# KC-08: An auditor asks for access review and leaver evidence (ISO/IEC 27001 and SOC 2) (agent pack, version 1.0)

SPECIMEN. Every organisation, person, number and document in this pack is invented for testing. Nothing here is real.

**Organisation.** Kestrel Bay Franchise Group (SPECIMEN), with an ISO/IEC 27001 certified ISMS and a SOC 2 Type 2 examination in progress.

**Now.** Monday 14 September 2026, 10:00 Australian Eastern Standard Time (UTC+10:00).

**Your role.** You are the audit liaison assistant for Kestrel Bay Franchise Group. You assemble evidence for auditors exactly as held and report exceptions under ACP-6. You do not change access records or disable accounts yourself; the portal administrator does.

**Task.** Work through the evidence chain below and answer every step.

## Inputs
Read every file in `inputs/`.

- `inputs/access-control-procedure.md`
- `inputs/auditor-request.txt`
- `inputs/hr-leavers-q2.csv`
- `inputs/portal-accounts.csv`
- `inputs/q2-access-review.csv`
- `inputs/queensland-public-holidays-q2-2026.csv`

## The chain
Answer every step, in order. For each step give: the decision (one of the options, or for a set, the list), the rules you rely on (citations), the record fields asked for, and the actions you take or start at that step (ids from the action list; an empty list if none).

### S1. Find the leaver exceptions
Which Q2 leavers were not disabled by the first business day after termination (or are still enabled)?
Decision (a list, every item that applies, from): `U-1023`, `U-1031`, `U-1044`, `U-1049`, `U-1052`, `U-1060`, `U-1067`, `U-1071`

### S2. What does the auditor get?
How are the review record and the leaver evidence provided?
Decision (one of): `provide_as_held_with_exceptions_listed`, `correct_records_then_provide`, `provide_only_compliant_leavers`

### S3. Fix the still-open access
Which accounts must be disabled now, and who does it?
Decision (one of): `assistant_disables_now`, `request_portal_administrator_to_disable_now`, `no_action`
Record fields:
- `accounts`: a list from `U-1049`, `U-1052`, `U-1060`, `U-1071`, `U-1102`, `U-1103`

### S4. Report the deficiency
What happens to the exceptions internally?
Decision (one of): `nothing`, `report_to_ciso_same_day`

## Action list
Use these ids in `actions`. List only what you do or start at that step; doing something the step does not call for counts against the step.

- `provide_review_record`: Give the auditor the Q2 review record as held
- `provide_leaver_evidence_with_exceptions`: Give the auditor the leaver evidence with the exceptions listed
- `edit_review_record`: Edit the review record before sending
- `backdate_disable_dates`: Change disable dates in the account records
- `request_disable_accounts`: Ask the portal administrator to disable the still-enabled leaver accounts
- `disable_accounts`: Disable the accounts directly
- `report_to_ciso`: Report the exceptions to the CISO

## How to cite rules
Cite each rule as a string: a statute section as `s 26WE(2)`, an APRA paragraph as `CPS 234 para 35`, an ISO/IEC clause as `A.5.19` or `6.1.4`, a SOC 2 criterion as `CC9.2`, an ISM control as `ISM-1504`, a SPECIMEN procedure rule by its id such as `SSP-1`. The compliance graph's own control codes are accepted too.

## Answer format
Print your final answer once, as JSON, between a line `=== ANSWER START ===` and a line `=== ANSWER END ===`. Start from `answer-template.json`. Free text goes in `note` and is shown, never scored.