- Severity
- HIGH
- Status
- OPEN
- Owner
- Chief Data Office
- Root cause
- Access management
- Test failure
- Operating effectiveness (COE)
- Opened
- 2026-03-10
- Due
- 2026-06-30
- Closed
- —
113 days old as of 2026-07-01OverdueRepeat
22% of customer-data access uncertified at campaign close; repeat of prior-year finding.
FAIL
tested 2026-02-28
This issue records a COE failure, shown first.
Control Operating Effectiveness (COE)
Procedures evaluating whether the control operated over the testing period.
- 1.Select 25 users with access to customer data domains and confirm each was certified in the period.
- 2.Verify access removed during certification was deprovisioned within SLA.PR.AA-01
- 3.Confirm exceptions were tracked to remediation.
Control Design Assessment (CDA)
Procedures evaluating whether the control is designed adequately.
- 1.Confirm the certification procedure defines the customer-data domains in scope and the semi-annual cadence.PR.AA-05
- 2.Confirm reviewer independence from the access being certified.
Related issues
Same root cause or a shared entity
Score contribution
Issue-pressure points as of 2026-07-01, before the factor is capped at 0–100.
- Customer Data Domain39 of 51 pts
76.5% of this entity’s issue pressure
Annual priority score: 66 · issue pressure carries 10% weight in the active model — one factor among several behind that score.
- HIGH severity: 25
- Overdue: +8
- Repeat finding: +6
Linked entities
- Customer Data Domain
DATA DOMAIN · CRITICAL