Top 10 Access Control Violations

• Unidentified or unresolved segregation of duties
• OS access controls on financial apps or portal not secure
• DB access supporting financial applications not secure
• Dev staff can run business transactions in production
• Lots of users with access to "super user" transactions
• Previous employees or consultants have system access
• Posting periods not restricted within GL application
• Custom programs, tables and interfaces are not secured
• Procedures for manual processes do not exist or not followed
• System docs do not match actual process