THE “ZERO-TRUST” AUDIT IN YARDI

1. Executive Summary

As commercial real estate portfolios expand, enterprise system access often becomes decentralized, leading to severe compliance vulnerabilities. This case study examines a tier-one Australian Commercial Real Estate Investment Trust (REIT) that faced significant risks of failing its SOC 1 Type II audit due to “permission creep” within Yardi Voyager. Through a comprehensive Segregation of Duties (SoD) audit, the rationalization of more than 150 legacy Menu Sets into a strict Role-Based Access Control (RBAC) model, and the deployment of an offshore managed support team for automated provisioning, IT General Control (ITGC) risks were successfully mitigated. Support overhead was reduced while institutional-grade compliance was ensured.

2. Introduction

In the highly regulated Australian commercial property sector, Yardi Voyager acts as the central financial nervous system. During a pre-audit health check, a rapidly expanding commercial REIT discovered that its Yardi environment had evolved into a “security spiderweb”. Years of ad-hoc access requests, employee turnover, and regional workarounds resulted in junior staff holding unauthorized permissions to sensitive financial modules. A critical failure in Segregation of Duties (SoD) was identified as the core issue. Users possessed the ability to both create vendors and approve payments, creating a significant vector for financial fraud and posing a serious threat to the organization’s compliance standing.

3. Background Information

Institutional investors require strict adherence to IT General Controls (ITGC) to ensure the integrity of financial reporting. Historically, the client allowed regional offices to manage their own user provisioning inside Yardi Voyager. This decentralized approach led to a bloated system containing more than 150 poorly defined Menu Sets for a workforce of only 300 employees. Key stakeholders included the Chief Financial Officer (CFO), who was responsible for the upcoming SOC 1 Type II audit, and the internal operations team, who struggled daily with cluttered menus and irrelevant modules.

4. Case Analysis (SWOT)

To systematically isolate the security vulnerabilities, a SWOT analysis of the existing user access landscape was conducted:

1. Strengths:A highly granular, robust native security architecture is possessed by Yardi Voyager, which is capable of strictly enforcing compliance if configured correctly.
2. Weaknesses:A complete lack of a centralized Segregation of Duties (SoD) matrix was identified. Additionally, “Super User” access was frequently granted as a quick fix to resolve L1 support tickets.
3. Opportunities:
   A dual benefit was offered by the redesigning and condensing of Menu Sets: audit requirements could be satisfied while the daily User Experience (UX) was drastically improved by hiding irrelevant modules.
4. Threats:Risks included the immediate threat of failing the SOC 1 Type II audit, potential financial fraud due to SoD violations, and the exposure of Personally Identifiable Information (PII) belonging to commercial tenants.

5. Proposed Solutions & Alternatives

To address the compliance gaps, two primary remediation paths were presented to the executive team:

Recommendation: Option B was selected to ensure remediation was completed before the arrival of external auditors and to fix the root cause through a centralized support model.

6. Implementation & Recommendations

A strict, three-phase remediation plan aligned with Australian business hours was executed by the offshore technical team:

1. Phase 1: Discovery & SoD Matrix Development (Weeks 1–2):
   All current user access logs were extracted directly from Yardi’s backend tables. Every job function (e.g., AP Clerk, Property Manager) was mapped against a newly developed SoD Matrix. Forty-two instances where users held conflicting financial privileges—such as the ability to edit bank details and process payments—were immediately identified and revoked.
2. Phase 2: Menu Set Rationalization (Weeks 3-4):
   The 150+ convoluted, legacy Menu Sets were archived. In their place, 12 standardized, strictly “Role-Based” menus were engineered. Users were restricted to the exact screens and reports necessary for their specific job descriptions, which drastically reduced UI clutter.
3. Phase 3: Automated Provisioning & BAU Handover (Weeks 5-6):
   A strict, ticket-based workflow was established for all future access requests. “New Hire” tickets are now submitted by the local Australian HR team to the offshore team, who provisions the exact role-based template to ensure “permission creep” cannot reoccur.

7. Conclusion & Lessons Learned

System security within Yardi is not considered a “set and forget” deployment. By shifting from a decentralized, reactive permission model to a highly governed, centralized RBAC architecture managed by an expert offshore team, the SOC 1 Type II audit was successfully passed with zero critical ITGC findings. Furthermore, internal L1 support tickets dropped by 60% as the operational friction of navigating Yardi was significantly reduced. The ultimate lesson learned is that clear, role-based system boundaries not only protect the organization from risk but also empower end-users to work faster and with greater confidence.