Leavers' accounts are disabled later than the 24-hour target
Description
The audit compared the leaver list of the last two quarters with the moments the accounts were disabled. Several accounts stayed active for two or three working days after the last day, because the notice from HR reached the service desk only at the end of the week. The Access Control Policy sets a target of 24 hours, and the audit counted the late accounts as a gap in that target.
The effectiveness check showed the same gap as the audit did: some leavers kept an active account for more than a day.
I think the checklist reaches us too late, @Sam de Vries. Can we have HR trigger the disable step the moment a leaving date is known?
Agreed. I will ask the HR Lead to send the leaving date to the service desk on the day it is known.
We re-check after the next three leavers.