Wednesday, 16:10 · She has read this question before
Different questionnaire. Same five requests.
Question 34 of a new form: who is responsible for reviewing access rights, and how do you know it happens. Lea has answered this for four different reviewers this year, in four different templates. The wording changes. What sits underneath it does not.
Name the owner
Every control question has a role behind it. A maintained role register gives one current answer even when people change.
Show the document
A statement invites another question. A policy with an owner, version and review date gives the reviewer something they can inspect.
Prove it is current
Reviewers look at dates early. Version history, change reasons and stale-date checks show the document is alive.
Answer once
Access reviews, joiners and privileged accounts overlap. Define the rule once and link every answer back to it.
Share only what belongs outside
The pack must be complete without exposing internal notes. Mark restricted material before export, and nothing has to be recalled afterwards.
By the time Lea reaches question 34, it is already answered, with its source attached. She reads it, agrees with it and moves to question 35. That is the whole trick.
See the workflow