Leaver Timeliness & Orphaned Account Report
Measures removal delay after exit and surfaces accounts with no current owner.
Available soon
- Format
- Excel
- Size
- 73 KB
- Length
- 12 sheets
- Version
- 2.0
- Updated
What's inside
What changed
- 2.0
Rewritten to the depth of the other CISO Times packs: the four measures with three months, target, tolerance, status in P11's words and direction, the summary for the leadership team, what went to the access review and where the measures go, and the leavers, movers and orphaned accounts behind the figures, each checked against JML-08, JML-09 and JML-15.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Within [[3]] working days of each month end, run the reconciliation: compare every in-scope system's accounts with the HR record and the sponsor register (JML-15). Enter the period end and the day the report runs on the Report sheet. |
| 2 | On Leavers, enter every leaver whose last working day fell in the month, from the Leaver Access Removal Checklist: the type, the last working day, for an urgent leaver the decision and the time they were told, the number of removals needed, the time of the last one and whether every removal was confirmed in the system. The deadline and the result calculate. |
| 3 | On Movers, enter every mover whose window closed in the month: the move date, whether the old line manager recorded a handover, and when the old access was removed (leave it blank if it is still held). The window and any residual access calculate (JML-08). Name any conflict the residual access held. |
| 4 | On Orphaned Accounts, enter each account the reconciliation found that matches nobody in the HR record or the sponsor register, or a shared account with no named owner, with when it was found and disabled. Disable each within [[1]] working day (JML-15). |
| 5 | On the Report, enter July and August from the last two reports, the live non-standard rights and those past expiry from the Access Provisioning Log (JMM-04), and the target and tolerance the leadership team accepts. Status and direction calculate. |
| 6 | Write the one-line summary and send every late leaver, mover with residual access and orphaned account to the access review coordinator as a finding (P07 AR-08); a pattern goes to the process owner as a process weakness (P07 AR-11). |
| 7 | Report to the security and IT leadership team with the other operational metrics. P11's catalogue imports ARM-03 as MC-23. It holds no leaver, orphaned-account or mover measure. An organisation that reports these four through its metrics programme adds them as catalogue rows under P11 MR-04, with P13's definitions and targets unchanged. |
| 8 | To clear the EXAMPLE, delete the contents of the Example column and of every yellow cell; keep the white formula columns. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its September 2026 report, run on 1 Oct 2026. In September 8 of 9 leavers lost all access on time, two orphaned accounts were found and disabled, and one mover kept access from their old role long enough to hold both sides of a High payment conflict. Each went to the access review as a finding.
Adapting for a small organisation: report the four figures and the findings, even when every figure is zero. A month with nothing found is still a month the reconciliation ran.
Adapting for a regulated entity (NIS2, DORA): the report shows identities reviewed and deactivated without delay (Implementing Regulation (EU) 2024/2690 Annex 11.5) and access withdrawn on termination (Delegated Regulation (EU) 2024/1774 Article 21(e)). Keep each month's copy.
Adapting where a service provider runs your IT: the provider can supply the extracts and the removal times. The reconciliation and the report are checked inside your organisation; the provider's own figures are an input, never the report.
Report
Leaver timeliness and orphaned accounts: monthly report
For the security and IT leadership team and the access review coordinator. Yellow cells are yours; every figure, status and direction calculates from the sheets behind it. Status words are P11's; the colour only repeats them.
Report settings
| Setting | Value | Note | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Period end | 30 Sep 2026 | EXAMPLE: September 2026. Type it; never a formula that changes it. | |||||||
| Report run on | 1 Oct 2026 | Within [[3]] working days of the period end (JML-15). | |||||||
| Minutes allowed for an urgent leaver (JML-09) | 60 | [[60]] | |||||||
| Mover window with a handover, working days (JML-08) | 5 | [[5]]; without a handover the old access goes on the move date. | |||||||
| Working days to disable an orphaned account (JML-15) | 1 | [[1]] | |||||||
| Report timeliness (calc) | Run on time (JML-15) | ||||||||
Non-standard access, for JMM-04 (from the Access Provisioning Log)
| Input | Value | Note | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Live non-standard rights at the period end | 17 | Every live right in the provisioning records. | |||||||
| Past expiry at the period end, neither removed nor renewed | 0 | From the Non-standard access sheet of the log. | |||||||
The four measures
| Measure | Target | Tolerance | July | August | September (calc) | Figure (calc) | Status (calc) | Direction (calc) | Note |
|---|---|---|---|---|---|---|---|---|---|
| JMM-01 Leavers removed on time | 100% | 85% | 83% | 92% | 8 of 9 | 89% | Below target, within tolerance | Worse | L-02: the warehouse system account was removed four working days late. |
| JMM-02 Orphaned accounts found | 0 | 2 | 6 | 3 | 2 | 2 | Below target, within tolerance | Better | Both on the pallet network portal, found on its first full user list, and disabled the day they were found. |
| JMM-03 Movers with residual access | 0 | 0 | 2 | 1 | 1 | 1 | Outside tolerance | Same | M-01 kept the supplier bank details role, a High conflict with payment approval (P02 SOD-FI-01). |
| JMM-04 Non-standard access past expiry | 0 | 0 | 3 | 1 | 0 of 17 live | 0 | On target | Better | Every non-standard right given an expiry at adoption has now been removed or renewed. |
Shares show as percentages; JMM-01 also in words. Tolerance is what the leadership team accepts without a decision: JMM-01 [[85%]]; JMM-02 [[2]]; JMM-03 Same as the target; JMM-04 Same as the target. Direction compares with August.
What each measure counts
| Measure | Definition | Target | |||||||
|---|---|---|---|---|---|---|---|---|---|
| JMM-01 | Leavers whose last working day fell in the period and whose access was removed from every system, local accounts included, within JML-09's time, out of all such leavers. | All | |||||||
| JMM-02 | Accounts found at the month-end reconciliation that match no current person in the HR record or the sponsor register, or shared accounts with no named owner. | Zero | |||||||
| JMM-03 | Movers whose mover window closed in the period and who still held access from their old role when it closed. | Zero | |||||||
| JMM-04 | Non-standard access rights past their expiry date at the period end, neither removed nor renewed. | Zero | |||||||
Summary for the leadership team
In September 8 of 9 leavers lost all access on time, two orphaned accounts were found and disabled, and one mover kept access from their old role long enough to hold both sides of a High payment conflict. Each went to the access review as a finding.
Raised with the access review (JML-15)
| Item | Raised as | Detail | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mover M-01 | Finding (P07 AR-08) | Residual access and a High conflict (P02 SOD-FI-01), separated on 2 Oct 2026. | |||||||
| Mover M-01 | Process weakness (P07 AR-11) | Mover requests added access and removed none. Owner: Head of IT; the change to the request is due 30 Oct 2026. | |||||||
| Leaver L-02 | Repeat of P07 PW-01 | Warehouse system account removed four working days late. | |||||||
| Orphaned accounts O-01 and O-02 | Findings (P07 AR-08) | Both on the pallet network portal, found on its first full user list; the portal joins P07's system inventory for the next campaign. | |||||||
Where the measures go
| To | What | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| The access review (P07) | Every late leaver, mover with residual access and orphaned account found is raised with the access review coordinator as a finding (P07 AR-08); a pattern is a process weakness (P07 AR-11). Between campaigns, this report finds what P07's ARM-03 ("Access that should not have existed") would otherwise find at the next campaign, so ARM-03 falling campaign on campaign is the evidence that this process works. | ||||||||
| The metrics programme (P11) | P11's catalogue imports ARM-03 as MC-23. It holds no leaver, orphaned-account or mover measure. An organisation that reports these four through its metrics programme adds them as catalogue rows under P11 MR-04, with P13's definitions and targets unchanged. | ||||||||
| When and to whom | Monthly, within [[3]] working days of month end, to the security and IT leadership team with the other operational metrics, and to the access review coordinator. | ||||||||
Sign-off
| Role | Name | Date | Signature or approval reference | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Report prepared by (IT service desk) | [[Name]] | [[YYYY-MM-DD]] | [[Reference]] | ||||||
| Report owner (Head of Information Security) | [[Name]] | [[YYYY-MM-DD]] | [[Reference]] | ||||||
Leavers
Every leaver whose last working day fell in the period, from the Leaver Access Removal Checklist. On time means every removal, local accounts included, was confirmed by the deadline JML-09 sets.
| Example | Leaver ID | Employee or non-employee | Leaver type | Role profile | Last working day | Decision (urgent leaver) | Told (urgent leaver) | Removals needed | Last removal | Every removal confirmed in the system | Systems removed late | Deadline (calc) | On time, JMM-01 (calc) | Note |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | L-01 | Employee | Planned | RP-01 Warehouse operative | 4 Sep 2026 | 2 | 4 Sep 2026 | Yes | 4 Sep 2026 | Yes | ||||
| EXAMPLE | L-02 | Employee | Planned | RP-02 Warehouse team leader | 11 Sep 2026 | 3 | 17 Sep 2026 | Yes | SYS-02 Warehouse management system | 11 Sep 2026 | No | L-02: the warehouse system account was removed four working days late. The warehouse system removal task went to a shared site mailbox, not to the named administrator. | ||
| EXAMPLE | L-03 | Employee | Planned | RP-03 Customer service agent | 11 Sep 2026 | 1 | 11 Sep 2026 | Yes | 11 Sep 2026 | Yes | ||||
| EXAMPLE | L-04 | Employee | Planned | RP-01 Warehouse operative | 18 Sep 2026 | 2 | 18 Sep 2026 | Yes | 18 Sep 2026 | Yes | ||||
| EXAMPLE | L-05 | Employee | Urgent | RP-06 Sales account manager | 23 Sep 2026 | 23 Sep 2026 | 23 Sep 2026 | 1 | 23 Sep 2026 | Yes | 23 Sep 2026 | Yes | ||
| EXAMPLE | L-06 | Agency worker | End date | RP-01 Warehouse operative | 18 Sep 2026 | 2 | 18 Sep 2026 | Yes | 18 Sep 2026 | Yes | The directory account expired automatically at the end date recorded at joining. | |||
| EXAMPLE | L-07 | Contractor | End date | None: base profile and non-standard access | 25 Sep 2026 | 1 | 25 Sep 2026 | Yes | 25 Sep 2026 | Yes | The project ended on its recorded date without anyone telling HR or the service desk. The account expired automatically at the end of the day. | |||
| EXAMPLE | L-08 | Employee | Planned | RP-01 Warehouse operative | 25 Sep 2026 | 2 | 25 Sep 2026 | Yes | 25 Sep 2026 | Yes | ||||
| EXAMPLE | L-09 | Employee | Planned | RP-07 Transport planner | 30 Sep 2026 | 4 | 30 Sep 2026 | Yes | 30 Sep 2026 | Yes |
Movers
Every mover whose window closed in the period. The old role's access goes on the move date, or within [[5]] working days where the old line manager recorded a handover (JML-08). Anything still held when the window closes is residual access.
| Example | Mover ID | Old role profile | New role profile | Move date | Handover recorded | Window closes (calc) | Old access removed | Residual access, JMM-03 (calc) | Working days held to the period end (calc) | Old access kept | Conflict it held (P02) | Note |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | M-01 | RP-04 Accounts payable clerk | RP-05 Payments officer | 7 Sep 2026 | No | 7 Sep 2026 | 2 Oct 2026 | Yes | 17 | Supplier invoice entry (SYS-01); Supplier master data, including bank details (SYS-01); Accounts payable folder (SYS-05) | SOD-FI-01 (High) | Separated: the old role's access removed. No P02 exception. The Financial Controller checked every change to supplier bank details since 7 Sep: none was made by the mover. The Chief Financial Officer asked the ERP provider for same-day removal; P07's weakness PW-02 (the provider's five-day removal time) is still open. |
| EXAMPLE | M-02 | RP-01 Warehouse operative | RP-02 Warehouse team leader | 1 Sep 2026 | No | 1 Sep 2026 | 1 Sep 2026 | No | Picker (handheld) (SYS-02) | |||
| EXAMPLE | M-03 | RP-03 Customer service agent | RP-06 Sales account manager | 14 Sep 2026 | Yes | 21 Sep 2026 | 18 Sep 2026 | No | Order entry and customer enquiry (SYS-01) | |||
| EXAMPLE | M-04 | RP-07 Transport planner | RP-02 Warehouse team leader | 21 Sep 2026 | No | 21 Sep 2026 | 21 Sep 2026 | No | Dispatch planning (SYS-02); Rate search user (SYS-10) | |||
| EXAMPLE | M-05 | RP-02 Warehouse team leader | RP-07 Transport planner | 28 Sep 2026 | No | 28 Sep 2026 | 28 Sep 2026 | No | Team leader: pick lists and stock moves (SYS-02) |
Orphaned Accounts
Accounts the month-end reconciliation found that match nobody in the HR record or the sponsor register, and shared accounts with no named owner. Each is disabled within [[1]] working day and raised with the access review (JML-15).
| Example | Orphan ID | System ID | Account | Last sign-in | Found | Disabled | Reconciliation for period ending | Working days to disable (calc) | Within JML-15 (calc) | Raised with the access review (P07 AR-08) | Note |
|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | O-01 | SYS-08 | Personal account of a transport planner who left on 26 Jun 2026, before the process was adopted | 25 Jun 2026 | 1 Oct 2026 | 1 Oct 2026 | 30 Sep 2026 | 0 | Yes | Yes | Pallet network booking portal (P06 SUP-009): found on its first full user list. |
| EXAMPLE | O-02 | SYS-08 | Shared bookings account for Warehouse 2, set up by a former team leader, with no named owner | 29 Sep 2026 | 1 Oct 2026 | 1 Oct 2026 | 30 Sep 2026 | 0 | Yes | Yes | Replaced by personal booking accounts for the two team leaders who used it (JML-02). |
Rules
Rules this workbook applies
The rules come from the Access Control Policy and keep their IDs across the pack. Change a rule there, never here: this sheet quotes it.
| Rule | Requirement | Where this workbook applies it |
|---|---|---|
| JML-04 | Access outside the person's profiles is non-standard. It needs a business reason, approval by the line manager (or the sponsor) and by the owner of the system or data, and an expiry date no more than [[6]] months ahead, or the non-employee's end date if that is sooner. At expiry it is removed unless the same approvers renewed it beforehand, with a new expiry date. | Report: JMM-04, non-standard access past its expiry. |
| JML-08 | A mover receives the new role's profile from the move date. The old role's access is removed on the move date or, where the old line manager records a handover, no later than [[5]] working days after it. Access still needed after that is requested as non-standard (JML-04). | Movers: the window and residual access (JMM-03). |
| JML-09 | A leaver's access is removed from every system, including local accounts outside single sign-on, by the end of their last working day. For an urgent leaver it is removed within [[60]] minutes of the decision, and before the person is told. Equipment, badges, tokens and shared credentials are recovered or changed the same day, using the leaver checklist. Removed accounts are deleted after [[90]] days, once their data has been dealt with. | Leavers: the deadline and whether every removal was confirmed by it (JMM-01). |
| JML-14 | Every grant, change, suspension and removal is recorded in the access provisioning log with its request reference, the approvers, who made the change and when it was completed. A removal is recorded as complete only when it is confirmed in the system. | Leavers: a removal counts only once confirmed in the system. |
| JML-15 | Within [[3]] working days of each month end, every in-scope system's accounts are reconciled with the HR record and the sponsor register. An orphaned account is disabled within [[1]] working day of being found. Every late leaver, mover with residual access and orphaned account is raised as a finding with the access review coordinator (P07 AR-08), and a pattern goes to the process owner as a process weakness (P07 AR-11). | The whole report: the reconciliation within [[3]] working days, orphaned accounts disabled (JMM-02), findings to the access review. |
Lists
| YesNo | LeaverType | Kind |
|---|---|---|
| Yes | Planned | Employee |
| No | Urgent | Agency worker |
| End date | Contractor |
Consultant
Supplier's staff
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| JMM-01 Leavers removed on time | Leavers whose last working day fell in the period and whose access was removed from every system, local accounts included, within JML-09's time, out of all such leavers. Target: all. |
| JMM-02 Orphaned accounts found | Accounts found at the month-end reconciliation that match no current person in the HR record or the sponsor register, or shared accounts with no named owner. Target: zero. |
| JMM-03 Movers with residual access | Movers whose mover window closed in the period and who still held access from their old role when it closed. Target: zero. |
| JMM-04 Non-standard access past expiry | Non-standard access rights past their expiry date at the period end, neither removed nor renewed. Target: zero. |
| Reconciliation | The monthly comparison of every in-scope system's accounts with the HR record and the sponsor register, to find orphaned accounts, late leavers and movers with residual access. |
| Orphaned account | An account that matches no current person in the HR record or the sponsor register, or a shared account with no named owner. P07 calls it an orphan account. |
| Dormant account | An account with no sign-in for [[90]] days (P07). |
| Residual access | Access a mover still holds from their old role after the mover window has closed. |
| Mover window | The move date, or [[5]] working days after it where the old line manager records a handover (JML-08). |
| Last working day | The leaver's last day at work, from the HR record. It can be earlier than the contractual end date, for example where holiday or garden leave follows. |
| Urgent leaver | A leaver who leaves at short notice or on bad terms: a dismissal, a resignation with immediate effect, a suspension, or a leaver suspected of misconduct. Also called a hostile leaver. |
| Status | P11's words: On target; Below target, within tolerance; Outside tolerance; No target set. The colour only repeats the words. |
| Direction | Better, Same or Worse than last month, read with whether higher or lower is better. |
| Tolerance | How far from target the security and IT leadership team accepts without a decision. Outside it, the report owner brings a plan. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, September 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | Report: the four measures monitored and evaluated each month against target, with direction |
| ISO/IEC 27001:2022 | Annex A 5.18 — Access rights | Leavers and Movers: access removed on leaving and moving, measured against JML-08 and JML-09 |
| NIST CSF 2.0 | PR.AA-01 — “Identities and credentials for authorized users, services, and hardware are managed by the organization” | The whole report: identities and accounts managed, and those that match nobody found and disabled |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | The report as evidence that access control and human resources security work in practice |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 11.5 — “manage the full life cycle of identities of network and information systems and their users”: unique identities, each user identity linked to a single person, shared identities only where necessary and explicitly approved and documented, logging of identity management, and regular review, deactivating identities no longer needed “without delay” | Orphaned Accounts and Leavers: identities reviewed and deactivated without delay when no longer needed |
| DORA — Regulation (EU) 2022/2554 | Article 9(4)(c) — policies that limit access to information and ICT assets to what is required for legitimate and approved functions, with controls that ensure sound administration of access rights | The report: access limited to what is needed, and withdrawn when it is not (financial entities) |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 21(e) — account management: roles for granting, reviewing and revoking access; privileged access on a need-to-use basis; removal without undue delay; review at least every six months for systems supporting critical or important functions and at least yearly for others | Leavers and Movers: access rights withdrawn without undue delay on termination or change |
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.