Termination of users
System Access and Termination Procedure Termination of users
OBJECTIVE
The objective of this System Access and Obtain a sample list of emails requesting the
Termination Procedure is to ensure that only termination of user
authorized user creations and amendments are
done on user IDs so as to reduce the number of Compare these emails against the datastore
fraudulent activities resulting from unauthorized report
user creations and role amendments where a
user is given roles that they are not supposed Obtain a list of circulars from HR requsting for the
have and to ensure that there are no disruptions termination of users
to service due to users having wrong user roles
in the system.
The Flexcube, Exergy, Agilis and GSAM Up user list
report is availed on Datastore every month and
Branch Managers and Heads of Departments are to
advise IT Service Desk of any changes for them to
disable or make amendments.
Users are terminated on the basis of an email sent
by Branch Managers or Heads of Departments in
response to user lists reports availed to Branch
Managers and Head of departments.
Users are terminated on the basis of a circular sent
User Termination
by Human Resources Department
Determine whether user termination
Heads of Departments and Branch Managers send procedures trigger automatic updates to the
an email to disable a user as and when a user User Access Management system to remove
leaves the employ of the Group access permissions.
Determine whether end-of-contract procedures
For all systems, an email instruction or trigger automatic updates to the User Access
memorandum from the Branch Manager or Unit Management system to remove access
Manager to delete/ disable will suffice. permissions.
If termination and end-of-contract events do
not trigger automatic User Access Management
updates, determine how the User Access
That managers may request user information as Management administrator receives
and when they require it and ask IT Service Desk notification of these events.
to disable any user IDs that are no longer Determine whether the procedures are the same
required through the IT Service Desk call logging for voluntary and involuntary terminations. If
system, Manage Engine not, obtain explanations.
Interview User Access Management and HR
staff to ensure that there are no gaps in the
notification process.
User Termination and Transfer Determine whether formal procedures exist for
User access is disabled, immediately, upon termination. periodic reviews of termination of temporary
When a user’s duties change, access permissions are users.
immediately modified in accordance with the user’s Determine whether formal procedures are in
new job functions. place for the periodic review and follow-up of
the list of terminated users.
User Termination Determine whether the disabling of the user ID
is formally confirmed by the User Access
Control: User IDs are immediately disabled upon
Management administrator to the terminated
termination of employment.
user’s supervisor.
Obtain a list of terminated users, including
contractors. If necessary, select a sample from
the list.
For involuntary terminations and end-
of-contract cases, determine the date
and time of the termination, and
compare them to the date and time that
the user ID was disabled. Obtain
explanations for unexpected delays.
For voluntary terminations, determine
whether the user ID was disabled within
a reasonable period after the termination
