Issue 2 described the office administrator post as currently vacant. That was wrong on both counts. Joanne Graham has been the Admin Assistant throughout, and Laura Walden joined on 8 June 2026 as Finance & Compliance Assistant — an additional role, not a replacement. The post was never vacant; the assessment described a vacancy that did not exist while omitting a second person who did. Both are now named as persons at risk. No control, score or action changed — the exposed population is the same and is now described accurately. The review anniversary is unchanged at 04/09/2027.
Handling, storing and disposing of confidential information — employee and subcontractor personal data, right-to-work documents, training certificates, payroll records, and customer commercial information held under framework agreements.
Northampton Office (Unit 1), Unit 2C Stour Road, home working locations and AMWS cloud storage.
| Hazard | Existing controls | Initial | Additional controls | Residual | ||||
|---|---|---|---|---|---|---|---|---|
| S | L | R | S | L | R | |||
| Employee or subcontractor personal data exposed — right-to-work documents, training certificates, payroll records | Held in the HR folder on Microsoft 365 with role-based access (POL_HSQE_30 Section 1); PROC_R2W_01 Right to Work procedure governs collection and retention; POL_HSQE_09 Data Protection | 3 | 2 | 6 | HR folder access limited to the Directors and confirmed at the September Management Review access review, so the restriction is evidenced rather than assumed | 2 | 1 | 2 |
| Customer commercial information shared more widely than needed | Customer-system access by individual named credentials, never shared (POL_HSQE_30 Section 7); no bulk export of customer data to local storage | 3 | 2 | 6 | Sharing links set to named recipients rather than anyone-with-the-link, as under RA_HO_02 | 2 | 1 | 2 |
| Paper records containing personal data left accessible in the office | Premises secured out of hours; the IMS portal is the master record, local copies are working copies only, and paper originals are limited to HR right-to-work and payroll files held in the locked HR cabinet | 2 | 3 | 6 | End-of-day habit of clearing anything containing personal data from desks. The confidential-waste route is not currently recorded — confirm and document it, whether an on-site cross-cut shredder or a confidential-waste collection (Leanne Mason, by 31/12/2026) | 2 | 2 | 4 |
| Confidential conversation overheard | Small office with few visitors; HR, payroll and disciplinary conversations held privately or by phone from a closed room | 2 | 2 | 4 | None — proportionate to the premises and the number of people present | 2 | 2 | 4 |
| Screen contents visible to a visitor or in a public place | Laptops locked when unattended (POL_HSQE_30 Section 5); very little desk working is done in public places or on customer premises | 2 | 2 | 4 | None. Privacy filters would be disproportionate to the amount of public working actually done | 2 | 2 | 4 |
| Loss or theft of a device holding personal data | Full-disk encryption on company laptops via BitLocker / FileVault; screen locks on mobiles; devices never left in unattended vehicles overnight (POL_HSQE_30 Section 5) | 3 | 2 | 6 | Remote sign-out and device-wipe capability confirmed in the Microsoft 365 admin centre with the invoking authority recorded (Aaron Mason, by 31/12/2026) | 2 | 1 | 2 |
| Personal data retained longer than it is needed | POL_HSQE_09 Data Protection sets the principle; right-to-work documents retained per PROC_R2W_01 | 2 | 3 | 6 | Retention periods for HR, payroll and training records written down and held in the HR folder so the principle is applied consistently (Leanne Mason, by 31/03/2027) | 2 | 2 | 4 |
This document is maintained under AMWS's continuous-compliance model. Substantive revisions are reviewed and signed off by the Directors at the standing weekly Director / HSQE compliance call (Sean Ashton, Onyx + Leanne Mason). Currency, cross-references and minor edits are checked at the monthly Onyx site visit. The annual Management Review (September) provides the strategic-level confirmation. Compliance is therefore continuous, not gated on a single annual meeting.