1. Relying on spreadsheets and duplicating assets
Treating a spreadsheet as the sole source of truth hides the difference between a planning note and a confirmed system state. Duplicate asset records compound the problem: the same laptop may appear available in one list and assigned in another, leading to unnecessary purchasing or missed recovery.
- Define the authoritative source for each important field and record when it was last checked. Keep spreadsheets for bounded tasks with a named owner.
- Reconcile assets using stable identifiers such as serial numbers, not display names alone. Investigate conflicting assignments before merging records; preserve relevant history and use an approved correction process.
2. Leaving applications ownerless and renewals unmanaged
An application without an owner rarely receives a timely decision about access, business need or renewal. Ignoring renewal dates allows commercial commitments to continue by default, even when teams have changed. A billing contact is not necessarily the person authorised to decide whether a service remains necessary.
- Assign a business owner and an operational contact to each application, including locally purchased services.
- Record renewal dates, notice requirements and the source contract. Schedule review early enough for the actual decision process, and confirm uncertain terms with procurement or the supplier.
- Review assignment, usage where available and business dependency before proposing changes; inactivity alone is not proof a subscription is unnecessary.
3. Leaving departure accounts active
A departure checklist can appear complete while an account remains active in an application outside the central identity service. Closing an IT ticket is not the same as confirming access removal. Equipment, shared responsibilities and business information also need explicit handover decisions.
- Use the confirmed departure event to identify known accounts, assigned assets and application owners. Record discovery gaps rather than claiming complete coverage.
- Obtain required approvals, perform authorised changes and verify the resulting state in each relevant system. Assign manual follow-up where no supported action exists.
4. Mistaking enrolment or visibility for enforcement
Device enrolment shows a management relationship, not full compliance. A stale check-in, missing assessment or unresolved exception can make a reassuring device count misleading. Similarly, seeing an account or a policy issue does not demonstrate the ability to correct it.
- Assess the specific controls required by policy, the freshness of each observation and whether the device is actually in scope.
- Separate observed, assessed and verified remediation states. Identify the authorised enforcement system and responsible operator.
- For example, a fictional enrolled laptop with no recent assessment should remain awaiting verification, not be labelled compliant merely because it appears in inventory.
5. Collecting context-free evidence and skipping approvals
A screenshot without a date, scope or reviewer may be difficult to interpret later. Automation without approvals can turn an uncertain record into an inappropriate change. Both mistakes remove the context needed to explain why an operation was justified.
- Attach the source, collection time, relevant policy or control, scope and reviewer to evidence. Distinguish a captured observation from a reviewed conclusion.
- Define approval requirements, exception handling and post-action checks before enabling a workflow.
- Lojycal provides append-only audit and signed evidence export mechanisms, but not every record is immutable. Integrity controls do not establish certification or legal sufficiency; retain human review.
6. Assuming an integration covers every field
A provider connection can expose selected records without supporting every field or write operation. Lojycal can connect operational records and workflows, but capabilities depend on the provider, mappings, permissions, credentials and plan or role requirements. Supported employee operations include preflight confirmation and re-read verification; confirm the exact workflow for your workspace.
- Test one representative record from source to display and, where supported, through an approved change and read-back.
- Check missing fields, stale data, identity matching and permission-denied behaviour.
- Choose the highest-risk mistake first, assign a corrective-action owner and review results before expanding automation.