Automatic amendment of scaccess records when saving a security profile

We're using SM 9.21 with folder security.  Whenever a security profile record is updated its corresponding scaccess record is also amended.  However, we have a fault whereby the amended folder is included in the scaccess record, regardless of whether the option is set to true or false.
For example:
If I set the "BTL Folder A Resolver" Incident Management Security Profile to:
Folder "A"  View=true  New=true  Update=never  Close=false
Folder "B"  View=false  New=false  Update=never  Close=false
I would expect the scacess record to look as follows:
File Name:  Probsummary
Security Group ID:  BTL Folder A Resolver
Restricting Query:  folder isin {"", "Folder A"} or folder=NULL
However, the scaccess record currently looks as follows:
File Name: Probsummary
Security Group ID: BTL Folder A Resolver
Restricting Query:  folder isin {"", "Folder A", "Folder B"} or folder=NULL
We have an old SM9 installation (which we do not make changes to) which we use as a reference system and this seems to work correctly, so clearly something has changed in our production system along the way, we just don't know what.
To investigate the issue I need to look at the mechanism which updates the scacess record upon saving the security profile (or folder rights) records.  Does anyone know what mechanism performs this action?
Many thanks in advance.