Audit 405578

Condition 1. The Health System performed and documented a Workday change review during the fiscal year; however, we noted appropriate evidence of testing and/or approval was not maintained for 4 of 25 sampled changes during the period. 2. The Health System performed a Workday User Access Review (UAR) during the fiscal year and maintained certain evidence demonstrating the UAR occurred; however, management did not retain the screenshot of the Workday report utilized for the User Access Review (UAR). Additionally, the individual performing the review also had access to the system, resulting in the individual reviewing and validating their own access. 3. Management did not consistently implement controls to ensure that privileged user access was limited to active individuals in support of their roles and responsibilities. Specifically, there were five vendors with Implementer access, which enables the implementation and migration of changes, who did not require that level of access during the period. Cause The conditions above relate to the following, respectively: 1. The condition occurred because the Health System did not have a centralized process for maintaining evidence of testing and approval for changes. 2. The condition occurred because the Health System did not include processes to implement separation of duties controls when the reviewer was included in the population or processes to include screenshots of the listing used to support the completeness and accuracy of the list. 3. This condition occurred because Implementer access was not included as part of the Workday UAR. Recommendation We recommend that management review and emphasize the change management policies and procedures with key personnel and establish a centralized process to ensure that evidence related to the review, testing, and approval of all Workday changes is maintained. Additionally, we recommend that management enhance the Workday UAR process to incorporate segregation of duties, preventing individuals from reviewing their own access, and to ensure that documentation, such as system-generated reports or screenshots, is retained to support the completeness and accuracy of the review. The scope of the UAR should be expanded to formally include a review of all privileged-level access, such as the Implementer role, to ensure this access is appropriate and promptly removed when no longer required.