If your company has gone through an ISO 13485 audit, a customer qualification review, or a formal ITGC assessment, you have probably encountered questions about access control. Role-based access. Privileged account management. Provisioning and deprovisioning processes.
Those terms are familiar. What is less clear, for most IT teams at SMB medical device companies, is exactly what auditors are looking for when they ask about them, and what kind of documentation actually satisfies the question.
What Auditors Mean by Access Control
When an auditor asks about access control in an ITGC review, they are asking several related
questions at once:
- Do users have only the access they need to do their jobs, and is that access defined by role rather than by individual preference?
- When someone joins the company, is access provisioned through a documented process,
appropriate to their role from day one?
- When someone leaves or changes roles, is their access removed or modified promptly and through a documented process?
- Is someone periodically reviewing who has access to what, especially for privileged accounts, and is that review documented?
Note what is not in that list: specific technology requirements. Auditors are not looking for a particular identity management platform or a specific review cadence. They are looking for evidence that access is managed intentionally, consistently, and with documentation that proves it
The Three Access Control Gaps Most Commonly Cited in ITGC Reviews
If you are doing a self-assessment before an FDA inspection, start with these three areas:
What Good Access Control Documentation Actually Looks Like
You do not need an enterprise IAM platform to have defensible access controls.
Those three things, done consistently with evidence, will satisfy the access control questions in most ITGC reviews at companies under 500 employees. The gap is almost never the controls themselves. It is the documentation that proves the controls are actually being executed.
More to Explore
More insights and resources worth checking out
More insights and resources worth checking out.
