RESPONSIBLE BUSINESS PRACTICE
Clients may entrust ACVIMA with access to business information, systems and working documents. We approach that responsibility through controlled access, professional business systems, confidentiality expectations and managed oversight.
Security is an ongoing operational responsibility. The controls used for a particular engagement depend on the services, systems and access required.
Access to client information and systems should be provided only where required for approved service delivery. Access should be based on operational need, appropriate to the person's role, and avoid unnecessary permissions.
Access should be reviewed when responsibilities change and removed when it is no longer required. ACVIMA does not control every client system, so appropriate arrangements depend on the systems involved.
The ACVIMA Client Portal uses authenticated access for protected operational areas. Portal access is separated according to authorised roles and relationships.
This supports appropriate access to relevant service information without suggesting that any system is invulnerable or absolutely secure.
ACVIMA uses professional identity and authentication controls for its business environment. Where applicable, multi-factor authentication is used to strengthen account protection for ACVIMA-controlled business systems and accounts.
Controls for external client systems remain subject to the client's own configuration and agreed access arrangements.
ACVIMA uses professional Microsoft 365 business services for appropriate internal communication, collaboration and document-management activities.
Where SharePoint or similar controlled document areas are used, access should be limited according to business need, permissions should reflect the person's role, and unnecessary access should be removed. Sensitive client information should not be placed in unrelated public locations.
ACVIMA expects personnel with authorised access to client information to handle it confidentially and only for legitimate service-delivery purposes.
Information should be used professionally and only in support of the authorised work.
Access should be removed or adjusted when a task no longer requires it, responsibilities change, an assignment ends, an engagement is completed, or a team member should no longer have access.
This is part of responsible access management throughout service delivery.
Clients should provide only the access reasonably required for the agreed service and should maintain appropriate controls over their own accounts, systems and information. ACVIMA and the client should agree appropriate access arrangements for the work being performed.