User Access Review – IT Audit Exercise

Project overview

This is a completed self-directed simulated IT Audit exercise involving a logical-access review of a fictional retail online-banking system.

The exercise demonstrates how user-access data can be tested in Microsoft Excel to identify control exceptions, assess risk, document findings and maintain evidence traceability.

Audit objective

To assess whether logical access is appropriate, authorised, secure and periodically reviewed.

Controls tested

• Leaver account deactivation
• Multi-factor authentication
• Privileged-access approval
• Dormant accounts
• Segregation of duties

Audit approach

A fictional population of 15 user accounts was tested using Excel formulas, filters and conditional formatting.

Each account was assessed against defined control criteria. Exceptions were documented with:

• The condition identified
• Associated risk
• Risk rating
• Recommended remediation
• Responsible owner
• Supporting evidence reference

Results

• 15 user accounts tested
• 10 accounts passed all tests
• 5 accounts contained control exceptions
• 33.3% simulated exception rate

The identified exceptions included:

1. An active account belonging to a terminated employee
2. An active account without MFA
3. Privileged access without approval evidence
4. A dormant active account
5. Conflicting payment permissions

Workbook contents

• Audit overview and procedure
• User-access population
• Excel control-testing sheet
• Findings log
• Evidence index

Download the completed Excel audit workbook

Tools and skills demonstrated

• Microsoft Excel
• Logical-access control testing
• IT risk assessment
• Exception analysis
• Audit evidence documentation
• Findings and recommendations
• Evidence traceability

Disclaimer

This project uses entirely fictional data and was created solely for learning and portfolio purposes. It does not represent work performed for a real organisation, bank or audit client.