Access Lifecycle
Verify system access is revoked promptly when someone leaves.
- Ledger + 2 client documents
- Key analysis in IT controls
How the result is read
Login after termination is proof access was not cut off; an active account long past termination with no login is an open door. What makes this a financial-statement matter rather than an IT one is whether the account could have posted, so the population is ranked by entitlement. Any login after termination is then traced into the journal and payment logs.
The worksheet, on the demo engagement
Access Lifecycle, as the application draws it for Harrow Precision Engineering Ltd, the fictional demo engagement — one row per identity.
- Active ERP users
- 24
- Terminated — still active
- 2
- Post-termination logins
- 1
- Avg revocation lag
- 18 days
Access lifecycle: HR termination vs. system deactivation. R.Kahn logged in post-termination; D.Wong orphan account active 91 days.
Result grid5 rows
| User ID | Name | HR termination | Last ERP login | Status at Y/E | Active roles |
|---|---|---|---|---|---|
| R.Kahn | R. Kahn (temp) | 2025-01-10 | 2025-01-15 | Active (post-termination) | GL_Post, AP_Approve, VM_Create |
| D.Wong | D. Wong (ex-AR clerk) | 2024-10-01 | 2024-10-08 | Active at year-end | AR_View, GL_View |
| J.Smith | J. Smith (Controller) | — | 2024-12-31 | Active | GL_Post, GL_Approve, AP_Approve, VM_Create |
| A.Lee | A. Lee (GL clerk) | — | 2024-12-31 | Active | GL_Post |
| SYSTEM | System account | — | n/a | Active | All automated modules |
In the application
Access Lifecycle is filed under IT controls, index letter K. "Run all analyses" runs it with every other analysis the ledger and the documents loaded can answer. The worksheet states the population it tested on its face — or "Not applicable" with the reason when a column it depends on is empty — and the Excel workbook the engagement exports files it under K, beside an index of the source files with their SHA-256 fingerprints.
Read it with
Run your next audit file test without the Excel crash.
One free engagement to evaluate, valid 60 days. The ledger never leaves the machine.
- 20 minutes
- Runs on a fictional engagement
- No client data required