Issue 2 described the office administrator post as currently vacant. That was wrong on both counts. Joanne Graham has been the Admin Assistant throughout, and Laura Walden joined on 8 June 2026 as Finance & Compliance Assistant — an additional role, not a replacement. The post was never vacant; the assessment described a vacancy that did not exist while omitting a second person who did. Both are now named as persons at risk. No control, score or action changed — the exposed population is the same and is now described accurately. The review anniversary is unchanged at 04/09/2027.
Storing, accessing and sharing AMWS business data on Microsoft 365 / OneDrive, the GitHub repositories that hold the IMS and Van Packs portals, and customer portals (Anglian Water, Severn Trent). Assessed against the controls set out in POL_HSQE_30 IT Security.
Northampton Office (Unit 1), Unit 2C Stour Road, home working locations, and any location from which a company or personal device connects to AMWS systems.
| Hazard | Existing controls | Initial | Additional controls | Residual | ||||
|---|---|---|---|---|---|---|---|---|
| S | L | R | S | L | R | |||
| Personal-data breach through a misdirected email or an over-broad file-sharing link | MFA enabled on Microsoft 365 and cloud storage (POL_HSQE_30 Section 2); role-based access with the access list held by Leanne Mason; no shared logins; 24-hour internal reporting and the 72-hour ICO pathway documented at POL_HSQE_30 Section 8 | 3 | 2 | 6 | Sharing links set to named recipients rather than anyone-with-the-link; Leanne Mason spot-checks externally shared links quarterly | 2 | 2 | 4 |
| Loss of working files or an inability to restore them | Microsoft 365 / OneDrive provider backup is the primary backup (POL_HSQE_30 Section 4); IMS and Van Packs portals versioned in GitHub with history as the source of truth; restore procedure documented in APP_17 | 3 | 2 | 6 | Restore has never been tested. Annual restore test — recover one folder and one portal build from history and record the outcome in the APP_17 testing log (Sean Ashton, by 31/03/2027) | 2 | 1 | 2 |
| Unauthorised access following a lost or stolen device | Full-disk encryption on company laptops, screen locks on mobiles, devices never left in unattended vehicles overnight (POL_HSQE_30 Section 5); MFA on all cloud services | 3 | 2 | 6 | Confirm remote sign-out and device-wipe capability in the Microsoft 365 admin centre and record who can invoke it (Aaron Mason, by 31/12/2026 alongside the Cyber Essentials work) | 2 | 1 | 2 |
| A leaver retains access to systems or customer portals | POL_HSQE_30 Section 1 requires same-day revocation; leavers processed by Leanne Mason; access list reviewed at the annual Management Review | 3 | 2 | 6 | Revocation recorded against the access list at the time it happens, so the September Management Review reviews evidence rather than a policy statement | 2 | 1 | 2 |
| Cloud service outage during a live job | APP_17 Business Continuity Plan; field work packs are carried in the vans and published on the Van Packs portal; telephone and WhatsApp fallback | 2 | 2 | 4 | None — a short Microsoft 365 outage does not stop field work, and the BCP covers a prolonged one | 2 | 2 | 4 |
| Accidental deletion of a controlled document | OneDrive recycle bin and version history; GitHub history for the portals; the portal is master and local copies are working copies only (POL_HSQE_30 Section 4) | 2 | 2 | 4 | None required — version history is the control and it is inherent to the platform | 2 | 2 | 4 |
| Subcontractor holding customer or personal data outside the official apps on a personal device | POL_HSQE_30 Section 5 BYOD rule — device locked, no customer data outside official apps; WhatsApp Works group used for operational cascade only | 3 | 3 | 9 | BYOD expectation restated in the IT-security toolbox talk on annual rotation; no customer personal data or documents to be circulated through the WhatsApp Works group | 2 | 2 | 4 |
This document is maintained under AMWS's continuous-compliance model. Substantive revisions are reviewed and signed off by the Directors at the standing weekly Director / HSQE compliance call (Sean Ashton, Onyx + Leanne Mason). Currency, cross-references and minor edits are checked at the monthly Onyx site visit. The annual Management Review (September) provides the strategic-level confirmation. Compliance is therefore continuous, not gated on a single annual meeting.