Hospital audit: nine dark cameras and a request to soften the report
You are auditing CCTV for a 300-bed private hospital in Amritsar against the site's stated 30-day retention and 98 percent camera-availability standard. The scope covers 62 cameras, two NVRs, the control room and access records for the month of January. Your tests produce: 9 cameras with no usable image for the whole month, 3 cameras whose on-screen date reads 2023 instead of 2025, storage actually holding 11 days, 14 dome covers soiled enough to fog night images, no access log for the pharmacy store feed, and an NVR time offset of 4 minutes 20 seconds. The facility manager says most of this is 'minor' and asks you to 'keep the numbers light' because the hospital is applying for accreditation. Your contract requires a factual report to the medical superintendent with a copy to the security committee.
1. Set out the structure of the report you would issue, and explain what each section is for.
Read the worked answer
Structure, section by section
- Scope, period and standard. Exactly what was tested (62 cameras, two NVRs, control room, access records, January), and the benchmark used - the site's own 30-day and 98 percent figures. Naming the benchmark is what converts an opinion into a finding.
- Method and evidence. How each test was performed (export attempts per camera, on-screen clock comparison against IST, capacity arithmetic, visual inspection), with an evidence register numbering every screenshot, export and log.
- Limitations. What you could not test and why - for example channels whose export failed for unrelated reasons, or records the site could not produce.
- Findings, one per issue, each with: the condition observed, the measurement, the evidence reference, the risk in operational terms, a severity rating, and the requirement breached.
- Severity summary - a single table so a reader who stops after page two still understands the shape of the problem.
- Recommendations with an owner and a due date, not just an action.
- Management response - verbatim, in their words. This is where disagreement belongs.
- Annexes - evidence register, hashes, photographs, clock-comparison images, capacity calculation.
The discipline of separating observation, evidence, risk and recommendation is what makes the report usable by a security committee and defensible if it is ever read in a courtroom or by an accreditation assessor.
2. Write two of the findings as they would appear in the report, and justify the severity you assign.
Read the worked answer
Finding 1 - Availability '9 of 62 cameras (channels 7, 11, 14, 22, 28, 31, 40, 47, 55) produced no usable image for the entire audit period. Evidence: export attempts on 3, 9 and 17 February, each returning "no video"; screen captures with NVR time visible; channel status export (Annexure C). Two of the nine cover the pharmacy corridor and one the ambulance bay. Measured availability: 53/62 = 85.5 percent, against the stated 98 percent. Risk: no recorded coverage of controlled-drug storage and emergency intake for a full month, and no footage to answer any incident or complaint from January. Severity: High. Requirement: 98 percent availability standard. Recommendation: restore and prove by a 24-hour continuous test per camera, evidence due within 7 days. Owner: facilities and CCTV vendor.'
Severity reasoning: the ratio drives the rating, but the location drives the risk - a dead camera over a corridor is a defect, a dead camera over the pharmacy is an exposure.
Finding 2 - Time accuracy 'NVR 1 runs 4 minutes 20 seconds ahead of IST; three channels display the year 2023. Evidence: side-by-side photograph of NVR time and IST reference at 11:42 on 9 February; per-channel date captures (Annexure D). Risk: every timestamp generated in January inherits the error, and footage from those three channels cannot be tied to a date at all without an interpretive note. Severity: High. Recommendation: enable NTP against an internal source, restrict clock changes to two named administrators, and re-test within 14 days.'
Write findings as measurements plus evidence plus consequence. Avoid 'the vendor is negligent' or 'staff do not care' - those are conclusions a reader cannot test.
3. How do you handle the facility manager's request to 'keep the numbers light', and what legitimate options does he have?
Read the worked answer
Decline, in writing, once, without drama. State that the report is factual, that the contract names the medical superintendent and the security committee as recipients, and that the figures are measurements with annexures attached - they are not a dial you can turn.
Offer the legitimate routes instead:
- Classification. If the site's own standard genuinely does not cover an item, it can be reported as an 'observation' rather than a nonconformity. That is a scope judgement, made once, in writing - not a numbers reduction.
- Management response. His disagreement goes in the management-response section, verbatim. A well-run accreditation process reads that section sympathetically.
- Remediation credit. If he fixes items before the report is issued, re-test and record the closure with dates and evidence. The finding then reads 'closed before issue' rather than disappearing.
- Sequencing. He may ask for a re-audit date; he may not ask for a different result.
Explain the exposure he is creating. An accreditation body that later finds nine dead cameras will treat a clean report far worse than an honest one. If a January incident surfaces and the footage does not exist, an altered audit becomes an insurance and liability problem, and the auditor's name is on it.
Protect the record. Keep the draft, the request and your reply. If pressure continues, escalate to your own contract manager and to the security committee, since they are a named recipient. Silence under pressure is how an auditor becomes complicit.