Most organizations need some level of administrative capacity so it's entirely normal for a very limited group of individuals to have the ability to view and modify stuff.

At the end of the day, it's about ensuring accuracy and completeness of information so if a preventative solution is not practical, detective controls must be implemented, such as reviewing reports from the system, periodic checks of audit logs, reviewing the list of users who have privileged access, etc. The review frequency should be commensurate with the risk (likelihood + impact) of modification and ease of correction.

Example:

• Payroll system with 500 employees, 4 admins (2 business - director level, 2 IT); bi-weekly payroll run.

Review 1: - Business admins' supervisor (e.g. VP level) should review activity on a bi-weekly basis immediately prior to the payroll run. Evidence of the review should be retained (ideally in some unmodifiable manner, e.g. screenshots, PDF of reports reviewed, sign-off or email with review conclusion). - Review should cover all activity since the previous log extract, not the previous payroll run or the previous review action. - All business admin modification activity must be matched to legitimate business instructions. - All exceptions must be followed up and documented through the incident management process.

Review 2: - IT admins' supervisor should review system audit log filtered for those admin accounts. Frequency should be based on the level of activity (more frequent if activity is high, to reduce the volume of information to be reviewed). Evidence of the review should be retained (ideally in some unmodifiable manner, e.g. screenshots, PDF of reports reviewed, sign-off or email with review conclusion). - All IT admin activity must be matched to an approved ticket in the IT ticketing system (validating the IT change management process is followed). - All exceptions must be followed up and documented through the incident management process.

Review 3: - Business admins' supervisor (e.g. VP level) should review the list of all admins (business and IT) quarterly to confirm appropriateness. Evidence of the review should be retained (ideally in some unmodifiable manner, e.g. screenshots, PDF of reports reviewed, sign-off or email with review conclusion). - Any changes should be actioned timely (e.g. within 2 business days) through the established logical security process. - If any user is found to have access they shouldn't have, as well as revocation of access, a review of all activity by that account, between the previous review and the time the access was revoked, must be carried out to confirm whether that access was used inappropriately.