# Northwind Retail plc — ITGC findings carried forward from FY2025

**FICTIONAL SAMPLE.** Northwind Retail plc, Meridian Payroll Services and every name,
date and finding below are invented for product demonstration. This describes no real
organisation and is not an audit opinion.

Prepared by: Internal Audit · Status as at 31 December 2025 · For FY2026 planning

---

## Carried-forward findings

### F-2025-03 — Leaver access not removed timely (Payroll — outsourced)
**Rating:** Significant deficiency
**Owner:** Head of HR Operations
**Original finding:** In FY2025 testing, 4 of 20 leavers retained access to the
outsourced payroll portal for more than 5 business days after their termination date.
Two retained access for more than 30 days.
**Root cause:** Terminations are notified to the service organisation by email, manually,
by the local HR administrator. There is no system-to-system feed and no reconciliation
between the HR leaver report and the service organisation's user listing.
**Management response (FY2025):** HR will notify the service organisation on the day of
termination. A quarterly reconciliation of the portal user listing to the HR active
employee list will begin in Q1 FY2026.
**Status at 31 Dec 2025:** Partially remediated. Day-of-termination notification is in
place for head office; regional stores continue to notify weekly. The quarterly
reconciliation has not yet been performed.
**Relies on service organisation control:** Yes — removal within one business day of
notification.

### F-2025-07 — Emergency changes exceed policy threshold
**Rating:** Deficiency
**Owner:** Head of IT Operations
**Original finding:** Emergency changes were 9% of all production changes in Q3 FY2025
against a policy threshold of 5%. Retrospective CAB approval for 3 of 12 emergency
changes sampled was recorded more than 2 business days after deployment.
**Root cause:** Release windows are weekly; teams use the emergency path to avoid waiting.
**Management response (FY2025):** Move to twice-weekly release windows from Q2 FY2026 and
report emergency change rates to the Audit Committee quarterly.
**Status at 31 Dec 2025:** Open. Release cadence unchanged.

### F-2025-11 — No independent review of direct database changes
**Rating:** Deficiency
**Owner:** Head of Platform Engineering
**Original finding:** Three direct production database updates were identified in FY2025.
Each was logged, but none had evidence of review by a second person.
**Management response (FY2025):** Introduce a mandatory second-reviewer field in the
emergency change ticket template.
**Status at 31 Dec 2025:** Remediated. Field added 1 November 2025; awaiting FY2026
testing to confirm operating effectiveness.

---

## Reliance on the payroll service organisation

Northwind relies on Meridian Payroll Services Limited for payroll processing. The FY2026
plan assumes reliance on Meridian's SOC 1 Type II report for the period 1 October 2025 to
30 September 2026.

Points to confirm when the FY2026 report is received:

1. Whether the report period covers Northwind's full financial year, and what bridging
   procedures are needed for any gap.
2. Whether the opinion is unqualified, and if not, which control objectives were affected.
3. Whether the complementary user entity controls are ones Northwind actually performs —
   in particular anything relating to timely notification of terminations, given F-2025-03.
4. Whether any subservice organisation is carved out, and if so whether Northwind has
   evaluated that organisation separately.