A monthly review of a customer information system should reveal whether staff can find the right information and use it appropriately. Counting contacts alone tells you little about duplicated records, outdated access or important details trapped in someone’s inbox.
The steps below create a manageable review for an Australian business using a customer relationship management system or similar records. They are an operational framework, not a complete privacy compliance assessment. A suspected breach or urgent access problem needs attention when discovered, rather than waiting for the next monthly meeting.
Step 1: Name the review’s purpose and owner
Choose the person responsible for organising the review and following up actions. Include people who actually use the system, along with relevant technical or privacy support. The owner does not need to perform every task, but should know where decisions and unresolved issues are recorded.
Define a small set of questions. Can staff locate current customer details? Are unfinished enquiries visible? Do people still have appropriate access? Has unnecessary information accumulated? These questions connect the review with real use instead of producing a report nobody needs.
Step 2: Confirm where customer information lives
List the systems involved in a typical enquiry or order. Include shared drives, forms, exports and spreadsheets as well as the main application. Note who is responsible for each location and how information moves between them.
The ASD’s ACSC business and customer data guidance recommends understanding what personal information is collected, where it is stored and how it is used. It also cautions that a central store must be protected; consolidation is not automatically security.
Do not create an extra copy of all customer records merely to perform the review. Use an appropriate restricted view, a small authorised sample or a summary that avoids unnecessary exposure. The review should not multiply the information it is trying to manage.
Step 3: Examine one ordinary workflow
Trace a recent enquiry from arrival to its current outcome. Check whether the next action, responsible person and relevant customer information are clear. Establish whether a handover depends on searching private messages or remembering an undocumented conversation.
- Where does the enquiry enter the system?
- Who checks whether a record already exists?
- How is the customer contacted and the response recorded?
- What shows that the enquiry is complete or awaiting action?
- How are corrections communicated to other relevant records?
Use the example to identify a specific improvement. If staff repeatedly retype the same information, investigate why before buying another integration. The underlying issue may be a confusing field, unclear responsibility or a form asking for information nobody uses.
Step 4: Review record quality carefully
Look for duplicate contacts, outdated details and inconsistent status labels. Decide how a correction is verified before changing important information. Two people with similar names are not necessarily the same customer, and merging their records without checking can create serious confusion.
Keep the reason for a material correction where appropriate. If an error affects another system, assign the follow-up instead of assuming it updates everywhere. Check that staff understand which version is the current working record.
Step 5: Check access and departed users
Review access against current roles, including staff changes and external suppliers. Ask whether each person still needs to view, change or export the information available to them. Include shared links and connected applications rather than checking named user accounts only.
Arrange changes through an authorised process. Record who approved them and verify they took effect. A monthly checklist can help detect an omission, but access removal should also be part of the actual departure or role-change process.
Step 6: Examine retention and recovery arrangements
Identify information whose continuing purpose is unclear and refer it to the appropriate retention decision. Legal obligations, business requirements and sensitivity affect what should be kept. Do not adopt a blanket rule to delete every old record or keep all information indefinitely.
Ask the relevant technical person to explain the current backup and recovery arrangements. Establish what evidence is available that recovery has been checked, and what the business would do if the application became unavailable. Avoid assuming that a cloud subscription alone answers those questions.
Step 7: Turn findings into a short action list
For each issue, record the problem, owner, proposed action and review point. Prioritise matters affecting customers or exposing information. Distinguish a confirmed error from a question requiring investigation so the action list does not quietly convert guesses into facts.
Choose improvements the team can implement and review. An instruction to clean the database is less useful than a defined process for checking and resolving a particular set of duplicate records. Keep affected staff informed about changes to fields or workflow.
Step 8: Close the loop next month
Start the next review by checking previous actions and any new incidents or recurring difficulties. Look for evidence that the improvement helped staff complete the intended task. A declining problem count is useful only if people are still noticing and reporting problems.
The monthly review should leave the business with clearer ownership and fewer unresolved questions about its customer information. Its value comes from practical corrections and accountable decisions, rather than the length of the exported report.