Audit Evidence Review

Difficulty: Advanced · Track: GRC

Test a control against real evidence, decide pass or fail, and assign a finding severity.

Context

You're running a mock internal audit of the access-revocation control from the Policy Gap Analysis challenge. You've been handed an offboarding log for one terminated employee. This is what auditors actually do: test a control against evidence, not just read the policy.

Task

Read the offboarding log and severity rubric below (static, safe example).
Decide whether the control passed or failed against the 5-day policy requirement.
Calculate how late the revocation was, and assign the correct finding severity.

Audit Evidence

Answers are directly copy-pasteable or calculable from this block.

AUDIT EVIDENCE — Employee Offboarding Log Employee: J. Rao (Employee ID 4471) Last working day: 2026-03-10 IT ticket to revoke system access opened: 2026-03-10 IT ticket closed (access actually revoked): 2026-04-24 Control tested: "Terminated employees must have system access revoked within 5 business days" (Access Control Policy, clause 4) Audit Finding Severity Rubric (days late beyond the 5-day requirement, simplified for this exercise): 0-5 days late -> Low 6-15 days late -> Medium 16+ days late -> High

Note: Educational example — employee name and dates are fictional.

Capture the Flags

Copy or calculate each answer from the evidence above. Case-insensitive.

0/3 flags captured

Flag 1 — Does this control pass or fail?

Question: Compare the dates against the 5-business-day requirement.

Flag 2 — Approximately how many calendar days elapsed before access was revoked?

Question: Count from the last working day (2026-03-10) to the ticket close date (2026-04-24).

Flag 3 — What severity should this finding be assigned?

Question: Apply the rubric to how many days late the revocation was (well beyond the 5-day requirement).

Back to Challenges