This checklist checks there is an access control policy, that access is logged and reviewed, and that logins are removed when no longer needed.
Prepared using the F-Q2A Audit Checklist form template.
The file is supplied in fully editable MS Word format and can be easily customised, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Checklist number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested audit checklists. No junk, jargon or unnecessary questions. Simple and usable audit checklists
developed over 25 years through practical use in the real world.
Further guidance on access control and internal auditing:
Download this audit checklist template with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This checklist is also included in the ISO 9001, ISO 14001, ISO 45001, ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help completing your internal audits or training your internal auditors, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Access Control Audit Checklist Template
A process audit checklist for auditing access control: the access control policy, logging and monitoring of access, review of access logs, and the register of user logins. It is set out on the F-Q2A Audit Checklist format, with the scope, criteria, site, participants, auditor and date recorded at the top, and each question alongside the auditee and the evidence viewed, response and findings.
Questions Covered
- Whether there is an access control policy in place
- Whether there is a system to log and monitor access
- How often access logs are reviewed, and whether the review would detect attempted or actual unauthorised access
- How the register of user logins is managed so access rights are reviewed and removed when no longer needed
Carrying Out the Audit
Take a few names from the register of user logins, including someone who has left or changed role, and check their current access matches what they need. Asking to see the last access log review shows how often it happens and what it found. Shared accounts, such as a general office login, are worth asking about, as it is hard to show who used them. Check also how access is granted in the first place, and who approves it.
Planning the Audit
Have the access control policy, the register of user logins and the records of recent access log reviews to hand, along with a list of recent leavers and role changes. If access logs are produced automatically by a system or an IT provider, ask to see one and who reviews it.
Who Should Carry Out the Audit?
Anyone trained in internal auditing who is independent of the area being audited. The questions are written in plain language, so the checklist also works well for training new internal auditors.
Included in the ISO Toolkits
This checklist is part of the ISO 9001 Toolkit and is also included in the ISO 14001, ISO 45001, ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.
Related Documents
Documents that work alongside this checklist:
Part of the Process Audit Checklists
This is one of the alphaZ process audit checklists, each covering a single area of the management system, so audits can be spread across the year using the ER11 Audit Schedule. The completed checklist becomes the record of the audit, and the results can be written up using the F-Q31 Audit Report.
Adapting the Checklist
The questions can be edited, added to or removed to suit the way the organisation works, and the scope and criteria at the top changed to match the area being audited. Because every alphaZ audit checklist uses the same F-Q2A layout, audit records look the same whichever area was audited, which makes them easier to review and compare.
Using the Findings
Accounts left open after someone leaves, or access logs that are not reviewed, are raised as actions, with access that is no longer needed removed straight away. Shared accounts that cannot be traced to a person are reviewed as well.
Would you rather we did it for you?
Our Internal Audit Training and Support service works through your internal audits with you while training your own people as internal auditors, so the audits are completed and the skills stay in the business.
Internal Audit Training and Support