DRAFT Risk Control Matrix

Process - ITGC

Sr. No. Sub-Process Activity Risk ID Perceived Risk Description

Access Management User Access R-ITGC-2 User access privileges of left

Termination employees are not timely
revoked

Access Management

Security
Management
Security
Management

Security
Management
Security
Management
Security
Management
Security
Management
Computer
Operations

Security Information R-ITGC-41 Security management practices

Management Security Policy are not in place
Existing Process /Control Description

Upon resignation or retirement of employee, HR forwards

clearance form to Manager - IT for IT assets held by concerned
employee

IT security policy in place.

 compare it policy and identify gaps
Gap Identified Suggested Control

1. This is being done only for assets and not 1. (a) On resignation or Termination of employee
for other accesses revokation provided to Department head should inform IT and HR department
exiting employee, apart from SAP ID immidiately. 1 (b) IT
department should remove accesses immidiately

1.Policy is not approved by BOD,Policy is Policy should be approved by BOD ,should be regulerly
not regulerly reviewed and updated .Policy reviewed and updated.Policy should be implemented in
implementated in informal way and 100 % formal way by way of undertaking from all employees
implenattion is not enured and reguler uwareness program.
Reference Remark observation Control Owner Frequency of
Document Control/s
1. HR As and when
2. Sr Manager IT

3. Manager IT and
Sr Manager IT

refer security
policy in it
policy
Key Control Nature of Type of Control
Control
Yes Detective(Based Manual + Automated
on email)