Services / Access and privilege audit

Who can do what

Access and privilege audit

If a locum from last Ramadan can still open the controlled-drug register, the application is not matching the roster. This audit lines roles up against people who actually work there.

Nurse at a station reviewing a patient board

Who it is for

Any facility where more than one shift shares the same application

How long it usually takes

One to two weeks

Roster against directory

We take a current duty roster and compare it with active application accounts. We look for departed staff, generic 'nurse1' logins, and privileges granted 'temporarily' during go-live. The output is a table a matron can act on, not a heat map.

Sensitive functions

Medication override, result acknowledgement, billing reversal, and record amendment are sampled in depth. We record whether the application enforces a second person, a reason code, or merely a checkbox that everyone ticks.

What you receive

An account hygiene list, a privilege map for the roles you actually employ, and recommended closures ordered by harm — a discharged doctor’s login before a missing password complexity rule.

Included in a typical engagement

  • Active-account review against a current roster
  • Privilege map for clinical and clerical roles
  • Sampling of override and amendment functions
  • Written closure list with owners

Ask for a scoping call about this work