Check effectiveness of corrective action

The internal audit sampled the access rights reviews of the last four quarters and found no record of a review for two of them. The Service Desk Lead owns the review, and the quarterly reminder had lapsed when the previous reminder owner moved to another team. Administrator rights on the identity provider were therefore not confirmed against the staff list for half a year, which the Access Control Policy does not allow.