Big4Guy

User access represents one of the biggest risk areas for Sarbanes Oxley compliance. Access to users who no longer work for the company should be removed in a timely manner. In most organizations, an users' access is terminated by the IT department when a terminated employees report is received from the HR department. As a result, there can be a significant delay in employee termination and user access rights removal.

Also, in most companies, access is removed only partially. In case user has access to multiple systems, access needs to be removed from all systems. Modern day methods like identity management though costly can significantly reduce the risk of unauthorized access to systems. The best possible way of controlling user access is to put a process in place, so that user termination is notified by the HR department to the IT department to ensure removal of access immediately. Excess user access can be a major control lacuna as far as Sarbanes Oxley compliance is concerned. It is up to companies to take action and control user access.

Related Posts

Spreadsheets and Sarbanes Oxley Compliance
Evaluating Disclosure Controls
Whistleblower Hotlines for Sarbanes Oxley
What is Basel II?