Northgate's audit template

Northgate's compliance team (Rachel Owusu) runs an access audit every quarter: March, June, September, December. Three weeks before, Rachel sends each team manager this template as a spreadsheet. This page describes it, so we know what Northgate needs from us.

Columns

One row per person.

Column	What Northgate expects	Where it comes from today
Site	The person's home site	Access report
Team	The team the person is in	Team manager
Employee number	Northgate's own number	Northgate's HR
Name		Access report
Job title		Northgate's HR
What they can open	Each door or zone, system and vehicle, one per line	Access report
Role that gives it	The role behind each access	Access report
Approved by, approved on	Who approved the access, and when	Approvals audit log: the last 400 days; decisions before 13 August were brought in from request history at launch
Reason	Why the person needs it	The request's reason (required since 29 July)
Reviewed	The team manager's initials: still needed, or remove	Team manager

Nothing in the template asks when a person last signed in.

How it goes today

1. A Northgate administrator exports the Access report as a PDF, one per site.
2. Each team manager finds their people in the PDF and types their rows into the template.
3. Team managers mark access to remove; administrators remove it in the portal.
4. Rachel collects the templates and signs the audit off.

Step 2 is the pain. In September the twelve sites' team managers retyped about 1,400 rows.

What Northgate asked for

A spreadsheet export a team manager runs for their own team, with the columns above that we hold (SUP-1240). Our plan for it is ACM-290.

Change history

Version	Date	Who	What
1	4 Jun	Ben	From Rachel's template after the June audit
2	17 Sep	Ben	September audit: 1,400 rows retyped from 12 PDFs
3	10 Oct	Ben	Northgate's ask for a team export, SUP-1240
4	12 Oct	Ben	December audit date; linked ACM-290