Access rights reviews were skipped for two quarters
Description
The internal audit sampled the access rights reviews of the last four quarters and found no record of a review for two of them. The Service Desk Lead owns the review, and the quarterly reminder had lapsed when the previous reminder owner moved to another team. Administrator rights on the identity provider were therefore not confirmed against the staff list for half a year, which the Access Control Policy does not allow.
Summary
On trackThis workflow is complete.
The reminder for the quarterly review was a calendar entry of the former reminder owner and was deleted together with the mailbox. The review also had no Task in the ISMS, so nothing took its place.
The access rights review is now a recurring Task held by the Service Desk Lead, and the ISMS Manager confirms every review. The two skipped reviews were carried out in full and all deviations were corrected.
The next two quarterly reviews were completed on time and each one shows a signed list. The corrective action is effective.