Reference no: EM133512247

CASE STUDY

A global organization struggles to effectively implement tools and technologies to support identity and access management, with a particular emphasis on the access certification process, to periodically validate user access appropriateness. Continued issues arise throughout the organization's remediation efforts, highlighting key lessons learned that can be extrapolated in the areas of communication, planning, roles and responsibilities, technology selection and implementation, among others.

XYZ Finance Corporation, a leading financial services company, had encountered significant issues with its access management program due to a lack of compliance with internal and external reporting requirements. Compliance pressure built after external auditors issued a management letter identifying significant deficiencies related to the effectiveness of the global access certifications conducted. These issues were experienced internally as the institution continued to struggle with the implementation of the supporting access certification tool, where performance-related issues had arisen, hindering the ability to effectively leverage key functionality required by the business.

Background and Issues

Two years prior to being issued the management deficiency letter, the organization had purchased a certification tool from a leading vendor in the marketplace-let's call this tool "Enterprise Access Governance (EAG)" for the purposes of this case study. The EAG certification tool and the associated access review and certification process had become critical to the organization from both a compliance and a risk reduction measure. The access review process served as the key control to periodically evaluate the appropriateness of access over time within the organization. Given the inherent risks associated with transactional systems and compliance mandates, these controls were heavily relied upon as a means to restrict inappropriate access. The scope of the reviews included both global Sarbanes-Oxley (SOX) systems and those deemed high risk by the business. After the EAG tool was implemented, performance limitations were quickly discovered, forcing the review process to be initiated once a year when the business could certify the appropriateness of access decisions and invoke access changes if needed. While an annual review provided some level of risk reduction, higher risk areas of the business would have benefited from recertifying their systems more frequently. Due to significant performance issues with the tool's overall availability and responsiveness, the review process proved to be very inefficient, costing the organization valuable resource time.

Due to the organization's significant reliance on the access review process to manage access risk and meet compliance objectives, it was deemed imperative that remediation efforts begin quickly to address the issues raised.

Question: The organization developed a response plan with the following main objectives:

• Define a tactical strategy for the remediation of the access certification control deficiencies as documented in the audit management letter.
• Define the revised business and functional requirements for the access certification process using a risk-based approach and leveraging the lessons learned from the prior execution of the control.
• Deploy the updated enhancements required by the business to the existing EAG tool, or replace the existing tool with an alternate technology that would fully support the business requirements for the recertification control.