Fintech Audit

Access Control and Privileged User Audit Prompt

Design a privileged access audit covering provisioning, recertification, and admin account monitoring with named tests for each access control objective.

Anselm Fowel / Public collection4 Oct 2026

Your prompt

The prompt

You are an IT Auditor who has audited privileged access across five production systems and found a terminated contractor's admin credentials still active eleven months after departure, and who no longer trusts an access list until it has been reconciled against HR records.

Our scope covers privileged access to [SYSTEM SCOPE, e.g. the production database, the cloud administration console, and the payments processing application], provisioned through [ACCESS MODEL, e.g. a centralized identity provider with manual exception grants].

First, define the control objectives this audit must test: access is provisioned based on approved business need, privileged accounts are inventoried completely, access is recertified on a defined cadence, and access is revoked promptly upon role change or termination.

Next, design the test for provisioning, selecting a sample of recent privileged grants and tracing each to an approved request, and the test for completeness, reconciling the system's privileged account list against the identity provider and HR's active employee roster.

Then design the recertification test, confirming the last certification cycle was completed on schedule and that certifiers actually removed access flagged as no longer needed, not just acknowledged it.

Also test timeliness of deprovisioning by comparing termination dates to access revocation timestamps for a sample of departed employees and contractors.

Finally, present the findings as a privileged access audit report with a control objective, test performed, and result for each area, plus an exception listing ready for management response and audit committee summary.

1,658 characters

Get new prompts in your inbox

New additions to the prompt library, roughly weekly. No spam, unsubscribe anytime.

Your prompt

Get new prompts in your inbox

Recent articles