Does the Audit Flag It? — TechKnowSurge

About this interactive

Auditing means inspection: checking that what the company said it would do is really being done. Things drift out of line, and an audit catches it. The lesson's example is the account life cycle. Errors at provisioning usually fix themselves, because the user complains that something does not work. Errors later do not. When someone changes position, they may get the new access without losing the old, and end up with more than either job needs. When someone leaves, the account may not be shut off. So an audit takes the list from HR and compares it with the accounts, monthly, quarterly or yearly, and checks that each account reaches only the resources its role needs. Out of line: an account still active after its owner left, rights kept from an old job, access the role does not need, an account that matches no one on HR's list, an account switched back on with no record of why. In line: access that matches the role, removed on time, or ending on a date that is set and documented. The lesson's other point, who does the auditing (a self-assessment, someone internal from another department, or an outside third party), is practised in the Security Functions module.

What you'll learn

Audit accounts against HR's records the way the Auditing lesson does, and flag the ones that are out of line: a leaver still active, rights kept after a change of job, access a role does not need, an account nobody owns
Tell an account that is out of line from one that only looks unusual, such as a contractor's access that ends with the contract

Aligned to

CompTIA Security+

5.5 Explain types and purposes of audits and assessments.

4.6 Given a scenario, implement and maintain identity and access management.

NIST 800-53

CA-2 Control Assessments

Key terms

IT Audit: A systematic inspection of IT processes, controls, and systems to identify misalignments and verify that established procedures are being followed correctly.
Self-Assessment: An internal audit in which an organization evaluates its own processes and controls; less costly than external audits but limited by potential bias and conflicts of interest.
Permissions: The defined access rights granted to users, groups, or objects that control what resources they can access or modify.

Topics

It Auditing Account Lifecycle Management Internal Audit Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →