Student records and information architecture audit

Why run this

What this checklist is for

Universities are federated by nature. Departments create sites, research groups keep their own structures, and central IT has authority over some of it and influence over the rest.

The result is student information distributed across an estate nobody has mapped, with access decisions made locally and inconsistently.

Run it with

Registrar or Head of Student Services

And with

SharePoint and Microsoft 365 administrators

And with

Information governance lead

The checklist

20 checks, in the order we would run them

Tick only what you can genuinely evidence today. An item you intend to do is not an item you have done, and scoring yourself generously here only produces a comfortable number and an uncomfortable project.

Section 1

Structure

Whether the estate has a shape anybody designed.

A site provisioning process exists rather than ad hoc creationAd hoc creation produces inconsistent permissions, which is where exceptions hide.
Every site has a named, current ownerOrphaned departmental sites are common in institutions and block every remediation.
A hub structure groups related sites for consistent policyPolicy applied at a hub reaches sites nobody remembers creating.
Naming and metadata standards exist and are appliedFindability across a federated estate depends on consistency more than on search technology.
Inactive sites are identified and archived or removedDormant sites hold student data and appear in every disclosure exercise.

Section 2

Student data protection

The obligations that make this different from a corporate estate.

Locations holding student-identifiable data are knownYou cannot apply proportionate controls to data whose location nobody has established.
Legitimate educational interest is enforced by role, not asserted by policyA policy document is not an access control. The system has to implement it.
Sensitivity labels are applied to student recordsProtection that travels with the document, including when it leaves the institution.
Retention aligns to your student records scheduleIncluding the different periods that apply to academic, disciplinary and financial records.
Access by departmental staff is reviewed periodicallyAccess granted for a role somebody has since left is the most common finding.

Section 3

Sharing

Where exposure accumulates in an open institution.

Anonymous sharing links are disabled or tightly restrictedAnonymous links to student records are a disclosure event requiring no attacker.
Organization-wide sharing is identified on sites holding student dataIn a university, organization-wide includes every student account.
Guest access is reviewed against current involvementVisiting academics, partner institutions and placement providers, added and never removed.
Link expiry is enforced on external sharingA link without an expiry outlives the placement, the collaboration and the student.
Students' own access to their records is handled deliberatelySubject access is a right. Making it a process rather than an exception saves considerable effort.

Section 4

Findability and adoption

Whether the structure actually serves people.

Staff can find current policy and procedure documents in under a minuteTest it. If not, the structure serves the people who built it rather than the people who use it.
Superseded versions are clearly marked or removedWorking from a superseded procedure is a governance problem, not a filing one.
Search returns useful results for common staff queriesTest with the ten questions staff actually ask.
Departmental practice varies within agreed bounds rather than freelyTotal standardisation is unachievable in a university. Bounded variation is not.
Somebody is accountable for the information architectureNot a committee. An architecture with no owner degrades toward the practices of whoever is most active.

What your score means

Read this against the number above

These bands are deliberately blunt. The middle band is where most organizations honestly sit, and it is a perfectly reasonable place to proceed from — provided the gaps are written down with owners rather than carried as optimism.

0–59%Significant gaps

Do not proceed yet. More than four in ten items are unaddressed, and the ones that fail here are usually the foundational ones that make everything after them harder.

60–84%Mostly ready, with known gaps

Proceed on a defined scope, with the outstanding items written into the plan as risks with owners and dates. This is the most common honest position.

85–100%Ready

The remaining gaps are small enough to handle during delivery rather than before it. Confirm the unticked items are genuinely minor rather than simply unexamined.

Your score highlights automatically as you tick items above. Nothing is saved, sent or tracked — refreshing the page clears it.

Closing the gaps

If you could not tick these, start here

The four items below are the ones whose absence causes the most trouble downstream. If your unticked items include any of these, they are worth addressing before the rest.

No provisioning process

Introduce one. Ad hoc site creation is the source of most permission inconsistency in federated institutions.

Student data locations unknown

Run discovery. Proportionate protection is impossible without knowing where the data is.

Anonymous sharing enabled

Restrict it this week. It is a disclosure risk that requires no attacker and no error.

Findability untested

Ask ten staff to find five things and time them. The findings are usually immediate and cheap to fix.

Want a second opinion on your score?

We will run the audit against one faculty or department and give you the findings including the discovery results, whether or not you take the remediation further with us.

Talk through your result Read the related guides We reply to every message within one business day.

Keep going

Related checklists

intune

educationReadiness

Device refresh readiness checklist

Twenty checks before a large device refresh in an institution, covering procurement, provisioning and the academic calendar.

June 6, 2026 · 20 checksOpen

d365-sales

educationReadiness

Enrolment cycle readiness checklist

Twenty checks before a recruitment cycle opens, covering data, communication and the melt window most institutions leave unmanaged.

January 31, 2026 · 20 checksOpen

fabric

educationReadiness

Student data platform readiness

Twenty checks before building an institutional data platform, covering governance, access and whether anybody will act on the output.

November 8, 2025 · 20 checksOpen

What this checklist is for

Run it with

And with

And with

20 checks, in the order we would run them

Structure

Student data protection

Sharing

Findability and adoption

Read this against the number above

If you could not tick these, start here

No provisioning process

Student data locations unknown

Anonymous sharing enabled

Findability untested

Want a second opinion on your score?

Related checklists

Device refresh readiness checklist

Enrolment cycle readiness checklist

Student data platform readiness

Tell us what you're trying to fix

Let’s get started on something great

Phone

Email