Chapter 22 — Security governance, risk and compliance: automation
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Reconciliation"]
N2["22.2 Findings"]
N3["Lab — Reconciling the HR roster with system accounts"]
N4["22.3 Humans in the loop"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Reconciliation"]
N2["22.2 Findings"]
N3["Lab — Reconciling the HR roster with system accounts"]
N4["22.3 Humans in the loop"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Reconciliation]
|
v
[22.2 Findings]
|
v
[Lab — Reconciling the HR roster with system accounts]
|
v
[22.3 Humans in the loop]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) automate a reconciliation check; (2) interpret automated findings; (3) keep humans in the loop.
22.1 Reconciliation
Priya automates a common check: comparing the human resources roster with accounts in the practice system. A script reads both lists and reports accounts belonging to people marked as leavers and accounts that match no one on the roster. Running it weekly replaces a manual comparison that took a clinic manager hours each quarter and was often skipped. Weekly runs also mean a leaver's account is found within days, not at the next quarterly comparison. The script prints each finding with the clinic, so the right manager can confirm it.
22.2 Findings
The lab compares a sample roster of five people with seven accounts. Two leavers, b.osei and d.wu, still have accounts. Two accounts, f.temp and g.test, match no one on the roster. That makes four issues among seven accounts. Priya investigates: f.temp was created for a locum and never removed, while g.test was left by the practice system provider after setup. Both orphan accounts are disabled after confirmation with their likely owners. Mr. Lind notes that g.test shows how a supplier's setup work can leave access behind, which the provider contract should address.
Lab — Reconciling the HR roster with system accounts
"""Reconcile HR roster with system accounts: leavers with access and orphan accounts."""
roster = {"a.khan": "active", "b.osei": "left", "c.lopez": "active", "d.wu": "left", "e.roy": "active"}
accounts = ["a.khan", "b.osei", "c.lopez", "d.wu", "f.temp", "e.roy", "g.test"]
leavers = [a for a in accounts if roster.get(a) == "left"]
orphans = [a for a in accounts if a not in roster]
print("leavers with accounts:", leavers); print("orphan accounts:", orphans)
print(f"accounts {len(accounts)}; issues {len(leavers) + len(orphans)}")
Run with python3 lab_recon.py. Verified output:
leavers with accounts: ['b.osei', 'd.wu']
orphan accounts: ['f.temp', 'g.test']
accounts 7; issues 4
22.3 Humans in the loop
Priya does not let the script disable accounts automatically. A human checks each finding first, because a leaver might have returned or an account might belong to a supplier with a valid reason. She learns that automation should handle repetitive comparison while people make decisions that need context. Automated findings also need owners, or they accumulate unread, which defeats the purpose of automating the check in the first place. A returning locum, for example, could appear as a leaver on the roster yet need the account next week.
Worked example
Priya automates roster reconciliation, finds two leavers and two orphan accounts among seven and keeps human confirmation before disabling.
Synthetic case. Names and accounts are synthetic.
Errors and limits
Name mismatches cause false findings. Unread reports defeat automation.
Exercises
- EX064 — Leaver accounts. Which leavers still had accounts? Rubric: 3 = b.osei and d.wu;; 2 = two;; 1 = vague;; 0 = none.
- EX065 — Orphan origins. Where did the orphan accounts come from? Rubric: 3 = a locum account and a provider test account;; 2 = origins;; 1 = vague;; 0 = none.
- EX066 — Manual decision. Why not disable accounts automatically? Rubric: 3 = findings need context a human must check;; 2 = context;; 1 = vague;; 0 = none.
Synthesis
Automation should do repetitive comparison while people make contextual decisions.
Continue studying — chapter 22 of 30
← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →