An audit finding closed with a screenshot
A clearing bank was asked to evidence who could write to settlement code over the prior year.
- Seats
- 1,400
- Systems
- 2
- Answer time
- 11 min
A week of manual reconstruction, every time.
Internal audit asked who could write to settlement code over the prior twelve months. The answer existed only as three systems to be cross-referenced by hand.
The reconstruction took a week, and it was not evidence — it was an assertion by whoever assembled it, which is what an auditor discounts.
One permission model over both systems.
Git and Subversion moved behind a single instance. Group membership became the source of truth rather than a document about it, and explicit deny replaced unpicking membership at offboarding.
Contractor accounts were IP-bound on creation, so a credential outside the corporate range authenticates nowhere.
The auditor stopped asking us to explain the answer and started asking us to export it.
Eleven minutes, and the output is the evidence.
- 001,400 seats across Git and Subversion under one model
- 01Access questions answered in 11 minutes, not a week
- 02Audit trail streamed to the existing SIEM
- 03Contractor access IP-bound by default
The question resolves against the audit log and exports with actor, IP, timestamp and severity attached. The finding closed in the review cycle it was raised in.
Would this approach fit your organisation?
Bring your repository count, your VCS mix and your compliance constraints. We will tell you honestly whether a staged migration is the right answer for you — sometimes it is not.
- Bring
- repository count, VCS mix, seat count
- Constraints
- regulator, classification, contract
- We answer
- within 24 hours, by an engineer
- Contact
- sales@rhodecode.com