// INTERACTIVE SIMULATION — MODULE 05

The Walk-In Auditor

You are the CISO of Meridian Capital. You have an active external audit underway — but you weren't expecting anyone today. Your assistant is calling.

// THE SITUATION
Your executive assistant calls your office at 10:47am. A man in a business suit is in the lobby. He says he's from Grant & Associates — your external audit firm — and that he needs immediate access to the server room to "close out a Q4 audit finding." He has a clipboard, a corporate lanyard, and a Grant & Associates business card.

He has no visitor appointment in the building's access system. When your assistant asked him about scheduling, he said the visit was "added last minute and the calendar invite probably didn't go through." He's been waiting 20 minutes and is visibly impatient.

You do have an active Grant & Associates audit underway — it's a real engagement. Your audit liaison at Grant & Associates is someone you've worked with for two years. You were not expecting anyone from Grant & Associates today.

Your assistant is asking what to do.
// DECISION POINT
What do you tell your assistant?
A
Grant temporary escorted access. You have an active audit and this sounds plausible. Have your assistant escort him to the server room with a junior IT staff member present.
B
Request his ID and business card, then call Grant & Associates' main number from your records to verify he was scheduled. Do not grant access until the verification is complete.
C
Deny access entirely. No one enters the server room without a verified appointment logged in IT Security. Tell the man he'll need to schedule a visit through proper channels.
D
Walk down to reception yourself to assess the situation. You want to make a judgment call face-to-face before deciding.