Defining User access appropriateness confirmation process for organization 

 Challenge 

 I am a SOX compliance lead in a multi - national organization . As part of assurance on   Information technology general controls , organization need to ensure that all the ERP   accesses provided to its 20000 users ( employees & others ) at the point of verification , is   appropriate for the role which the user is playing . These are specific requirements sought by   statutory auditors considering significant importance of regulatory requirements to ensure   completeness and accuracy of the financial reporting numbers in the books of accounts and   other regulatory disclosures . For the year 2019 - 2020 , my team along with IT application team   spent significant time to identify the users for whom access appropriateness confirmations   have to be obtained and approached various employees of the organization over emails / calls   to get this confirmation . Wherever the user confirmed that access of a specific user is   inappropriate , immediate revocation action need to be taken by BASIS team . Considering the   efforts put in FY19 - 20 , we have decided to automate this entire process for FY20 - 21 . 

 Selection 

 We have consulted multiple service providers and senior management personnel to   understand their perspective of this problem and analyzed various tools applicable to address   the problem , within assigned budget . One of the option was to develop the in house tool in   lotus notes application , which does not incur much cost , but the efforts required in   maintaining data base in line with ERP is phenomenal . Alternate approach was to deploy GRC   access control application applicable for existing ERP package , which already has all the data   flowing from existing ERP and hence , no additional efforts required in maintaining data base .   We went ahead with access controls in GRC module and engaged a consultant to implement   the same . 

 Application 

 Initially IT application team was resistant to go ahead with this application due to some   practical challenges , like they want to exclude some select users for appropriateness   confirmation ( like senior management personnel , employees for whom reporting managers   are not mapped in ERP , etc . , ) . After discussing with consultants and HR teams , we finalized   an approach to eliminate some users in this process and initiate confirmation process to   remaining users . 

 Insights 

 During the discussions , we have also noted some of the best practices that we are not   following . Current access granting mechanism in the organization did not define role owner , 

 who has to review the roles which user is requesting and question whether such access need   to be given or not and accordingly approve . While , we wanted to build this approach in our   ERP system , considering deadlines for current year , we went ahead and implemented access   control with current ERP set up , but management agreed to set up role owner concept in next   financial year . 

 Approach 

 Considering the timelines required for implementation , we wanted to adopt an agile   approach . We formed a task force under my leadership and involved cross functional teams .   Weekly reviews are conducted to understand the problems and to discuss solutions , and   tracking of the solutions is done through another in - house tool built for tracking purpose . 


EMAIL: 
ID_NUM: 
NAME_STUDENT: 
PHONE_NUM: 
STREET_ADDRESS: 
URL_PERSONAL: 
USERNAME: 

### Task: You are a PII (Personal Identity Information) Detection. Given a essays written by students, you have to identify ONLY the following:
NAME_STUDENT - The full or partial name of a student that is not necessarily the author of the essay. This excludes instructors, authors, and other person names.
EMAIL - A student’s email address.
USERNAME - A student's username on any platform.
ID_NUM - A number or sequence of characters that could be used to identify a student, such as a student ID or a social security number.
PHONE_NUM - A phone number associated with a student.
URL_PERSONAL - A URL that might be used to identify a student.
STREET_ADDRESS - A full or partial street address that is associated with the student, such as their home address.
### Input: Defining User access appropriateness confirmation process for organization 

 Challenge 

 I am a SOX compliance lead in a multi - national organization . As part of assurance on   Information technology general controls , organization need to ensure that all the ERP   accesses provided to its 20000 users ( employees & others ) at the point of verification , is   appropriate for the role which the user is playing . These are specific requirements sought by   statutory auditors considering significant importance of regulatory requirements to ensure   completeness and accuracy of the financial reporting numbers in the books of accounts and   other regulatory disclosures . For the year 2019 - 2020 , my team along with IT application team   spent significant time to identify the users for whom access appropriateness confirmations   have to be obtained and approached various employees of the organization over emails / calls   to get this confirmation . Wherever the user confirmed that access of a specific user is   inappropriate , immediate revocation action need to be taken by BASIS team . Considering the   efforts put in FY19 - 20 , we have decided to automate this entire process for FY20 - 21 . 

 Selection 

 We have consulted multiple service providers and senior management personnel to   understand their perspective of this problem and analyzed various tools applicable to address   the problem , within assigned budget . One of the option was to develop the in house tool in   lotus notes application , which does not incur much cost , but the efforts required in   maintaining data base in line with ERP is phenomenal . Alternate approach was to deploy GRC   access control application applicable for existing ERP package , which already has all the data   flowing from existing ERP and hence , no additional efforts required in maintaining data base .   We went ahead with access controls in GRC module and engaged a consultant to implement   the same . 

 Application 

 Initially IT application team was resistant to go ahead with this application due to some   practical challenges , like they want to exclude some select users for appropriateness   confirmation ( like senior management personnel , employees for whom reporting managers   are not mapped in ERP , etc . , ) . After discussing with consultants and HR teams , we finalized   an approach to eliminate some users in this process and initiate confirmation process to   remaining users . 

 Insights 

 During the discussions , we have also noted some of the best practices that we are not   following . Current access granting mechanism in the organization did not define role owner , 

 who has to review the roles which user is requesting and question whether such access need   to be given or not and accordingly approve . While , we wanted to build this approach in our   ERP system , considering deadlines for current year , we went ahead and implemented access   control with current ERP set up , but management agreed to set up role owner concept in next   financial year . 

 Approach 

 Considering the timelines required for implementation , we wanted to adopt an agile   approach . We formed a task force under my leadership and involved cross functional teams .   Weekly reviews are conducted to understand the problems and to discuss solutions , and   tracking of the solutions is done through another in - house tool built for tracking purpose .
### Output: 