261|EXCEL – Access Termination Control

BYU Student Author: @Kiya_Smith
Reviewers: @Kylie_Larsen17 @Abraham_Reyes_Leon
Estimated Time to Solve: 15 Minutes

We provide the solution to this challenge using:

Need a program? Click here.

Overview
As an analyst at Deloitte, you play a crucial role in evaluating the effectiveness of clients’ internal controls. Your latest assignment involves assessing an access termination control for a client. The client has provided you with a dataset of employees from the past year, including their start date, termination date, and access removal date. The terminated employees must have their access to the clients data removed within a day of being terminated. Your objective is to analyze the dataset and determine whether the control is operating effectively by identifying instances of timely, late, or missing access removals.

Instructions
Download the Access Termination Data excel file provided to you containing employee termination data.

  1. Create a new column at the end titled “Removal Status” in the dataset.
  2. Apply an IF Statement to All Rows in the Column to classify each employee into one of these categories:
    a. Current Employee – The employee has not been terminated.
    b. Removed in Time – Access was removed within 24 hours of termination.
    c. Removed Late – Access was removed, but after the 24-hour deadline.
    d. Not Removed – Access was never removed after termination.
    e. Apply Conditional Formatting:
  • Red for “Not Removed”
  • Yellow for “Removed Late”
  • Green for “Removed in Time”
  • “Current Employees” can remain with default formatting.
  1. Determine on your own first if you think the control is effective. In this case usually a control is effective if the control works all the time or the majority of the time. The control is not effective if there are multiple instances of no access removal for terminated employees and late access removal.

  2. Import the completed Excel workbook into ChatGPT. And use it as well as the details of this case to prompt ChatGPT to generate a report summarizing:
    a. Whether the control is effective.
    b. Evidence supporting your conclusion.
    c. Any recommendations to improve weaknesses.

  3. Post your new excel workbook as well as the report as your solution to this challenge.

Data Files

Suggestions and Hints

There will be multiple IF statements inside the initial IF statement. Start with an IF statement where the criteria is that if the “Termination Date” column is empty and enter another IF statement for the false criteria. There should be a total if 3 IF statements in your equation.

Remember to use conditional formatting to highlight your cells that have been either Removed on Time, Removed Late or Not Removed. This is found in the middle of the home tab and it says “Conditional Formatting”. Then in the drop-down you can select “Highlight Cells Rules” then choose “Equal To” and put the conditions in for each of the three (Removed on Time, Removed Late or Not Removed).

Solution

Here’s my workbook and short report. This was good practice!

Access Termination Control Review Report

Objective

The purpose of this analysis was to evaluate whether the client’s access termination control is operating effectively. Specifically, the control requires that employee system access be removed within 24 hours of termination.


Scope & Methodology

We analyzed a dataset of employees over the past year, including start dates, termination dates, and access removal dates. Each employee was classified into one of the following categories:

  • Current Employee

  • Removed in Time

  • Removed Late

  • Not Removed

The analysis focused on terminated employees and whether access removal occurred within the required timeframe.


Results

Out of 50 total employees, 8 were terminated during the period under review.

Breakdown of terminated employees:

  • Removed in Time: 3

  • Removed Late: 2

  • Not Removed: 3

This indicates that 5 out of 8 terminated employees (62.5%) did not meet the control requirement.


Conclusion

The access termination control is not operating effectively.A majority of terminated employees experienced either delayed access removal or no removal at all. Given the sensitive nature of system access, even a small number of failures represents a significant control deficiency. The observed exception rate indicates that the control is not consistently executed and cannot be relied upon.


Risks Identified

  • Unauthorized access to company systems after termination

  • Increased risk of data breaches or data misuse

  • Potential for fraudulent activity

  • Exposure to regulatory and compliance violations


Recommendations

To strengthen the control environment, we recommend the following actions:

  1. Automate Access Removal
    Integrate HR and IT systems to ensure access is automatically revoked upon termination.

  2. Enhance Monitoring Procedures
    Implement daily reconciliation between terminated employees and access removal records.

  3. Enforce Timeliness Requirements
    Establish escalation procedures for any access not removed within 24 hours.

  4. Reduce Manual Dependencies
    Introduce preventive controls that disable access immediately when termination is processed.

  5. Conduct Periodic Reviews
    Perform regular audits to confirm no terminated employees retain system access.


Overall Assessment: Based on the procedures performed and the results obtained, the control deficiency is significant. Immediate remediation is recommended to reduce security and compliance risks.