SOC 2 Evidence Router
12 control exceptions on 10 of 18 IAM accounts: 2 terminated employees still have active access and 2 privileged accounts lack MFA.
HR terminated Grace Liu on 2026-08-25, but the account signed in on 2026-08-31, 2026-08-31 - 2026-08-25 = 6 days later, so it was still enabled past the 1-day SLA. The export has no deactivation date.
Method1IAM accounts are matched to the HR roster by email (case-insensitive), then by employee id.
2Terminated and still active: the removal SLA of 1 day(s) has passed since the HR termination date (CC6.2, CC6.3). Inside the SLA the account is marked Remove but not raised as an exception.
| Exception ID | Account | |
|---|---|---|
| EX-001 | Grace Liu | grace.liu@fernhill.example |
| EX-002 | svc-backup | svc-backup@fernhill.example |
| EX-003 | Sam Okafor | sam.okafor@fernhill.example |
IAM user export, plus the HR roster with termination dates
Access review workpaper and control exceptions (CC6.1, CC6.2, CC6.3) (Quarterly access review workpaper (18 accounts), Control exception list (12))
$2,500 / month, 30% to the referring partner
Read in memory for the session, never stored, never used to train a model.
Privacy and security findings are not legal advice or an audit opinion. Confirm them with privacy counsel or a qualified assessor.