The audit leaves a staffing decision
A manager needs to close an offboarding finding before a customer’s security review. Outside help looks safer than asking a busy team. But an unresolved finding alone does not establish a staffing shortage. In this hypothetical service business, assume eight qualified staff overtime hours are available this week and $600 for extra payments. Without verified access removal, the company could assure its customer that a former employee is blocked while access remains usable.
Disabling the account leaves a session
The directory record says account_status: disabled, but the customer portal keeps its own signed-in session. Disabling the directory account blocks a fresh login; this portal requires a separate action to revoke existing sessions. Before the fix, the disabled test account can still open a protected page. The handover from HR to IT ends at account disabling. Extend that handover to include session revocation.
Price the same verified fix twice
Assume the change takes six implementation hours and two independent retest hours. Keeping it internal costs (6 + 2) × $50 = $400 in overtime. A contractor costs 6 × $80 = $480, plus 2 × $50 = $100 for the company’s retest: $580 total. Both fit this week’s $600 budget. Choose the internal team: its eight available hours cover the work for $180 less. Payment buys work; the retest establishes whether access is blocked.
Let the result and capacity decide
Inspect the disable event and session-revocation log. After the fix, try the protected page with the old test session and attempt a fresh login. Both must be denied. Either success keeps the finding open: correct the workflow and retest. Record the accountable owner and evidence before reporting closure. Now assume only three overtime hours remain available. The internal plan cannot fit; the contractor plan needs only two internal hours. With the same $600 budget, choose the $580 contractor plan.