How auditors test user access controls in a SOX audit

Under section 404 of the Sarbanes-Oxley Act (SOX), the auditor checks whether your user access controls worked as described over the period tested and at fiscal year-end. For each control, the auditor takes a sample from that year’s events: people who got access, people who left or changed jobs, and the access reviews you held. Each item is then checked against its record, such as an approval dated before access was granted or an account disabled on time. What IT general controls are is covered in What are IT general controls (ITGC)?.

What the auditor is testing

The auditor follows AS 2201 from the Public Company Accounting Oversight Board (PCAOB). It began as Auditing Standard No. 5 and was renumbered in a 2015 reorganization. Paragraph 44 says a test of operating effectiveness asks two things. Did the control run as designed, and did the person running it have the authority and skill to do it?

So the auditor tests the controls your company says it has. Neither the statute nor the SEC’s 2007 guidance for management (Release No. 33-8810) lists which access controls to have. The SEC guidance names “access to programs and data” only as an example area. For a checklist, NIST SP 800-53 Rev. 5, the federal security control catalog, covers account controls under AC-2. NIST isn’t a SOX rule.

The sample is only as good as the list it comes from. If the list of leavers from HR is missing someone, no sample drawn from it can show that person’s account was closed. So check where each list comes from before the audit starts.

How evidence is gathered

AS 2201 lists four kinds of procedure: asking the people involved, watching the process, inspecting documents, and redoing the control. Paragraph 50 ranks them from least to most evidence in that order. Its note says inquiry alone doesn’t give enough evidence that a control works.

In practice, an IT lead saying “we disable leavers the same day” starts the test but doesn’t finish it. The records that show the control ran are the ticket or approval, the system’s own record of when the account changed, and the HR date to compare them with. Paragraph 51 adds that smaller companies may keep less formal records. In that case, asking questions combined with other procedures can be enough.

How samples are picked

PCAOB’s audit evidence standard (AS 1105, adopted in 2010 as Auditing Standard No. 15) gives three ways to choose items to test. The auditor can test all items, test specific items picked for a reason, or use audit sampling. Audit sampling means testing part of a population so the result says something about all of it. Results from specific items picked on purpose can’t be projected to the whole population.

Audit sampling has its own standard, AS 2315 (AU sec. 350 before the 2015 renumbering). As amended in 2010, it says statistical and nonstatistical sampling can both give enough evidence when applied properly. It adds that a properly applied nonstatistical sample is ordinarily about the same size as, or larger than, an efficient statistical one.

How much evidence the auditor needs depends on risk. Paragraph 46 of AS 2201 says that as the risk of a control rises, so does the evidence the auditor should get. Paragraph 52 says testing over a longer period, and closer to the assessment date, gives more evidence.

Testing early in the year

Section 404 asks for an assessment at fiscal year-end. When the auditor tests at an earlier date, AS 2201 covers what happens next. Paragraphs 55 and 56 have the auditor decide what more evidence is needed for the rest of the year. That depends on the control, the earlier results, how long is left, and whether anything changed. When the risk is low, inquiry alone may be enough for that last stretch.

For management’s own evaluation, the SEC guidance says it ordinarily considers evidence from a reasonable period of the year, including fiscal year-end. If you change a control during the year, such as moving to a new HR system, paragraph 53 of AS 2201 applies. The auditor can test only the new control if it has run long enough to test. If the old one matters to the auditor’s view of risk, paragraph 53 says the auditor should test it too.

When the auditor finds an exception

An exception is a sampled item where the control didn’t run as described, such as a leaver whose account stayed active. Paragraph 48 of AS 2201 has the auditor judge what the deviation means for the control’s risk, the evidence needed, and its effectiveness. A note says a control doesn’t have to run without any deviation to be considered effective.

If the control isn’t working, it’s a deficiency. The auditor judges how severe it is. Paragraph 64 says severity depends on whether there’s a reasonable possibility the controls will fail to catch a misstatement, not on whether one actually happened. Paragraph 68 has the auditor weigh other controls that make up for the gap, but only if they’re precise enough to catch a material misstatement.

For a leaver whose account stayed open, the useful follow-up is a record showing the account wasn’t used after their last day. A sign-in log that names each person can show that. With a shared login, it can’t. The log shows the account name, so a leaver’s use looks the same as everyone else’s. NIST AC-2(9) asks you to weigh this “lack of accountability” before allowing shared accounts.

Admin accounts

Admin rights raise questions of their own: who holds them, who used them, and who reviews them. Those are covered in What a SOX audit asks about admin accounts, and which records to keep.