- Severity
- HIGH
- Status
- OPEN
- Owner
- Identity Engineering
- Root cause
- Access management
- Test failure
- Operating effectiveness (COE)
- Opened
- 2026-04-05
- Due
- 2026-06-30
- Closed
- —
87 days old as of 2026-07-01OverdueRepeat
Quarterly recertification incomplete; orphaned admin accounts identified on core platforms.
FAIL
tested 2026-03-31
This issue records a COE failure, shown first.
Control Operating Effectiveness (COE)
Procedures evaluating whether the control operated over the testing period.
- 1.Select 25 privileged accounts across the period and confirm each was included in a completed recertification.
- 2.For each sampled account, verify an independent reviewer approved continued access with evidence retained.PR.AA-05
- 3.Confirm accounts flagged for removal were deprovisioned within the defined SLA.PR.AA-01
- 4.Verify late or missed recertifications were escalated and tracked to closure.
Control Design Assessment (CDA)
Procedures evaluating whether the control is designed adequately.
- 1.Obtain and read the privileged access review procedure; confirm it defines scope, reviewer independence, recertification frequency, and remediation timelines.PR.AA-05
- 2.Confirm the privileged-account population is system-generated from authoritative identity sources rather than a manually maintained list.PR.AA-01
- 3.Walk through one completed quarterly review end to end to confirm the control operates as designed.
Related issues
Same root cause or a shared entity
Score contribution
Issue-pressure points as of 2026-07-01, before the factor is capped at 0–100.
- Enterprise IAM Platform39 of 79 pts
49.4% of this entity’s issue pressure
Annual priority score: 62 · issue pressure carries 10% weight in the active model — one factor among several behind that score.
- HIGH severity: 25
- Overdue: +8
- Repeat finding: +6
Linked entities
- Enterprise IAM Platform
APPLICATION · CRITICAL