301 / 499
This report is intended for use by the management of the Variable Annuity Life Insurance Company ("VALIC") and its subsidiaries.
VALIC Retirement Services Company ("VRSCO") and VALIC Financial Advisors, Inc. ("VFA"), its user entities, and the independent
auditors of its user entities, and is not intended and should not be used by anyone other than these specified parties.
Back to TOCClick
VALIC
.com 94
V. Other information provided by VALIC: Management's response to operating effectiveness exceptions
Control Activitiy
Description of Exception
Management Response
16.2 Upon termination and/or transfer,
physical access to data centers is
revoked timely.
For 1 out of 25 terminated employees
sampled, physical access was not
removed timely.
Management reviewed access logs
and confirmed that the terminated
employee did not access the data
center after termination date. Further,
the employee had general access
and did not have access to any of the
secured rooms. The root cause of
this issue was untimely notification of
termination to HR so the management
response in 13.12 is applicable. To
remediate, management is taking
actions to improve timeliness of
termination notification to HR,
including:
1) monthly notification sent to all
managers to review their employee
data for accuracy, including terminated
employees
2) self reporting of resignation
3) dashboard available to managers
to monitor timeliness of termination
reporting
4) HR and Technology Risk Office
improving awareness around the
importance of timely termination
through training sessions.