OCC should recertify the financial management system users with default accounts semi-annually in accordance with documented policies and procedures. If a decision is made that these accounts should not be recertified, then OCC should document a risk acceptance and identify compensating controls to minimize the residual risk to a level acceptable by management.