I Used a Colleague’s Login for Development Work—How Should I Handle the Audit Meeting?

Stop using the shared account immediately and be completely factual in the meeting. Explain when and why it was used, who knew about it, and what work was performed. Ask your program manager to attend so responsibility and the access issue are discussed openly. The appropriate solution is an individually assigned account, or a formally documented exception with compensating controls—not an informal shared password.

Invite the program manager, or at least tell the auditor beforehand that management was aware of the arrangement. You can acknowledge that using someone else’s credentials was a mistake without speculating about penalties. The fact that the auditor warned you now gives you a chance to correct it, but continuing after being told to stop would make the situation much worse.

Your manager’s statement that a separate login isn’t available doesn’t make password sharing compliant. Raise the issue through the normal security or access-management process and request written guidance. In the meeting, focus on remediation: disable the shared access, identify the affected systems and dates, review the logs, and obtain proper permissions or an approved alternative.

This can be treated as a serious access-control violation because activity under a shared login cannot be reliably attributed to one person. Consequences depend on company policy, the systems involved, and whether any sensitive data or unauthorized actions were accessed. Don’t delete logs, alter records, or try to coordinate a story; preserve the facts and cooperate with the review.