For financial institutions subject to FDICIA, the Federal Deposit Insurance Corporation Improvement Act, the annual management attestation is a critical declaration of compliance. It signifies that the institution’s internal controls over financial reporting (ICFR) are effective. One key control to validate is how user access reviews are performed.
Banking system access reports often involve massive, unstructured text reports that can span hundreds—or even thousands—of pages. Without a structured process for managing and interpreting these reports, institutions risk gaps in their internal control framework and potential non-compliance.
The Connection Between Access Reviews and FDICIA Attestation
The management attestation requires leaders to assert that the institution’s ICFR is operating effectively. A cornerstone of this effectiveness is ensuring that access to systems that impact financial reporting are properly controlled.
Key considerations include:
- Are Access Reviews Performed Effectively?
- Institutions must confirm that access reviews are not just performed but are thorough and actionable.
- Reviews should align with organizational policies, including frequency based on the criticality of the system, review of privileged access, and independence of the review.
- Can Management Interpret Review Results?
- Massive, unstructured reports often make it difficult for auditing let alone executive management reporting, leading to challenges when trying to spot issues.
- Without tools to distill these reports into actionable insights, critical risks may go unnoticed.
- Are Access Review Processes Documented?
- Auditors will expect clear evidence of how access reviews are conducted, the independence included, how the results are assessed, and how changes are implemented.
The Challenges of Unstructured Access Review Reports
Unstructured reports often present the following challenges:
- Volume of Data: Hundreds of pages of raw data can be overwhelming to sift through manually.
- Lack of Context: Reports may list permissions or codes without explaining their relevance or risk level.
- Inefficiency: Extracting actionable insights from unstructured reports can be time-consuming and prone to error.
Three Questions to Ask Before Finalizing Your Management Attestation
To ensure that access reviews are effectively incorporated into the FDICIA attestation, ask the following:
- How Complicated Is the Access Review Process?
- Are the reports structured and easy to interpret, or do they require extensive manual effort?
- Are Privileged Permissions Highlighted in Reports?
- Do reports clearly identify high-risk accounts and permissions?
- Ensure these permissions are reviewed with extra scrutiny.
- How Are Changes Highlighted Since the Last Review?
- Can reports easily identify access changes made since the last review?
- Highlighting deltas helps detect anomalies quickly.
- Have all terminated employees been removed from systems?
- Integrating termination governance to access reviews addresses one of the biggest risks with access management and a common audit finding.
- Is there independence in the access review?
- Community banks often struggle with independence during the access reviews as the system owner may be the best person to review the access reports; however, segmentation of duties and independence are a key part of the need for performing access reviews based on FFIEC Guidance.
If all of this sounds complicated and complex, the team at Finosec is here to help. We’re committed to creating resources to guide you on your compliance journey, and our experts are ready to discuss how Governance360 can streamline your access reviews and strengthen your FDICIA compliance efforts.