Systems audit: leaver access and privileged changes
A fictional finance team has moved to a new payment application. Internal audit tests terminated-user access and production-change approval. The risk committee needs a defensible summary of observed exceptions.
Original Finance Circle systems-audit case. All users, deadlines and exceptions are fictional. PwC’s Digital Trust Insights is source context, not evidence about any named organisation.
Independent Finance Circle learning material. The source organisation does not sponsor, author or endorse this exercise.
Clarify. Structure. Calculate. Defend.
Take 2 minutes to clarify the decision and definitions, 3 minutes to structure the analysis, then work the exhibits. Finish with a concise recommendation and answer a follow-up. The time is a suggested practice format, not an employer requirement.
Clarify before solving
What are the data basis and reporting boundary?
Original Finance Circle systems-audit case. All users, deadlines and exceptions are fictional. PwC’s Digital Trust Insights is source context, not evidence about any named organisation.
Which assumptions can I use without requesting more data?
The case policy requires access disabled within five business days of termination, inclusive of day 5. Elapsed days are already calculated. All six leavers are sampled records only; no population projection. No evidence of post-termination activity is provided.
What decision am I expected to support?
Management fixes all five observed record-level exceptions: three leavers and two changes. A retest finds one of six new leavers late and no exceptions in four new changes. Calculate each retest rate and each improvement in percentage points.
Build your structure
- Policy criteria, populations and time definitions
- Leaver access versus change approvals
- Observed exceptions and privilege exposure
- Remediation, compensating controls and retesting
Use the branches that matter to this decision. A memorised framework is less useful than explaining why each analysis could change your recommendation.
Everything you need to work the case.
Assumptions & boundaries
- The case policy requires access disabled within five business days of termination, inclusive of day 5. Elapsed days are already calculated.
- All six leavers are sampled records only; no population projection. No evidence of post-termination activity is provided.
- The change policy requires documented approval before deployment. Each change below is one sampled record.
Leaver-access sample
| User | Business days to disable | Role |
|---|---|---|
| L1 | 2 | Read-only |
| L2 | 7 | Payment editor |
| L3 | 5 | Reporting |
| L4 | 9 | Administrator |
| L5 | 1 | Read-only |
| L6 | 6 | Payment approver |
Production-change sample
| Change | Approval timing |
|---|---|
| C1 | Before deployment |
| C2 | After deployment |
| C3 | Before deployment |
| C4 | No approval evidence |
Choose the responsibility. Solve the decision.
Each level uses the exhibits above and asks a different question. Your entries stay in this open page only; copy your work before leaving.
Apply the policy precisely.
Calculate the number and rate of late removals, and L4’s delay beyond the deadline.
Why does a day-5 removal pass?
Numerical checks compare your arithmetic with the case model. Written recommendations are self-practice and are not automatically graded.
03 · Reveal worked solution & decision guide
Expected numerical answers
- Late removals
- 3 records
- Leaver sample exception rate
- 50 %
- L4 delay beyond deadline
- 4 business days
Work through the calculation
- Late records are L2 (day 7), L4 (day 9) and L6 (day 6). L3 at day 5 meets the deadline.
- Rate = 3 / 6 × 100 = 50%. L4 delay = 9 − 5 = 4 business days.
A strong concise response
My calculation shows that late removals is 3 records; leaver sample exception rate is 50 %; l4 delay beyond deadline is 4 business days. The sample shows late disablement, not evidence that a former user logged in or executed a payment.
Answer the interviewer follow-up
Why does a day-5 removal pass?
The specified policy allows five business days inclusive. A different real policy or timestamp convention could change the test; this case has already calculated elapsed business days.
Assessment rubric · 20 points
For self-review or mentor discussion. This rubric is not an automated written-answer grade or an employer scoring system.
Correctly derives all 3 numerical results for this level, keeps signs and units consistent, and explains the method.
Explains the objective: Apply the policy precisely. States the supplied scope, timing and metric definitions before calculating.
The sample shows late disablement, not evidence that a former user logged in or executed a payment. Addresses the interviewer follow-up without contradicting the facts.
Leads with a clear conclusion, distinguishes facts from assumptions, and identifies the next evidence needed. Does not claim the source company asked or endorsed this question.
Use full precision until the final rounding. Alternative written recommendations may be reasonable if they respect the facts and explain assumptions. This is Finance Circle’s guide, not an official source-company answer.
Source & attribution
The references below identify the public reporting, hiring guidance, research or mock-interview material used for context. Finance Circle wrote the exercise and its answers. Illustrative figures are explicitly identified; they are not company results or findings.
Public context; Finance Circle’s scenario inputs are illustrative.
Employer career context; the exercise is not a disclosed PwC interview question.
Source reviewed 30 October 2026. No external page is needed to answer this exercise. Company names and logos identify sources only. All trademarks belong to their respective owners.