There is a category of finding that cannot be argued with, and every organization in a regulated setting eventually meets it: a person had access to records, systems, or clients before the evidence of their clearance was on file.
It cannot be argued with because there is no version of the facts that helps. The dates are in the system logs. The clearance date is on the document. If the first precedes the second, the finding writes itself, and the explanations available — we were short-staffed, the result was delayed, we knew the person — are all true and none of them matter.
What makes this worth writing about is that it is almost never a decision. Nobody chooses to put an uncleared person in front of a client. It happens because onboarding is a sequence of tasks held in someone's head during a week when three other things were on fire.
A gate is not a checklist item
The distinction is the whole fix.
A checklist item is something you tick. It depends on the person doing the ticking remembering, having time, and being willing to hold up a start date. Under pressure, checklist items get ticked in anticipation — the clearance is nearly back, the training is booked for Thursday, the person starts Monday and the tick goes in.
A gate is a point in the sequence that nothing passes without evidence. Accounts are not created. Keys are not issued. Schedules are not assigned. Not because the policy forbids it, but because the person who creates accounts does not create them until the gatekeeper has signed. The enforcement is structural rather than personal, which means it survives a bad week.
The practical difference shows up in one place: a gate produces a record even when nothing goes wrong. A checklist produces a record only that someone ticked it.
What the gate holds
The specific requirements are yours, and they vary by license type, contract, and role — confirm them against your licensing standards rather than any article. But the structure is consistent, and it has four stages.
Before the gate, an offer is signed, a personnel file is opened, clearance processes are initiated the same day, required pre-service training is assigned, and confidentiality and conflict forms go out for signature. No access of any kind exists yet, including email.
At the gate, one named person confirms that every required item has evidence on file with a date. Not that it has been requested. Not that it is expected. On file, with a date, produceable.
After the gate, provisioning happens — accounts created from the role catalog rather than improvised, keys and devices issued and logged, policy acknowledgments signed.
After that, the post-service obligations begin: the training calendar, the supervision schedule, the renewal dates for anything that expires.
The only part that requires discipline is the middle one, and it requires it exactly once per hire.
The three failures worth naming
The provisional start. Someone begins in a role described as administrative or shadowing, on the reasoning that they are not really working with clients yet. The account was still created. The record still shows access. If the role genuinely involves no access to records, systems, or people, that is a real distinction — but it has to be true in the system logs, not just in the description.
The rehire. A person who worked here before, whose clearances were current when they left. Clearances expire, standards change, and the gap in employment is itself often a requirement to re-run something. Rehires skip the gate more often than new hires, because everybody already knows them.
The contractor and the volunteer. The gate is usually built for employees. The exposure is identical for anyone with access to records or to the people you serve, and the file is usually thinner.
What to do this month
Take the last five people who started — including any contractor or volunteer with access. For each, put two dates side by side: the date each required clearance was evidenced on file, and the date their first system account was created.
If any account predates any clearance, you have found a live gap rather than a hypothetical one, and it is worth a conversation with your counsel about what, if anything, to do now.
Then make the gate structural. One named gatekeeper, one signature, and an agreement with whoever creates accounts that they do not create them without it. That agreement is the entire control. Everything else is paperwork around it.
The onboarding clearance gate checklist — including the workbook that computes whether the gate may open, and will not read MAY OPEN until every required item is evidenced — is free on the Open Shelf. No registration, no email address.