Audit User Access at a Fictional Company

Create an evidence-backed user-access audit workpaper and management report.

Introduction

30 Second Summary

People move through companies faster than their system access sometimes changes. One forgotten account can leave sensitive business systems exposed.

In this project, you will conduct a user access audit for a fictional company called BluePeak Services. Your evidence becomes a traceable Microsoft Excel audit workpaper plus a management-ready Microsoft Word audit report.

What You'll Build

Picture opening your finished audit package to show five risk-rated findings with the evidence trail behind every conclusion.

By the end of this project, you'll have:

A traceable audit workpaper that lets you connect each conclusion to its control criteria plus its source evidence.
A workforce reconciliation that reveals two departed workers whose accounts still have access.
A management-ready audit report that presents five risk-rated findings mapped to CIS Controls Navigator v8.1 criteria plus NIST Cybersecurity Framework 2.0 outcomes.
Secret Mission: A preserved remediation copy plus a documented retest that closes the departed-worker finding without altering the original evidence.

Are there any prerequisites?

You'll need basic spreadsheet editing skills in Microsoft Excel plus basic document editing skills in Microsoft Word on a Mac. No cloud account, live company access, or security testing authorization is required.

Before We Start

Before you examine any evidence, this checkpoint fixes the purpose of your audit. You are assessing whether BluePeak Services' fictional user access is authorized, current, appropriately privileged, and protected by MFA because unauthorized or excessive access can harm the business.

Set Up the Audit Evidence Pack

A defensible audit depends on organized audit evidence. Scattered source files make later conclusions harder to trace.

This step gives the BluePeak Services audit one local home in Finder.

Microsoft Excel holds your workpaper. Microsoft Word holds your report.

In this step, get ready to:

Create a local folder for the audit evidence pack.
Prepare an Excel workpaper with six blank worksheets.
Save a blank Word report beside the workpaper.

Create the project folder

A single project folder gives every audit file a predictable location. That location becomes the starting point for each later test.

Click Finder in the Dock.
Open Documents by pressing Shift-Command-O.

You should see the contents of your Documents folder.

Create a new folder by pressing Shift-Command-N.

You should see a new folder name ready for typing.

Type IT_Audit_User_Access as the folder name.
Press Return.

Your audit now has a dedicated home inside Documents. Every file you create in this project stays together there.

Build the Excel workpaper

An audit workpaper records what was tested. It also shows how the auditor reached each conclusion.

Press Command-Space bar to open Spotlight.
Type Microsoft Excel in the search field.
Press Return.

You should see Microsoft Excel open.

Select Blank workbook.

You should see a new workbook with at least one worksheet tab.

Select New Sheet until six worksheet tabs are visible.

You should now see six blank worksheet tabs along the bottom of the workbook.

Double-click the first worksheet tab name.
Type Scope.
Press Return.

The first worksheet tab should now display Scope.

Rename the second worksheet Account_Inventory.
Rename the third worksheet Active_Roster.
Rename the fourth worksheet Departures.
Rename the fifth worksheet Role_Matrix.
Rename the sixth worksheet Workpaper.

The tabs should appear as Scope, Account_Inventory, Active_Roster, Departures, Role_Matrix, and Workpaper from left to right.

Why six worksheets?

The Scope worksheet anchors the audit boundary. The four middle worksheets preserve the evidence sources used later.

The Workpaper worksheet records the testing trail. It connects each procedure to its supporting evidence.

Leave every worksheet blank.
Press Command + S to save the workbook.

Because this is the first save, Excel opens the Save As window.

Enter User_Access_Audit_Workpaper in the Save As box.
Choose Documents/IT_Audit_User_Access as the save location.

The save location should now point to your project folder.

Select Excel Workbook (.xlsx) from File Format.
Click Save.

Excel should now show User_Access_Audit_Workpaper in the workbook title.

Tabs missing or out of order?

Select New Sheet until six tabs are visible.
Drag the worksheet tabs until they match the required order.
Press Command + S to save the corrected workbook.

Ask for help with the workbook structure: help me correct the worksheet names and order in my Excel audit workpaper.

Save and verify the Word report

Management eventually needs a concise report based on tested evidence. Saving the blank report now reserves a separate place for that final output.

Press Command-Space bar to open Spotlight.
Type Microsoft Word in the search field.
Press Return.

You should see Microsoft Word open.

Select Blank document.

You should see an empty Word page ready for the report.

Leave the document blank.
Press Command + S to save the document.

Word opens the Save As window for the new document.

Enter User_Access_Audit_Report in the Save As box.
Choose Documents/IT_Audit_User_Access as the save location.

The report now points to the same local folder as the workpaper.

Select Word Document (.docx) from File Format.
Click Save.

Word should now show User_Access_Audit_Report in the document title.

Why save a blank report?

The report stays empty until the workpaper contains supported findings. This keeps management conclusions tied to completed audit tests.

Before you reopen the files, do you expect the project folder to contain one Excel workbook plus one Word document?

Close the Word document by pressing Command + W.
Switch back to Microsoft Excel by clicking its icon in the Dock.
Close the Excel workbook by pressing Command + W.
Return to Finder by clicking its icon in the Dock.
Double-click IT_Audit_User_Access in the Documents window from earlier.

You should see User_Access_Audit_Workpaper.xlsx plus User_Access_Audit_Report.docx inside the folder.

Double-click User_Access_Audit_Workpaper.xlsx.

Excel should reopen the saved workpaper.

Return to Finder by clicking its icon in the Dock.
Double-click User_Access_Audit_Report.docx.

Word should reopen a separate blank document.

Switch back to Microsoft Excel by clicking its icon in the Dock.

You should see six blank worksheets in this order: Scope, Account_Inventory, Active_Roster, Departures, Role_Matrix, and Workpaper.

Both audit files are now open in their separate applications.

Files missing or failing to reopen?

Return to Documents/IT_Audit_User_Access in Finder.
Confirm the workbook ends with .xlsx.
Confirm the report ends with .docx.

Ask for help locating or reopening the files: help me find and reopen my saved Excel workpaper and Word audit report on my Mac.

That is the audit foundation in place. Next, you will define the scope and inspect the first account export.

Perform the First Account Review

Your audit evidence pack is ready. The open Microsoft Excel workbook gives each test a traceable home.

This first review tests how far one account export can support an audit conclusion. You will check administrative multi-factor authentication before testing whether the same export proves current authorization.

In this step, get ready to:

Document the audit boundary with its control criteria.
Load the ten supplied account records into the workbook.
Test what the account inventory can support.

Define the audit boundary

An audit objective states the question your work must answer. The scope identifies the accounts covered by that question.

Control criteria make each audit conclusion traceable to a stated requirement.

Why use two standards?

The CIS Controls Navigator v8.1 supplies detailed safeguards for the tests.

The NIST Cybersecurity Framework (CSF) 2.0 supplies higher-level outcomes for risk framing. The workpaper keeps both layers visible.

Switch back to the User_Access_Audit_Workpaper.xlsx workbook from earlier.
Select the Scope worksheet tab.
Enter Audit Date in cell A1.
Enter 2026-09-12 in cell B1.
Enter Objective in cell A2.
Enter determine whether accounts are authorized, current, appropriately privileged, and protected by required MFA in cell B2.

You should now see the audit date above a one-sentence objective on the Scope sheet.

Enter Scope in cell A3.
Enter supplied user, administrator, and service accounts in cell B3.
Enter CIS Criteria in cell A4.
Enter CIS Safeguards 5.1, 5.3, 5.5, 6.2, 6.5, and 6.8 in cell B4.
Enter NIST Outcomes in cell A5.
Enter NIST CSF 2.0 outcomes PR.AA-01, PR.AA-03, and PR.AA-05 in cell B5.
Save the changes to User_Access_Audit_Workpaper.xlsx.

You should see five populated rows covering the audit date, objective, scope, CIS criteria, and NIST outcomes.

Load the supplied account inventory

An account inventory is the source list of identities with current access. Keeping the supplied values unchanged preserves the evidence you are about to test.

Select the Account_Inventory worksheet tab.
Enter the headers from A1 through G1 as Account_ID, Employee_ID, Person_Name, Account_Type, Status, Assigned_Access, MFA.
Enter the headers from H1 through N1 as Last_Sign_In, Start_Date, Stop_Date, Department, Department_Owner, Service_Review_Date, Purpose.

You should see fourteen headers across row 1. The first header is Account_ID in column A.

Enter row 2 with A2 maya.patel, B2 E001, C2 Maya Patel, D2 User, E2 Enabled, F2 Financial Analyst, G2 Yes, H2 2026-09-10, I2 2024-03-18, K2 Finance.
Enter row 3 with A3 liam.chen, B3 E002, C3 Liam Chen, D3 User, E3 Enabled, F3 Finance Manager, G3 Yes, H3 2026-09-08, I3 2021-07-12, K3 Finance.

You should now see two Finance user records beneath the headers.

Enter row 4 with A4 sofia.ramirez, B4 E003, C4 Sofia Ramirez, D4 User, E4 Enabled, F4 Global Administrator, G4 Yes, H4 2026-09-11, I4 2025-02-03, K4 IT.
Enter row 5 with A5 noah.williams, B5 E004, C5 Noah Williams, D5 User, E5 Enabled, F5 IT Staff, G5 Yes, H5 2026-09-11, I5 2020-10-19, K5 IT.

You should now see two IT user records in rows 4 and 5.

Enter row 6 with A6 noah.admin, B6 E004, C6 Noah Williams, D6 Administrator, E6 Enabled, F6 Global Administrator, G6 No, H6 2026-09-12, I6 2020-10-19, K6 IT, N6 Privileged administration.
Enter row 7 with A7 amina.yusuf, B7 E005, C7 Amina Yusuf, D7 User, E7 Enabled, F7 Sales Representative, G7 Yes, H7 2026-06-01, I7 2023-11-06, K7 Sales.

Rows 6 and 7 should now contain the administrator record plus the first Sales record.

Enter row 8 with A8 ethan.brooks, B8 E006, C8 Ethan Brooks, D8 User, E8 Enabled, F8 Sales Manager, G8 Yes, H8 2026-09-09, I8 2022-05-23, K8 Sales.
Enter row 9 with A9 olivia.martin, B9 E007, C9 Olivia Martin, D9 User, E9 Enabled, F9 HR Specialist, G9 Yes, H9 2026-09-01, I9 2024-01-08, K9 HR.

You should now see the Sales Manager record followed by the HR Specialist record.

Enter row 10 with A10 lucas.silva, B10 E008, C10 Lucas Silva, D10 User, E10 Enabled, F10 CRM User, G10 Yes, H10 2026-09-04, I10 2026-03-02, K10 Sales, N10 Contractor access.
Enter row 11 with A11 svc.backup, C11 Service account, D11 Service, E11 Enabled, F11 Backup Operator, G11 Not applicable, H11 2026-09-12, I11 2025-01-15, K11 IT, N11 Nightly backup job.

The inventory should now end with a contractor account in row 10 and a service account in row 11.

Save the changes to User_Access_Audit_Workpaper.xlsx.

The Account_Inventory sheet should contain one header row plus ten account records. Unspecified cells should remain empty.

Rows shifted into the wrong columns?

Check that Account_ID is in cell A1.
Check that Purpose is in cell N1.
Confirm that cells omitted from each supplied record remain empty.

Help me find why my Account_Inventory rows are shifted.

Test what the inventory can prove

Control testing compares evidence against a criterion. A defensible conclusion only reaches as far as the available evidence supports.

Select the Account_Inventory worksheet tab.
Scan Account_Type in column D for an administrator account.

You should find noah.admin in row 6.

Read the values from E6 through G6.

You should see Enabled, Global Administrator, and No. This is a preliminary exception against the administrative MFA criterion.

Select the Workpaper worksheet tab.
Enter Preliminary exception: noah.admin is an enabled Global Administrator account with MFA set to No. in cell A1.
Enter Evidence reference: Account_Inventory. in cell A2.

Your first test now has a named account, a visible condition, and a source reference.

Before you inspect the broader evidence, predict whether every enabled account will have independent proof of current authorization.

Return to the Account_Inventory worksheet tab.
Inspect the sheet for an independent source that confirms current employment for each enabled human account.

You will find identifiers plus dates inside the account export. You will find no independent source that confirms current employment.

This evidence gap is the intended result of the test. The export cannot support a conclusion that every enabled account is currently authorized.

Why is insufficient evidence valid?

Evidence sufficiency asks whether the available material can support the audit conclusion. Insufficient evidence records that the current source cannot answer the test question.

This conclusion prevents missing proof from being treated as authorization.

Return to the Workpaper worksheet tab.
Enter Are all enabled accounts currently authorized? in cell A4.
Enter Insufficient evidence in cell A5.

The authorization test now has a named question plus a clear conclusion.

Enter No independent employment-status evidence is available. in cell A6.
Save the changes to User_Access_Audit_Workpaper.xlsx.

Before the final check, predict whether the Workpaper will show one conclusion or two different evidence outcomes.

Review cells A1 through A6 on the Workpaper sheet.

Your Workpaper should show noah.admin as a preliminary exception. It should also show Insufficient evidence for the active-account authorization test because no independent employment-status evidence is available.

Workpaper result missing?

Check cell A1 for the preliminary exception involving noah.admin.
Check cell A5 for the exact conclusion Insufficient evidence.
Check cell A6 for the missing independent employment-status evidence reason.

Help me check why my Workpaper does not show both review outcomes.

That is a strong audit habit. Your Workpaper now separates a supported exception from an honest evidence limitation.

Your first account review is documented. Next, you will add independent workforce evidence to resolve the authorization question.

Reconcile Workforce Evidence

Your first account review exposed an administrator account without MFA. It also left account authorization unresolved because the inventory lacked employment status.

This step adds independent workforce evidence to Microsoft Excel. A reconciliation then matches each enabled human account to a current worker or a documented departure.

Why use two workforce sources?

The active roster confirms who currently works at BluePeak Services. The departures list explains why a missing worker no longer qualifies as authorized.

Together, these sources resolve the evidence limitation recorded during your first account review.

In this step, get ready to:

Add the current workforce evidence to Active_Roster.
Add the departure evidence to Departures.
Reconcile every enabled human account by Employee_ID.

Add current workforce evidence

The Active_Roster sheet provides an independent list of current workers. Its Employee_ID values give you a reliable key for matching people to accounts.

Switch back to User_Access_Audit_Workpaper in Microsoft Excel.
Select the Active_Roster worksheet tab.
Select cell A1.
Copy the tab-separated workforce evidence below:

Employee_ID	Name	Department	Job_Role
E001	Maya Patel	Finance	Financial Analyst
E002	Liam Chen	Finance	Finance Manager
E003	Sofia Ramirez	IT	IT Support Specialist
E004	Noah Williams	IT	IT Administrator
E005	Amina Yusuf	Sales	Sales Representative
E006	Ethan Brooks	Sales	Sales Manager

What does this evidence prove?

Each Employee_ID links a current worker to the corresponding account inventory record.
The roster establishes that E001 through E006 belong to the current workforce.
The job role provides context for later access testing.

Paste the copied evidence into cell A1.
Save User_Access_Audit_Workpaper.

Good progress. Your Active_Roster sheet should show one header row followed by six current-worker records.

Did the evidence appear in one column?

Undo the paste if every value landed in column A. Use Excel's text import options to separate the values at each tab.

Make sure cell A1 is selected before pasting again.

Help me separate tab-delimited workforce data into Excel columns.

Add departure evidence

A missing active-roster match signals a possible exception. The Departures sheet provides the date plus the reason needed to evaluate that gap.

Select the Departures worksheet tab.
Select cell A1.
Copy the tab-separated departure evidence below:

Employee_ID	Name	End_Date	Departure_Type
E007	Olivia Martin	2026-08-31	Terminated
E008	Lucas Silva	2026-09-05	Contract ended

What does this evidence prove?

The end date establishes when each person's workforce relationship ended.
The departure type distinguishes a termination from the end of a contract.
An enabled account linked to either record lacks current workforce authorization.

Paste the copied evidence into cell A1.
Save User_Access_Audit_Workpaper.

That closes the missing context from your first review. Your Departures sheet should show records for E007 plus E008.

Are the departure dates displayed incorrectly?

Confirm that Olivia Martin's date reads 2026-08-31. Confirm that Lucas Silva's date reads 2026-09-05.

Re-enter either value exactly as supplied if Excel changed its meaning.

Help me correct the two departure dates in Excel.

Reconcile enabled human accounts

Manual matching can feel fiddly because E004 appears on two account rows. Both rows still use the same workforce identity for this authorization test.

Before you compare the records, how many enabled human accounts do you think will fail to match the current roster?

Return to the Account_Inventory worksheet.
Review each row whose Account_Type is User or Administrator.
Keep each reviewed row whose Status is Enabled in the test.
Exclude svc.backup because its Account_Type is Service.
Match each remaining Employee_ID against Active_Roster.
Check Departures for each Employee_ID without an active-roster match.

You should find active-roster matches for every enabled human account linked to E001 through E006. The accounts olivia.martin/E007 plus lucas.silva/E008 should produce authorization exceptions.

A traceable workpaper records the result for each tested account. It also names the source that supports the decision.

Switch back to the Workpaper worksheet.
Leave the preliminary noah.admin MFA exception unchanged.
Select the first blank row beneath the existing active-account authorization test.
Copy the reconciliation record below:

Account_ID	Employee_ID	Result	Evidence Reference
maya.patel	E001	Match	Account_Inventory, Active_Roster
liam.chen	E002	Match	Account_Inventory, Active_Roster
sofia.ramirez	E003	Match	Account_Inventory, Active_Roster
noah.williams	E004	Match	Account_Inventory, Active_Roster
noah.admin	E004	Match	Account_Inventory, Active_Roster
amina.yusuf	E005	Match	Account_Inventory, Active_Roster
ethan.brooks	E006	Match	Account_Inventory, Active_Roster
olivia.martin	E007	Authorization exception	Account_Inventory, Departures
lucas.silva	E008	Authorization exception	Account_Inventory, Departures

How does this support the conclusion?

A Match means the enabled account's Employee_ID appears on the current roster.
An Authorization exception means the account remains enabled after the person's documented departure.
The noah.admin match addresses workforce authorization only. Its separate MFA exception remains valid.

Paste the reconciliation record into the selected blank row.
Replace the existing Insufficient evidence conclusion with Authorization exceptions identified.
Save User_Access_Audit_Workpaper.

Before you inspect the finished workpaper, do you expect the prior evidence limitation to remain?

Review the active-account authorization test in Workpaper.

You should see active-roster matches for E001 through E006. You should also see authorization exceptions for olivia.martin/E007 plus lucas.silva/E008.

The evidence references should collectively cite Account_Inventory, Active_Roster, and Departures. The preliminary noah.admin MFA exception should remain unchanged.

Strong work. Your workpaper now supports an evidence-backed authorization conclusion.

Does the conclusion still say insufficient evidence?

Confirm that all nine enabled human accounts appear in the reconciliation record. Make sure both departed-worker rows show Authorization exception.

Check that Account_Inventory, Active_Roster, and Departures appear across the evidence references.

Help me debug my workforce reconciliation results.

Your authorization test now rests on independent workforce evidence. Next, you will turn the complete exception set into risk-rated findings.

Complete the Control Tests

Your workforce reconciliation exposed two departed people whose accounts still have enabled access. Those exceptions now need a defensible audit trail.

A defensible finding connects each exception to a criterion. Its evidence trail carries the test through risk, corrective action, and conclusion.

In this step, get ready to:

Populate the approved access model in the role matrix.
Test four additional access-control exceptions against the available evidence.
Complete five risk-rated findings in the audit workpaper.

Add the approved access model

The Role_Matrix worksheet defines the access that BluePeak Services approves for each job role. This baseline helps you identify privileges that exceed a person's business responsibilities.

Select the Role_Matrix worksheet in the Microsoft Excel workbook from earlier.
Populate the worksheet by pasting this tab-separated access model into the first empty cell:

Job_Role	Required_Standard_Access	Permitted_Admin_Access
Financial Analyst	Financial Analyst	None
Finance Manager	Finance Manager	None
IT Support Specialist	Helpdesk Operator	None
IT Administrator	IT Staff	Global Administrator on a dedicated administrator account
Sales Representative	Sales Representative	None
Sales Manager	Sales Manager	None

What Does This Data Establish?

The Required_Standard_Access column defines the approved everyday access for each job.
The Permitted_Admin_Access column limits privileged access to approved circumstances.
The IT Administrator row permits Global Administrator access only through a dedicated administrator account.

Save User_Access_Audit_Workpaper.xlsx.
Count the populated role rows beneath the header.

You should count six role rows. Your role matrix now gives every privilege test an approved baseline.

Did the Data Paste Incorrectly?

Undo the paste if every value landed in one cell.
Copy the block again from the first header through the final None value.
Paste the copied data into one empty cell in Role_Matrix.

Help me fix tab-separated role data that pasted into the wrong Excel cells.

Test the remaining exceptions

The detailed criteria come from CIS Controls Navigator v8.1. The NIST Cybersecurity Framework 2.0 connects each exception to a broader security outcome.

How Should I Assign Ratings?

These ratings form the project rubric for this audit exercise.

Use High for unauthorized or privileged access that could cause significant business impact.
Use Medium for an access-hygiene or ownership gap that increases risk without confirmed misuse.
Use Low for a minor documentation issue.

Compare amina.yusuf's last sign-in date of 2026-06-01 with the audit date of 2026-09-12.
Compare noah.admin's administrator account type with its MFA value of No.
Compare sofia.ramirez's assigned Global Administrator access with the required Helpdesk Operator access in Role_Matrix.
Inspect the Department_Owner field plus the Service_Review_Date field for svc.backup.

What Should I See?

The amina.yusuf account exceeds 45 days of inactivity. This supports finding F-02 with a Medium rating under CIS 5.3 plus NIST PR.AA-01.
The noah.admin account lacks administrative MFA. This supports finding F-03 with a High rating under CIS 6.5 plus NIST PR.AA-03.
The sofia.ramirez account exceeds the approved access for an IT Support Specialist. This supports finding F-04 with a High rating under CIS 6.8 plus NIST PR.AA-05.
The svc.backup record lacks an owner plus a review date. This supports finding F-05 with a Medium rating under CIS 5.5 plus NIST PR.AA-01.

Build the final finding register

The Workpaper worksheet is the final audit trail. Each row lets a reviewer trace one conclusion back to its procedure plus supporting evidence.

Switch back to the Workpaper worksheet from earlier.
Select the existing used cells in the worksheet.
Clear the preliminary working rows.
Populate the final register by pasting this tab-separated data into the first empty cell:

Finding ID	Objective	Criterion	Procedure	Evidence Reference	Result	Rating	Risk	Recommendation	Auditor Conclusion
F-01	Determine whether enabled accounts are currently authorized.	CIS 5.1 and 6.2, NIST PR.AA-01	Compare enabled human accounts in Account_Inventory to Active_Roster and Departures by Employee_ID.	Account_Inventory: olivia.martin and lucas.silva. Departures: E007 and E008.	olivia.martin and lucas.silva remain Enabled after departure.	High	Former workers could access business systems or data after departure.	Disable departed access.	Exception confirmed. Controls for timely access revocation need improvement.
F-02	Determine whether dormant enabled accounts are disabled.	CIS 5.3, NIST PR.AA-01	Compare Last_Sign_In to the 2026-09-12 audit date and identify inactivity over 45 days.	Account_Inventory: amina.yusuf. Last_Sign_In: 2026-06-01.	amina.yusuf remains Enabled after more than 45 days of inactivity.	Medium	An unused enabled account could be compromised without prompt detection.	Disable dormant access.	Exception confirmed. Dormant access controls need improvement.
F-03	Determine whether administrative access uses MFA.	CIS 6.5, NIST PR.AA-03	Inspect Administrator accounts and compare MFA status with the requirement.	Account_Inventory: noah.admin. MFA: No.	noah.admin has enabled administrative access without MFA.	High	A stolen administrative password could expose privileged systems.	Enforce administrative MFA.	Exception confirmed. Administrative authentication controls need improvement.
F-04	Determine whether access matches approved job roles.	CIS 6.8, NIST PR.AA-05	Compare Assigned_Access in Account_Inventory with Required_Standard_Access in Role_Matrix.	Account_Inventory: sofia.ramirez assigned Global Administrator. Role_Matrix: IT Support Specialist requires Helpdesk Operator.	sofia.ramirez has access beyond the approved IT Support Specialist role.	High	Excess privilege could allow unauthorized system changes.	Replace Sofia's access with Helpdesk Operator.	Exception confirmed. Least-privilege controls need improvement.
F-05	Determine whether service accounts have complete ownership records.	CIS 5.5, NIST PR.AA-01	Inspect service accounts for Department_Owner and Service_Review_Date values.	Account_Inventory: svc.backup has blank Department_Owner and Service_Review_Date fields.	svc.backup lacks a documented owner plus a review date.	Medium	Missing accountability could allow the service account to remain active without review.	Assign an owner plus a review date.	Exception confirmed. Service-account governance needs improvement.

What Makes This Workpaper Traceable?

The objective states the control question tested by each finding.
The procedure records how you examined the available evidence.
The evidence reference points reviewers to the exact source records.
The remaining fields connect the exception to its rating, business risk, corrective action, and audit conclusion.

Save User_Access_Audit_Workpaper.xlsx.
Predict how many findings have each rating before you check the completed register.
Count the ratings from F-01 through F-05.

You should count three High findings plus two Medium findings.

Review every finding from its objective through its auditor conclusion.

Each finding should contain a criterion, procedure, evidence reference, result, rating, risk statement, recommendation, and auditor conclusion. The evidence should support every statement without changing the source worksheets.

Do the Findings Look Misaligned?

Undo the paste if values shifted into the wrong columns.
Copy the complete block again from Finding ID through the final conclusion.
Compare any unexpected rating with the project rubric above.

Help me check a misaligned or incomplete Excel audit finding register.

That is the evidence trail complete. Next, you will turn these five findings into a concise management audit report.

Write the Management Audit Report

Your completed workpaper in Microsoft Excel now connects every exception to its criteria, evidence, risk, recommendation, and conclusion. That traceability gives you a reliable source for the final report.

Management needs a concise risk story with prioritized actions. In this step, you will turn the five workpaper findings into a management-ready report in Microsoft Word.

In this step, get ready to:

Draft the report structure with its objective, scope, criteria, and methodology.
Convert the five workpaper findings into a prioritized management table.
Validate every report statement against the completed workpaper.

Draft the report sections

An audit report leads with the context that management needs for decisions. Its opening sections explain what was reviewed before presenting individual findings.

Switch back to the blank User_Access_Audit_Report.docx document from earlier.
Add the five required section headings in the order shown below.

Report Structure

Executive Summary presents the overall result plus the rating profile.
Objective and Scope defines the purpose plus the accounts covered.
Criteria and Methodology identifies the control criteria plus the evidence used.
Findings and Recommendations presents each exception with its corrective action.
Conclusion states the overall condition of the access controls.

State under Executive Summary that 10 accounts were reviewed as of 2026-09-12.
Name account evidence, workforce evidence, departure evidence, and role evidence as the source set.
Summarize the rating profile as three High plus two Medium.
State under Objective and Scope that the audit determines whether accounts are authorized, current, appropriately privileged, and protected by required MFA.
Define the scope as the supplied user, administrator, and service accounts.
List the CIS Controls v8.1 criteria as 5.1, 5.3, 5.5, 6.2, 6.5, and 6.8.
List the NIST Cybersecurity Framework 2.0 outcomes as PR.AA-01, PR.AA-03, and PR.AA-05.
Describe the methodology as comparing Account_Inventory, Active_Roster, Departures, and Role_Matrix.

What Makes the Methodology Traceable?

Each methodology statement identifies the evidence behind the tests. This lets a reviewer move from the report back to the source worksheet.

The detailed CIS criteria support the tests. The NIST outcomes connect those tests to the wider cybersecurity risk.

Save User_Access_Audit_Report.docx.
Review the first three sections from top to bottom.

You should see the account count, audit date, rating profile, objective, scope, criteria, and evidence sources. Each statement should agree with the completed workbook.

Good progress. Your report now explains the review before management reaches the detailed findings.

Build the findings table

A findings table turns detailed test results into a format that management can scan. Each row keeps the observation, risk, and recommendation tied to one finding ID.

Place your cursor under Findings and Recommendations.
Use the table insertion control in the Word ribbon to create a table with six rows plus five columns.
Enter Finding ID, Rating, Observation, Risk, and Recommendation as the column headers.
Copy the matching risk statement from Workpaper into each finding row.
Populate the remaining cells with the findings blueprint below.

Findings Table Blueprint

Each item below maps to one table row. The risk source is the matching risk statement in Workpaper.

Finding ID: F-01. Rating: High. Observation: Departed workers retain enabled access. Recommendation: Disable departed access.
Finding ID: F-02. Rating: Medium. Observation: Dormant enabled account exceeds 45 days. Recommendation: Disable dormant access.
Finding ID: F-03. Rating: High. Observation: Administrator account lacks MFA. Recommendation: Enforce administrative MFA.
Finding ID: F-04. Rating: High. Observation: IT support user has excessive access. Recommendation: Replace Sofia's access with Helpdesk Operator.
Finding ID: F-05. Rating: Medium. Observation: Service-account inventory is incomplete. Recommendation: Assign an owner plus a review date.

Save User_Access_Audit_Report.docx.
Review the number of finding rows in the completed table.
Review the values in the Rating column.

You should see five finding rows covering F-01 through F-05. The ratings should include three High entries plus two Medium entries.

The main risk story is now visible at a glance. Management can connect every exception to a specific corrective action.

Table Details Do Not Match?

Compare each report row with the same finding ID in Workpaper.
Check every copied risk statement for missing words.
Check that the table cells did not shift while you entered the rows.

Ask for help if the two files still disagree: Help me reconcile my report table with the Workpaper findings.

Validate and finalize the report

A defensible report stays consistent with its supporting workpaper. The final comparison catches changed ratings, shortened risks, and recommendations that drifted from the evidence.

Write under Conclusion that access controls need improvement because departed access, privileged MFA, and least-privilege failures create immediate exposure.
Switch back to the User_Access_Audit_Workpaper.xlsx workbook from earlier.
Compare the report's account count, audit date, and evidence types with the workbook.
Compare every table row with the corresponding finding in Workpaper.
Count the High plus Medium ratings in the report.

What Does the Final Comparison Prove?

The comparison proves that the report summarizes completed audit work. A reviewer can trace each management statement back to its evidence plus conclusion.

Return to User_Access_Audit_Report.docx.
Correct any report statement that does not match the workpaper.
Save Documents/IT_Audit_User_Access/User_Access_Audit_Report.docx.
Return to User_Access_Audit_Workpaper.xlsx.
Save Documents/IT_Audit_User_Access/User_Access_Audit_Workpaper.xlsx.

Before the final check, do you expect every observation, risk, and recommendation to match the workpaper exactly?

Perform one final review of the Word report from Executive Summary through Conclusion.

You should see all five required sections. The report should state that 10 accounts were reviewed as of 2026-09-12 using account, workforce, departure, and role evidence.

The findings table should contain F-01 through F-05 with three High ratings plus two Medium ratings. Each row should preserve the observation, risk, and named recommendation from Workpaper.

The conclusion should state that departed access, privileged MFA, and least-privilege failures create immediate exposure. That statement should agree with the three High findings.

You have completed the reporting loop. Your audit package now turns traceable evidence into prioritized actions for management.

Secret mission

Reperform a Closed Finding

Management says the departed accounts are disabled. Preserve the original evidence while recording the simulated fix in a separate worksheet. Independently retest F-01 before marking it closed in the report.

Clean Up Your Resources

Your audit package is stored entirely in local files, so there are no ongoing costs. Choose whether to keep it available, close it for later, or delete it entirely.

Resources you used:

Microsoft Excel workpaper at Documents/IT_Audit_User_Access/User_Access_Audit_Workpaper.xlsx.
Remediation_Copy worksheet inside the Excel workpaper.
Microsoft Word audit report at Documents/IT_Audit_User_Access/User_Access_Audit_Report.docx.

Keep everything running

No action needed. Choose this if you want to retain the completed audit package for future reference.

Keep the Documents/IT_Audit_User_Access folder in your Documents folder.
Confirm that every name and piece of evidence remains clearly labeled as fictional.
Preserve the original Account_Inventory worksheet as the unchanged source evidence.

Pause - I'll come back to this later

Close the audit files while preserving your saved progress for a later session.

Close User_Access_Audit_Workpaper.xlsx in Microsoft Excel.
Close User_Access_Audit_Report.docx in Microsoft Word.
Leave the Documents/IT_Audit_User_Access folder unchanged.

Delete - I don't want to use this again

Remove the local audit package when you no longer need it. This cleanup only targets the Documents/IT_Audit_User_Access folder.

Close User_Access_Audit_Workpaper.xlsx in Microsoft Excel.
Close User_Access_Audit_Report.docx in Microsoft Word.
Select Documents in the Finder sidebar.
Select the IT_Audit_User_Access folder.
Move the selected folder to Trash.
Review Trash for anything you want to restore.
Empty Trash to delete the folder permanently.

The workbook, report, and remediation worksheet are now removed from your Mac.

Nice Work!

You completed a full user-access audit for BluePeak Services! Every conclusion now traces from source evidence to a management action.

Your Microsoft Excel workpaper preserves the detailed audit trail. Your Microsoft Word report presents the same results as a concise risk story.

You've learned how to:

Build a traceable audit workpaper where every test creates a clear trail from criterion to evidence to conclusion.
Produce five risk-rated access findings through independent account reconciliation. CIS Controls v8.1 supplies the detailed test criteria. NIST CSF 2.0 frames the broader risk outcomes.
Write a management-ready audit report with prioritized recommendations. The report keeps every statement consistent with the workpaper.
Secret Mission: Preserve the original Account_Inventory evidence. Test the remediation in Remediation_Copy. Independently retest F-01 before marking it closed.

Ready to quiz yourself?