Review and testing of access authorizations and capability
Access control tables provide information regarding access
levels by individuals. Access should be based on job descriptions
and should provide for a segregation of duties. Testing can be
performed through the review of access rules to ensure that access
has been granted as management intended,