HR access role reviews

Control Design Assessment (CDA)

Procedures evaluating whether the control is designed adequately.

1. 1.Obtain and read the HR role-review procedure; confirm it defines the semi-annual cadence and reviewer responsibilities.
2. 2.Confirm the review covers all HRIS roles with elevated or sensitive access, not only administrator roles.

Control Operating Effectiveness (COE)

Procedures evaluating whether the control operated over the testing period.

1. 1.Select 25 HRIS role assignments and confirm each was reviewed within the semi-annual cadence.
2. 2.Confirm roles flagged for removal during review were revoked.
3. 3.Confirm late reviews were escalated and tracked to completion.

Linked risks

• HR data privacy violationmitigation 3

Framework mappings & latest test