Testing settings and reviewing access

1. Regulatory Concept & Core Standards

In this video we will consolidate a skill: evidence a change through suitable retesting. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. Configuration examples describe general methods. Verify real functions in your own environment. Each change connects permissions, procedure and Latvian rules. Fictional tests help avoid creating a new confidentiality risk.

A setting is not correct merely because an administrator sees it. Test actual roles, allowed actions and blocked actions. Changes can affect search, export, notices and old cases. Document test limits.

Apply the following rule: Sections 11–12 protect the identities of reporters and persons concerned. The GDPR requires necessity-based retention. Adopt a specific document schedule considering archiving, procedural and sectoral duties. The Whistleblowing Law contains no universal five-year period for all reports. Assess attachments, exports and copies too.

2. Practical Implementation & Procedure

Define expected results first. Use fictional cases and varied roles. Test granting and removing rights. Record version, result and correction. Retesting should show no new problem. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A new role sees one case, but search exposes other titles. The team restricts search, then checks lists, export and notifications. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does one successful opening establish every permission is correct? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Test prohibited access and other revealing views too. Conclusions must fit the work actually performed.

One mistake to avoid is: extending one successful test to the entire system.

Now apply the national rule to a second decision. The system deletes every file five years after receipt. Is this a universal Latvian rule?

No. Define purpose, applicable procedural and archiving duties, starting event and review. Protect exports and attachments too. Completed examination does not automatically mean immediate deletion; indefinite unnecessary retention is also impermissible. Document exceptions and regular review.