Most of the year, the service desk is judged on speed. How fast the queue moves, whether the SLA is green, whether the person on the other end felt looked after. Then an audit shows up and the question changes. SOC 2, ISO 27001 and Cyber Essentials are different certificates, but they all want the same thing from the people who run the desk: proof of who joined, who left, and who can still sign in.

That proof isn’t a policy and it isn’t a dashboard. It’s the ticket that created an account, the person who approved the access, the device that walked out the door, and the leaver step that actually turned the sign-in off. When those pieces sit in different tools, or in one person’s spreadsheet, the desk ends up explaining a control it doesn’t fully hold. This post is about that week, and what it feels like when the questionnaire lands on the people who can show the work.

It’s Wednesday, 16:10. Someone from the audit firm has sent a list that looks polite and isn’t. Joiners in the last ninety days. Leavers. Who approved access. Which devices those people used on day one. Evidence, not a link to a policy. The person who owns the master spreadsheet is on a train with a dying laptop. The service desk has the tickets and Security has the control wording, and right now neither can tell the story without that file.

On the desk, all three certificates come down to one question. Can you show, for a real person, how they got an account, a device and a set of rights, and how those things stop when they leave? A green SLA pack doesn’t answer it. Volume, speed and a healthy CSAT say the queue is moving. They don’t say that the joiner from March still has access to a system they used for six weeks and never touched again.

The desk is the evidence

I’ve sat in reviews where the slide says access is reviewed quarterly and the room goes quiet when someone asks to see one name. The control exists on paper, and the proof is a conversation between three teams who each hold a third of it.

Joiners, movers and leavers are part of the audit, and they’re more than an HR workflow with an IT footnote. The ticket that created the account, the manager who approved the group, the device that was handed over, the leaver checklist that actually disabled the sign-in. If those live in four tools and one person’s memory, the certificate is a story you hope nobody interrupts.

Cyber Essentials is the smallest of the three and it still asks for this. Who has admin. Whether leavers are really gone. Whether the devices you claim are yours are the ones people use. ISO 27001 will ask how you know the process keeps happening after the audit team goes home. SOC 2 will ask for the population and then a sample, and sit with you while you open the ticket. Different badges, same question.

What fails is rarely the absence of a process. It’s a process that only works when its author is in the building. The spreadsheet with twelve tabs. The “we pull that from the console if they ask”. The leaver who was dealt with in Teams and never became a ticket. The joiner whose extra access was a favour, so it isn’t on the form the auditor is holding.

What you can actually show

You don’t need a new audit tool for this. You need one population you can talk through without the spreadsheet owner.

Take the joiners from the last ninety days. Just that, not the whole company and not every system. One list.

For each person, the desk should be able to say, without a side call:

  • the request that started it, and who approved it
  • the account that was created, and the access that was really granted, including anything extra that wasn’t on the form
  • the device they left with, and who owns it in the register
  • what would happen to all of that if they resigned on Friday

If any of those needs the person who’s on the train, that’s your finding. Write it down before the auditor does.

The green pack can stay in the leadership meeting. When someone asks for a name, what you put on the table is a ticket, an approval, a device record and a leaver path that still works when the usual person is offline.

Pick that list this week. Ten joiners is enough. If the desk can explain them, you have evidence. If it can’t, you’ve found the work, and it’s better to find it on a Wednesday than in the sample.