Log Analysis User Role ITGC Sample Extraction Steps
Check sampled ITGC log rows for user, role, event type, timestamp, result, and source completeness.
Description
IT general control (ITGC) log records need several source fields for follow-up testing.
IT general control (ITGC) log records need several source fields for follow-up testing. This check uses presence flags rather than parsing logs.1
The returned values include Log sample complete, Incomplete log rows, Incomplete row indices, Logs checked. The How section below explains the calculation, input rules and interpretation.
When to use Log Analysis User Role ITGC Sample Extraction Steps
Use Log Analysis User Role ITGC Sample Extraction Steps when you need to evaluate the supplied records under the calculation and evidence rules below. No actual log extraction, chronology, user authorization or substantive control operation is tested.
Prepare source-backed observations and the applicable engagement policy before entering facts. Use consistent monetary units and periods. Supply all boolean evidence flags explicitly, and treat a successful screen as a reason to continue professional review.
How to use Log Analysis User Role ITGC Sample Extraction Steps and understand its results
- Prepare source-backed observations and the applicable engagement policy before entering facts. Use consistent monetary units and periods. Supply all boolean evidence flags explicitly, and treat a successful screen as a reason to continue professional review.
- Enter logRows using the field table and calculation rules, then run the tool.
- Read complete, issueCount, issueRowIndices, logsChecked. The explanation below defines the units, signs, ordering and any flags or placeholder values.
- If the tool reports an input issue, correct the values and run it again. Apply the stated assumptions when interpreting a successfully returned result.
| Input field | Meaning | Value type; see rules below | Requirement |
|---|---|---|---|
| logRows | Rows ordered as user, role, event type, timestamp, result, and source-present flags. | list of list of number | Required |
Supply rows [user,role,eventType,timestamp,result,source] as exactly six binary presence flags, possibly empty. Return zero-based issue indexes/count, logs checked and complete when none.
issue=any of six flags0 Units, indexing, boundary conditions and exceptional cases are defined in the calculation rules above.
| Output field | Meaning | Value type |
|---|---|---|
| complete | Log sample complete | boolean |
| issueCount | Incomplete log rows | integer; minimum: 0 |
| issueRowIndices | Incomplete row indices | list of number |
| logsChecked | Logs checked | integer; minimum: 0 |
{
"input": {
"logRows": [
[
1,
1,
1,
1,
1,
1
],
[
1,
1,
0,
1,
1,
1
]
]
},
"output": {
"complete": false,
"issueCount": 1,
"issueRowIndices": [
1
],
"logsChecked": 2
}
}Limitations and assumptions
No actual log extraction, chronology, user authorization or substantive control operation is tested.
Numeric inputs, where present, must be finite. Follow the calculation-specific rules for overflow, underflow and exceptional cases. Core numeric and string lists are limited to 100,000 entries; text entries are subject to the general large-text limit. Follow any smaller calculation limits above. Matrices are limited to 128 rows and 128 entries per row. Missing fields without a declared default, extra fields, wrong value types and violations of the calculation rules are input errors. A successfully returned false flag is an evaluated outcome; its meaning is explained above.
Alternative or Complementary methods
Use User Access Review Quarterly Recertification Evidence Tester: Access recertification records need a reviewer, decision and supporting evidence within an explicit age allowance. Row flags summarize already reviewed facts. For a complementary task, use RPA Bot Audit Trail Versioning Evidence Lookup: A robotic process automation (RPA) audit trail needs identifiable versions and supporting execution/review evidence. Identification text alone is not sufficient.
References
Similar or alternative tools
- User Access Review Quarterly Recertification Evidence Tester
Access recertification records need a reviewer, decision and supporting evidence within an explicit age allowance. Row flags summarize already reviewed facts.
- RPA Bot Audit Trail Versioning Evidence Lookup
A robotic process automation (RPA) audit trail needs identifiable versions and supporting execution/review evidence. Identification text alone is not sufficient.