Who can do what, and what should be closed

The scan compares roles with job functions, puts a proposal per finding and measures again after the clean-up. Illustration on demo data.

Process flow of the demo

Week 1 to week 3

Step 1 · Week 1Scan

Step 2 · Week 1Findings

Step 3 · Week 2Decisions

Step 4 · Week 2Clean-up

Step 5 · Week 3Follow-up

ITBrings in the question or the signal

AI worksDoes the work in the systems

Person decidesTakes the decision

In the system and evidenceRecords what happens

5.3In the system and evidenceReport before and after, with date and who decided what

1ScanWeek 1
1. 1.1ITScan started: Microsoft 365 and accounting, 120 accounts
2. 1.2AI worksRoles compared with job functions and the list of leavers
2FindingsWeek 1
1. 2.1AI worksTwo former employees can still reach the shared folders
2. 2.2AI worksThree employees can create suppliers and approve payments
3. 2.3In the system and evidenceReport ready, with a proposal per finding
3DecisionsWeek 2
1. 3.1Person decidesIT decides: block the two accounts
2. 3.2Person decidesFinance manager decides: creating and approving in two hands
4Clean-upWeek 2
1. 4.1In the system and evidenceChanges prepared as a list per system
2. 4.2Person decidesIT carries out the changes and signs off
5Follow-upWeek 3
1. 5.1AI worksSame scan run again
2. 5.2AI worksAll findings resolved
3. 5.3In the system and evidenceReport before and after, with date and who decided what

NowIn the system and evidence5.3Report before and after, with date and who decided what

What it does, what you get and the evidence

What it does: The scan reads the roles and rights from Microsoft 365 and the business software and sets them against the job functions. Whatever is too broad, outdated or conflicting goes into a report with a proposal per finding.
What you get: A report with findings, severity and proposal, and after the clean-up a second scan as the follow-up measurement.
Evidence: The follow-up: the same scan after the clean-up, with the findings that were resolved.
Example: A wholesaler with 120 employees finds that former staff can still reach the shared folders and that three people can both create suppliers and approve payments.