What this is
What is a provisioning record?
What is a provisioning record?
It is the single list of everything a worker holds from the organisation — physical items and access rights alike. It is written at the point of issue, not reconstructed at exit, and it is the authoritative answer to the question of what this person has. Everything else is a partial view held by one department.
What does provisioning cover that an equipment issue note does not?
An issue note covers a transaction: one item, one day, one signature. A provisioning record covers a person's whole entitlement across stores, IT and facilities, and stays open across their tenure. The difference matters at offboarding, where you need the person view rather than a stack of transactions.
Why is this raised on role change and not only at hire?
Because role change is where entitlement accumulates. A worker who moves from stores to maintenance gains tool access and area access, and almost never loses the old rights, because nobody was asked to. Re-running the record on role change makes the removal side of the move explicit.
Scope
When is a worker equipment and system provisioning required?
This is the person-level entitlement record. It spans stores, IT and facilities, which is precisely why it is easy to lose to the neighbouring templates that each cover one slice of it.
Use this template when
- A new starter is being issued equipment and granted access before or during their first week
- A worker changes role and their equipment or access entitlement changes with it
- A worker is issued a replacement for a lost, damaged or expired item and the record needs updating
- A temporary or agency worker is being provisioned for a fixed engagement
- Offboarding needs the authoritative list of what to recover and what to revoke
Do not use it for
- Access Request Record, which authorises one targeted grant with its own justification and end date, rather than the day-one bundle.
- PPE and Locker Issue Record, which is the transactional issue note with sizes and replacement dates for personal protective equipment alone.
- New Starter First Day Record, which captures what happened on day one — arrival, induction, first supervised task — not what the person now holds.
- Key and Access Device Register, which is the asset-side view of every key and fob in circulation, not the person-side view.
- Worker Offboarding Checklist, which reads this record backwards at exit and should never be the first place an item is written down.
Compliance mapping
Which ISO 27001 cl.8.1 requirements does this satisfy?
ISO/IEC 27001 clause 8.1 covers operational planning and control; the substance sits in the Annex A controls on asset inventory, return of assets and access provisioning. PPE obligations come from separate occupational health and safety law rather than the standard.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO/IEC 27001:2022 Annex A 5.9 | An inventory of information and other associated assets, including owners, is developed and maintained | Records |
| ISO/IEC 27001:2022 Annex A 5.10 | Rules for acceptable use and procedures for handling assets are identified, documented and implemented | Records |
| ISO/IEC 27001:2022 Annex A 5.11 | Personnel and other interested parties return all organisational assets in their possession upon change or termination of employment | Records |
| ISO/IEC 27001:2022 Annex A 5.16 | The full life cycle of identities is managed, including creation on joining and adjustment on role change | Access |
| ISO/IEC 27001:2022 Annex A 5.18 | Access rights are provisioned in accordance with the access control policy and adjusted on change of role | Access |
| ISO/IEC 27001:2022 Annex A 7.2 | Secure areas are protected by appropriate physical entry controls | Access |
| ISO/IEC 27001:2022 clause 8.1 | Processes needed to meet information security requirements are planned, implemented and controlled, with documented information retained as evidence | Outcome |
| PPE at Work Regulations 1992, regulation 4 | Suitable personal protective equipment is provided to employees exposed to a risk that cannot otherwise be adequately controlled | Physical |
What it does not cover
- The purchase order, which proves the organisation bought an item but not that a named person received it or agreed to return it.
- The IT service desk ticket, which records account creation but is closed the same week and never reopened when the role changes.
- The key cabinet log, which shows a fob left the cabinet and rarely shows which permissions that fob currently carries.
- A signed PPE issue sheet alone, which covers protective equipment and leaves accounts, door access and tools entirely undocumented.
- The offboarding checklist, which is a recovery instrument and cannot be the source of truth for what was issued years earlier.
Global
Worker Equipment and System Provisioning requirements by country
Provisioning straddles two legal regimes: safety law dictates what protective equipment must be provided and at whose cost, while data protection and security law dictates what access may be granted and evidenced.
Personal Protective Equipment at Work Regulations 1992, as amended by the 2022 Regulations
Requires suitable PPE to be provided free of charge, maintained and properly stored, with the 2022 amendment extending the duty from employees to limb (b) workers.
Agency and casual workers must be provisioned on the same basis as employees, so a record that only covers permanent staff no longer evidences compliance.
Council Directive 89/656/EEC on the use of personal protective equipment, Articles 3 to 6
Sets the hierarchy — collective measures first — and requires assessment, information and training on the PPE actually provided.
The record has to show that the issue followed an assessment rather than a standard kit list, and that the worker was told how to use and maintain what they were given.
29 CFR 1910.132, including the employer payment provisions at 1910.132(h)
Requires hazard assessment, provision of suitable PPE, employee training, and employer payment for most protective equipment.
OSHA citations frequently turn on documentation rather than the equipment itself: no written hazard assessment or issue record means the provision is treated as unverified.
How to complete it
How to complete a worker equipment and system provisioning, step by step
The mechanics are simple. The four judgements below decide whether this record still holds up when somebody has to act on it two years later.
It is tempting to answer Yes when only some items carry a serial. Answer Yes only if every item that has an identifier has had it recorded. A partial capture reads as complete in reporting and then fails at exit, which is the worst of both — the record claims coverage it does not have.
The weak version is comparing the grant to the department's usual bundle. The strong version is asking what the person will actually do this month. Role change is where this matters most, because the honest question is what the old role's access should now lose, and the field will not answer that unless somebody looks.
The worker signs for what they received, and the signature is only meaningful if they were told the terms first — what must come back, in what condition, what happens if it does not. Explaining at exit is legally weak and practically useless. Sequence it before Worker Signed For What They Received, not after.
A worker starting without their prescription safety eyewear or without the system account they need is not complete, however convenient it is to mark it so. Leave the record open, let Status carry In progress, and let the gap be visible. A closed record with a silent gap is how people spend a fortnight doing a job they cannot properly do.
What auditors find
Most common worker equipment and system provisioning findings
These are the findings audits and exit reviews return to, with the field that would have prevented each.
| Finding | Clause | What fixes it |
|---|---|---|
| Leaver retained a laptop and a door fob that no list recorded | ISO/IEC 27001:2022 Annex A 5.11 | Everything Recorded Against The Person in the Records section is the join between the three functional lists and the individual. |
| Equipment recovered but unidentifiable, so recovery could not be reconciled | ISO/IEC 27001:2022 Annex A 5.9 | Serial Or Asset Numbers Captured. Without an identifier the return of an asset cannot be matched to its issue. |
| Worker retained old department's door access after transferring | ISO/IEC 27001:2022 Annex A 5.18 | Re-raise the record with Trigger set to Role change, and answer Access Level Matches The Role against the new role only. |
| Contractor's temporary system account still active months after the engagement | ISO/IEC 27001:2022 Annex A 5.16 | End Date Applied Where Temporary in the Access section, with the corresponding Access Request ID captured in Outcome. |
| PPE issued without recorded sizes, so replacements guessed and fit failed | PPE at Work Regulations 1992, regulation 4 | PPE Issued And Recorded With Sizes. Ill-fitting PPE is unsuitable PPE, and unsuitable PPE is the same finding as no PPE. |
| Fobs issued from the cabinet but never entered into the register | ISO/IEC 27001:2022 Annex A 7.2 | Keys Or Fobs Issued And Registered plus Recorded In The Key And Access Register — two fields because the issue and the registration genuinely come apart. |
Case in point
Case in point: the reconciliation that took six weeks
A distribution site closed a shift pattern and released forty-one agency workers over a fortnight. Offboarding asked stores for the issue list. Stores produced PPE sheets for thirty-two of them, IT produced account exports that did not use the same name format, and facilities had a key cabinet log with initials rather than full names.
Reconciling the three lists took six weeks and still left eleven fobs and four handheld terminals unaccounted for. Every individual issue had been done properly. What was missing was the person-level record that would have let one page answer the question for each worker, written on the day they started rather than assembled after they had gone.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
5 sections
- Reference
- OPS-039
- Archetype
- Record
- Record ID
- PROV-2026-000
- Scoring
- Provisioned and recorded
- Direction
- High is good
- Singleton
- Yes
- Basis
- ISO 27001 cl.8.1
- Links
- Links Access Request, Key Register, PPE Issue
- Tags
- Worker, Provisioning, Access
- Sections
- 5
- Fields
- 50
- Follow up fields
- 3
- Repeating sections
- 0
- Links out
- 6
Header
13 fieldsRecord ID*
Auto sequence. Format PROV-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Worker*
Person ID
Links to FDN-003 Person ID
Trigger*
New starter, role change, replacement, or additional need.
Requested By*
Issued By*
Issued*
The List Offboarding Works From
You cannot remove what was never recorded as issued. This is the same list read forwards at the start and backwards at the end, and it only exists if somebody built it on day one.
Physical
6 fieldsPPE Issued And Recorded With Sizes*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Uniform Issued*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Locker Allocated*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Tools Or Instruments Issued*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Vehicle Or Equipment Allocated*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Keys Or Fobs Issued And Registered*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Access
6 fieldsSystem Accounts Created*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Access Level Matches The Role*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Door Access Granted To Required Areas Only*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Restricted Area Access Justified*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
End Date Applied Where Temporary*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Recorded In The Key And Access Register*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Records
6 fieldsEverything Recorded Against The Person*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Serial Or Asset Numbers Captured*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Replacement Dates Set Where Applicable*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Return Expectations Explained*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Worker Signed For What They Received*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Register Updated*
- Yes3 pts
- No0 pts
Outcome
19 fieldsProvisioning Complete*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Items Issued*
Access Rights Granted
Access Request ID
Links to OPS-028 Request ID
Key Register ID
Links to OPS-026 Register ID
PPE Issue Record ID
Links to OPS-030 Record ID
Items Assessed*
Excludes anything marked N/A.
Items Failed*
Score Percent*
Calculated on submission. High is good. N/A items leave the denominator.
Result Band*
- Pass3 pts
- Caution1 pt
- Fail0 pts
Completeness Percent*
How much of the template was actually answered. A high score on a half completed form is not a high score.
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Hiring Manager*
Signature*
Stores*
Second Signature*
OPS-039 · record IDs look like PROV-2026-000 · Links Access Request, Key Register, PPE Issue
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
Issuing is easy. Keeping the record current across role changes, and making sure it is the list offboarding actually reads, is where provisioning quietly fails.
Holds the person-level entitlement across stores, IT and facilities, reopens the record on every role change, and hands the resolved list to offboarding rather than making somebody rebuild it.
Ties the PPE lines back to the hazard assessment for the role, so equipment is issued against an assessed risk rather than a standard kit list, and flags sizes or replacement dates that were never captured.
Maps the population back to Annex A 5.9 and 5.11, and surfaces workers whose entitlement has grown across role changes without anything being removed.
Reconciles issue records against the key and access registers, drafts the role-change delta, and holds every write for your approval before it touches a record.
This template lives in KnowOps — frontline execution. Shift handover, production control, daily management, worker lifecycle and improvement.
Meet KnowOps→Glossary
Worker Equipment and System Provisioning definitions and key terms
- Provisioning
- The act of issuing equipment and granting access rights to a named person, recorded at the point of issue rather than reconstructed later.
- Asset inventory
- The maintained list of organisational assets with identifiers and owners, which is what makes return of assets enforceable at exit.
- Return of assets
- The obligation on a worker to hand back everything held by the organisation on termination or change of role, and on the organisation to know what that is.
- Limb (b) worker
- A UK employment status covering casual and some agency workers, brought within the PPE provision duty by the 2022 amendment regulations.
- Entitlement
- The full set of items and access rights a person legitimately holds at a point in time, as distinct from the individual transactions that created it.
FAQ
Frequently asked questions about worker equipment and system provisioning
Should this be one record per worker or one per issue event?+
One per worker, reopened on each trigger. The Trigger field distinguishes New starter, Role change, Replacement and Additional need, so the history is visible without splitting the person across multiple records. Splitting by event recreates exactly the fragmentation the record exists to solve.
How does this differ from the PPE and Locker Issue Record?+
The PPE record is the detailed transaction — sizes, replacement dates, the physical handover. This record is the person-level summary that also carries accounts, tools and door access. Capture the PPE Issue Record ID in the Outcome section so the detail is one click away rather than duplicated.
Do agency and contract workers need this record?+
Yes, and arguably more urgently. Short engagements are where provisioning is most casual and recovery least likely. The UK PPE amendment of 2022 removed any argument that limb (b) workers sit outside the provision duty, and the security exposure from an unrecovered fob is identical regardless of contract type.
What should Access Rights Granted actually count?+
Count distinct rights, not systems — a group membership carrying several permissions is not one right. The number is useful mainly as a trend: if new starters in one function routinely receive three times what another does, that is a question about the access model rather than about any individual.
Is a second signature from stores really necessary?+
It is the only signature that comes from the person who physically handed the items over. The hiring manager signs for the entitlement being correct; stores signs for the handover having happened. When the same person can supply both, the record documents an intention rather than an event.
What happens to this record at offboarding?+
It becomes the checklist. Worker Offboarding Checklist should be populated from this record rather than from memory, and every line here should resolve to returned, revoked or written off. Items that cannot be resolved are the ones that belong in the CAPA, not in a footnote.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Worker Onboarding and Offboarding
Worker Profile
Holds a record for each worker, including role, department, site and start date
Exit Health Assessment
Records a worker's health status when they leave a role with hazardous exposure
Key and Access Device Register
Holds every key, fob and access device, who has it and what it opens
Access Request Record
Requests and approves access for a person to an area or a system, with the justification and an end date
New Starter Pre-Arrival Checklist
Everything that must be complete before a new worker's first shift, covering right to work, references, medical clearance, competency evidence, equipment ordered and systems requested
New Starter First Day Record
Records what actually happened on a new worker's first day, from arrival through induction, introductions, equipment issue and their first supervised task
More in Worker Lifecycle
New Starter Pre-Arrival Checklist
Everything that must be complete before a new worker's first shift, covering right to work, references, medical clearance, competency evidence, equipment ordered and systems requested
New Starter First Day Record
Records what actually happened on a new worker's first day, from arrival through induction, introductions, equipment issue and their first supervised task
Probation and Ninety Day Review
Reviews a new worker at the agreed points, covering competence, fit, support received and whether anything promised at hire actually happened
Worker Role Change Record
Records a worker moving to a different role, area, shift or site, and what has to change as a result
Worker Offboarding Checklist
Closes out a worker leaving, covering access removal, equipment return, knowledge handover, final health surveillance and the exit conversation
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO/IEC 27001:2022 — clause 8.1 and Annex A controls 5.9, 5.10, 5.11, 5.16, 5.18, 7.2
- Personal Protective Equipment at Work Regulations 1992 (SI 1992/2966), regulations 4 and 7, as amended by SI 2022/8
- Council Directive 89/656/EEC — Minimum health and safety requirements for the use of personal protective equipment, Articles 3 to 6
- 29 CFR 1910.132 — General requirements for personal protective equipment, including 1910.132(h) employer payment
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.