What should auditors test for client data segregation in a shared workflow platform?

author: AcadiFi Team

Answer:

Test whether users can access only the records, domains, clients, and workflows they are authorized to see. That means reviewing role design, group membership, provisioning approvals, privileged access, domain or client rules, external-user access, and exception reports.

Good testing includes both positive and negative cases. Confirm that an authorized user can access required records, and confirm that the same user cannot access another client's tickets, attachments, configuration items, or reports. Also test administrators and integration accounts because those roles often bypass normal user restrictions.