Timely Access Removal

Due to potential risks associated with employee separations where some Tennessee Valley Authority (TVA) employees ceased active work prior to their last official day of employment, we included an audit of timely access removal as part of our annual audit plan. Our audit objective was to determine if physical and logical access is removed when employees cease active work prior to retirement or other termination. Our scope included TVA employees whose employment ended during calendar year 2018 who ceased active work prior to retirement or other termination. In summary, we found (1) TVA’s policies and procedures do not provide guidance for supervisors/managers regarding removal of an employee’s logical or physical access if they stop active work prior to separation, and (2) employee’s physical and logical access is not consistently removed on a timely basis when employees cease active work prior to retirement or other separation.