A-1014#1Report Assembly Agent · Cleared assembleCleared54a2eb65...17640a IT2A-1009#3Joiner Provisioning Agent · Cleared provision standardCleared3b3395ad...20a44d

Exceptions raised against this control

2 still open of 2

EXC-001Two leavers retained access beyond one business dayhighopen · due Sep 05, 2026

One approver kept queue rights for five days and one function leader kept enterprise override rights for three days after departure. more

Owner

Acme Identity and Access Management · customer

Remediation

Move leaver processing off the manual ticket path and onto the directory feed. more

EXC-011A mover accumulated two approval queues for four daysmediumin-remediation · due Sep 03, 2026

A move between functions added the new queue without removing the old one. more

Owner

Acme Identity and Access Management · customer

Remediation

Make the mover path a remove-then-add transaction rather than an add.

What this page is, and what it is not

Read this before quoting a result

The test results on this page are a modeled test history for a modeled estate. more

12 of 12 evidence citations on this control resolve to a record in the evidence spine. Every citation resolves; each one links through to the sealed record it refers to.

A control shown as untested has no result at all. Coverage on this platform counts controls that were actually tested; it never counts a control as passing because it was designed.