Which practice best describes access control for computerized SOP systems?

• A. Role-based access
• B. Share passwords among team
• C. Open access for all staff
• D. No authentication

Answer: (A)

Access control for computerized SOP systems is best handled by role-based access. This means giving users permissions based on their job role rather than treating everyone the same. It supports the principle of least privilege—people only get the tools they need to do their work. In an SOP system, you can define roles like Editor (create and modify SOPs), Approver (review and publish), and Viewer (read-only). Mapping permissions to roles makes it easy to add, remove, or adjust access when someone changes roles, and it creates clear accountability through auditable activity tied to a user. It also helps enforce segregation of duties, such as ensuring the person who drafts an SOP is not the same person who approves it, which reduces risk.

Sharing passwords among team members weakens accountability because actions are no longer tied to a specific individual. Opening access to all staff violates least privilege and increases the chance of unwanted changes or data exposure. No authentication leaves the system completely unprotected and unable to verify who is performing actions. Role-based access strikes the right balance of security, control, and practicality for SOP systems.