Kensington Grey

An account audit needs to answer more than whether a setting is switched on. The team also needs to know what was checked, what the evidence supports, and what still needs an owner's confirmation.

The review brought account access, connected applications, email, domain management, and website operations into one assessment. Recommendations needed enough context for the agency to make decisions about the work that would follow.

Our approach was evidence first. We reviewed the available settings and records without changing them, then documented observations alongside their scope and limitations.

• Review the systems togetherWe examined account protection and administrative access, file sharing, connected applications, email and domain configuration, and website operations.
• Connect each observation to evidenceThe assessment paired checks with dated observations and supporting references, so recommendations could be traced back to what was reviewed.
• Make uncertainty visibleWe distinguished observed settings from items that needed further review or client confirmation. Missing evidence was not treated as proof that a process or protection did not exist.
• Set an order for the workThe report grouped recommendations into immediate priorities and later follow-up, with owner confirmation where a decision depended on business context.

Implementation was a separate next step. The assessment gave the team a record to work from before making changes to its systems.

Kensington Grey received a documented review of its account and security setup, with supporting evidence, recommended actions, and the limits of each check recorded together.

The recommendations were organized into an order of work, giving the team a basis for deciding what to address first and what needed further confirmation from system owners.

The outcome was a plan for follow-up work. The audit did not change settings or permissions, and it does not establish that the recommendations have since been implemented.