Privileged access management audit program.
How to audit whether administrator and other privileged accounts are recorded, limited, specially secured and used in a traceable way.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation controls privileged access deliberately: inventory and accountability, restriction to what is necessary, additional authentication, protected storage of credentials, logging of use and regular review. It also assesses whether emergency access and access by service providers are regulated.
Scope
- Administrator accounts for operating systems, databases, directory services, network components, virtualisation and cloud consoles
- Technical accounts, service accounts and emergency accounts with elevated rights
- Access by service providers with privileged rights
- Out of scope: general access management for ordinary users, which is covered in a separate sample
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A policy governs the granting, use and withdrawal of privileged rights and is approved by management. | NIS2 Directive Art. 21(2)(i); ISO/IEC 27001:2022 Annex A 8.2 | Read the policy, establish approval and currency, and compare its scope with the system overview. | Policy with approval record, system overview |
| 2 | All privileged accounts are inventoried, and each account is assigned a responsible person and a purpose. | ISO/IEC 27001:2022 Annex A 8.2; BSI ORP.4 | Read privileged accounts directly from five systems and compare them with the inventory. | Inventory of privileged accounts, system extracts of administrator groups |
| 3 | Privileged rights are limited to what is necessary; roles are justified by the business and approved. | ISO/IEC 27001:2022 Annex A 8.2 and 5.15 | Select ten privileged accounts and check justification and approval of the rights. | Requests and approvals, role descriptions |
| 4 | Administrators use an account without elevated rights for daily work and a separate account for administrative tasks. | BSI ORP.4; ISO/IEC 27001:2022 Annex A 8.2 | Check whether administrator accounts have a mailbox or are used for internet access. | Account list with mailbox, analysis of internet use by privileged accounts |
| 5 | Multi-factor authentication is used for privileged access and remote access; exceptions are justified and approved. | NIS2 Directive Art. 21(2)(j); § 30(2) no. 10 BSIG | Check configuration of administration consoles, VPN and cloud access and go through the exceptions. | Configuration extracts, list of exceptions with approval |
| 6 | Credentials of privileged accounts, in particular service and emergency accounts, are kept in a protected vault or equivalent and are changed after use or at defined intervals. | ISO/IEC 27001:2022 Annex A 8.2; BSI ORP.4 | Have the safekeeping procedure described and check the date of the last change for a sample. | Procedure description, vault extract, evidence of changes |
| 7 | Administrative activity and use of privileged accounts are logged; sessions are recorded on particularly critical systems. | ISO/IEC 27001:2022 Annex A 8.15 and 8.2 | Check logging for two critical systems and trace an administrative activity from the log. | Logging configuration, log extracts, recordings |
| 8 | Privileged rights are reviewed at defined intervals by their owners, and findings are implemented. | ISO/IEC 27001:2022 Annex A 5.18 and 8.2 | Review the last review: scope, response rate, deadlines and actual withdrawal of rights no longer needed. | Review reports, confirmations, tickets for withdrawal |
| 9 | Where needed, elevated rights are granted for a limited time and withdrawn automatically afterwards where the technology allows. | ISO/IEC 27001:2022 Annex A 8.2 | Check whether time-limited rights are in use and examine a sample of grants for withdrawal after expiry. | Configuration of time-limited grants, log of granting and withdrawal |
| 10 | Emergency access is regulated: triggering, approval, use, logging and subsequent review. | ISO/IEC 27001:2022 Annex A 8.2; BSI ORP.4 | Review all uses of emergency accounts in the last twelve months and check approval and subsequent review. | Emergency access procedure, list of uses, evidence of review |
| 11 | Privileged access by service providers is regulated by contract, approved individually, time-limited and logged. | ISO/IEC 27001:2022 Annex A 5.19 and 8.2 | Check access of three service providers: approval, time limit, authentication and logs of the latest sessions. | Contracts, approvals, access logs |
| 12 | Accounts of departed or transferred administrators are blocked or adjusted promptly. | ISO/IEC 27001:2022 Annex A 5.18; BSI ORP.4 | Compare leaver and mover lists with the administrator groups and determine the time until adjustment. | Leaver list, extract of administrator groups, blocking record |
Documents to request
- Policy on privileged access
- Inventory of privileged, technical and emergency accounts
- System extracts of administrator groups on a reference date
- Configuration evidence of multi-factor authentication
- Procedure description for the safekeeping of credentials
- Log extracts of administrative activity
- Reports of the last review of privileged rights
- Contracts and approvals for access by service providers
Typical findings
- There is no complete overview of privileged accounts; service accounts have no responsible person.
- Administrators work daily with their privileged account, including for e-mail and internet.
- Credentials of emergency and service accounts sit in spreadsheets or have been unchanged for years.
- Multi-factor authentication is not required consistently for administrators, and exceptions are not justified.
- The review of privileged rights is confirmed without any rights actually being withdrawn.
- Service providers keep access after the end of the engagement.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing