Is access to sensitive information and/or systems limited?
Is a log of computer/building access rights maintained?
If an employee separates from the company are the access rights revoked?
Is there a documented procedure in place to ensure that all access rights are revoked?