# User offboarding: illustrative control-test plan

**Status:** Not executed. This is a portfolio learning sample, not a record of an employer or client assessment.

All context is fictional. No population, sample or evidence has been examined, and no assurance conclusion has been reached.

## Objective

Determine whether sampled leaver accounts were disabled within the organization's approved offboarding timeframe. Cover only systems included in the agreed scope.

## Criteria and scope

- Obtain the approved offboarding policy and the effective date and time of each authorized termination.
- Agree the review period and systems in scope.
- Use the actual approved timeframe; do not substitute an invented universal deadline.
- Clarify responsibilities for central identity accounts, business applications, remote access and supplier-managed systems.
- Obtain permission to access evidence and agree how sensitive personnel information will be protected.

## Population and sampling

Obtain the authoritative list of leavers for the review period. Reconcile its completeness with the relevant personnel records before selecting a sample.

Document the population size, selection approach, rationale, selected items and limitations. This example deliberately does not prescribe a sample size without knowing the population and risk.

## Evidence request

- Authorized termination records, including effective times.
- Offboarding tickets and approvals.
- Account-disable timestamps and relevant application access records.
- Documented exceptions and approvals.
- Control procedure and responsible roles.

## Proposed procedures

1. Confirm the control objective and criteria with the responsible owner.
2. Review the procedure to understand whether it could achieve the intended objective.
3. Obtain and reconcile the population before selecting a sample.
4. For each selected leaver, compare the required disable time with the supporting evidence for each in-scope system.
5. Record the evidence reference, procedure performed, result and any exception.
6. Distinguish a control failure from insufficient evidence. Do not record a pass where evidence is missing.
7. Discuss exceptions and limitations with the responsible owner and reviewer.
8. If remediation is agreed, record the action, owner and due date.
9. Review closure evidence and perform appropriate follow-up before closing the finding.

## Workpaper record

| Field | Current status |
|---|---|
| Review period | Not set |
| Approved criteria | Not obtained |
| Population | Not obtained |
| Completeness check | Not performed |
| Sample | Not selected |
| Evidence | Not obtained |
| Test execution | Not performed |
| Exceptions | Not assessed |
| Conclusion | Not tested; no assurance conclusion |
| Reviewer | Not assigned |

## Independence and limitations

Operating a control and independently auditing that control are different responsibilities. A real engagement must establish appropriate review and independence arrangements.

Evidence of an account being disabled does not, by itself, establish that every application, session or access path was addressed. The scope and limitations should remain explicit.