Module M7

Findings drafted by the Twin

Autonomy: L2
Meridian Trust Bank1 Nov 2025 – 31 Oct 2026

Findings Register (Module M7)

Every finding drafted by the Twin requires human review and confirmation before it can enter the official report (BR-2).

F-001A.5.18· Access rightsMinor NCDraft — awaiting auditor decision
Twin Confidence:
87%
Condition

Of 212 employees who left between 1 Nov 2025 and 31 Oct 2026, 9 had active directory accounts more than 24 hours after their leaving date. The longest delay was 41 days.

Criteria

Access Control Policy section 4.3: access must be removed within 24 hours of the leaving date.

Evidence Cited
EV-0142: HR leavers export (212 rows)EV-0143: Directory account disable logT-A518-02: Full-population match test
Apparent Root Cause

Not confirmed. Exit interviews suggest contractors and outsourced staff are not part of the HR feed that drives automatic disablement.

Impact / Risk

Former staff held live credentials for the corporate directory and email, with potential reach into core banking support systems.

F-002A.8.8· Technical vulnerabilitiesMajor NCDraft — awaiting auditor decision
Twin Confidence:
74%
Condition

42 critical vulnerabilities raised in the period remained open beyond the 14-day remediation deadline, with a median delay of 63 days. 11 of them sit on internet-facing payment gateways. No risk acceptance is recorded for any of the 42.

Criteria

Vulnerability Management Standard v3.1, section 5: critical vulnerabilities must be remediated within 14 calendar days, or formally accepted by the CISO.

Evidence Cited
EV-0164: Scan reports Feb–Oct 2026EV-0165: Critical/high ticket ageing exportT-A808-01: Deadline arithmetic test
Apparent Root Cause

Not confirmed. Ticket comments suggest a change-freeze between March and May backlogged remediation with no exception handling.

Impact / Risk

Exploitation of a known critical issue on an internet-facing payment service could lead to data breach or service outage.

Twin Warning on Evidence Quality:
• Evidence for the change-freeze explanation is a single ticket comment — treat the cause as unconfirmed.
• Scope depends on the CMDB extract dated 30 Sep; ask for the October refresh before issuing.
F-003A.8.15· LoggingObservationDraft — awaiting auditor decision
Twin Confidence:
68%
Condition

6 of 47 critical systems listed in the CMDB do not appear in the log source inventory. No Q3 log review record exists for the SIEM, although the procedure requires monthly review with sign-off.

Criteria

Logging and Monitoring Procedure v2.0 sections 3.2 and 4.1.

Evidence Cited
EV-0151: Log source inventoryEV-0152: CMDB critical systems extractT-A815-01: Coverage comparison
Apparent Root Cause

Unknown.

Impact / Risk

Blind spots reduce detection of and response to security incidents on critical systems.

Twin Warning on Evidence Quality:
• Weak evidence: the Q3 review may exist offline. The Twin abstains on operating effectiveness until REQ-015 is resupplied.
F-004A.5.18· Access rightsOFIDraft — awaiting auditor decision
Twin Confidence:
81%
Condition

Leaver removal relies on a nightly HR feed. Contractor exits are notified by email to the service desk and are not reconciled monthly.

Criteria

Beyond requirement — good practice reference ISO/IEC 27002:2022 5.18 and the banking pack reconciliation pattern.

Evidence Cited
EV-0142: HR leavers exportEV-0146: Contractor exit emails (sampled 3)
Apparent Root Cause

Process design, not a lapse.

Impact / Risk

Repeat of the A.5.18 condition if contractor volumes grow.

F-005A.6.3· Awareness and trainingPositive practiceDraft — awaiting auditor decision
Twin Confidence:
90%
Condition

A quarterly phishing simulation programme runs with role-specific follow-up training triggered automatically for repeat clickers. Click rate fell from 11.4% to 3.1% over three quarters.

Criteria

Recognised good practice under ISO/IEC 27002:2022 7.3.

Evidence Cited
EV-0171: Phishing campaign resultsEV-0172: Triggered training records
Apparent Root Cause

n/a

Impact / Risk

n/a