🏥 SCM · NUMS System Architecture · Management & Audit
SCM · NUMS
KwaZulu-Natal Department of Health
SCM-NUMS v3.0
August 2026
🏥

# SCM-NUMS
System Architecture

Supply Chain Management – Nurse Uniform Management System

For Management & Auditors · Audit-Ready Architecture

Version: 3.0 Date: August 2026 Classification: Internal
SCM · NUMS
KwaZulu-Natal Department of Health
Table of Contents
Page 2

# Table of Contents

1. Executive Summary
2. System Overview & Scale
3. Enterprise Architecture Layers
4. Governance & Audit Framework
5. Security Architecture
6. Role-Based Access Control (RBAC)
7. Data Architecture & Database Schema
8. Process Flows
9. Integration Points
10. Deployment & Infrastructure
11. Audit Assurance & Compliance
12. Management Benefits

SCM · NUMS
KwaZulu-Natal Department of Health
Executive Summary
Page 3

# 1. Executive Summary

The Supply Chain Management – Nurse Uniform Management System (SCM-NUMS) is a centralized, secure, enterprise-scale web application designed to manage the entire lifecycle of nursing uniforms across KwaZulu-Natal.

🎯 Purpose: To provide a unified, transparent, and auditable platform for nurse registration, uniform ordering, supervisor approval, distribution tracking, financial reporting, and compliance monitoring.

32,000+
Nurses & Users
Province-wide coverage
11
Health Districts
KwaZulu-Natal
700+
Health Facilities
Hospitals, clinics, CHCs
✅ Key Management Benefits

- Provincial standardisation of uniform ordering
- Real-time visibility of orders and approvals
- Complete financial accountability
- Audit-ready transaction logs
- Fraud prevention and detection

📋 Audit Readiness

- Every transaction is logged and time-stamped
- Full traceability to individual users
- Continuous audit evidence
- Internal & external audit support
- PHSDSBC Resolution 1 of 2022 compliant

SCM · NUMS
KwaZulu-Natal Department of Health
System Overview & Scale
Page 4

# 2. System Overview & Scale

## 2.1 System Purpose

SCM-NUMS is a provincial enterprise platform that digitizes and automates the uniform management process for all nurses in KwaZulu-Natal. It replaces manual paper-based systems with a secure, web-based solution that provides end-to-end visibility and control.

## 2.2 Scale & Reach

32,000+
Active Users
Nurses & authorised staff
5,000+
Monthly Orders
Average monthly volume
100%
Audit Coverage
All transactions logged

## 2.3 Stakeholder Groups

Stakeholder | Role | System Access
--- | --- | ---
Nurses | Place uniform orders, view history | Nurse Portal
Supervisors | Approve/reject orders, activate nurses | Supervisor Dashboard
District Administrators | Manage district operations | District Admin Portal
Head Office | Oversee province, manage settings | Head Office Portal
Auditors | Review logs, verify compliance | Audit Reports

SCM · NUMS
KwaZulu-Natal Department of Health
Enterprise Architecture Layers
Page 5

# 3. Enterprise Architecture Layers

A four-layer architecture designed for security, scalability, performance, and maintainability

Presentation
Nurse Portal Supervisor Dashboard District Admin Head Office Responsive
Application
Auth Orders Approvals Catalogue Reports Audit
Data
User & HR Orders Catalogue Audit Logs Reference
Infrastructure
Linux Apache PHP 8.2 MariaDB HTTPS Backup
🔐 Authentication

Session-based login with password hashing

🛡️ RBAC

Role-Based Access Control with data filtering

📋 Audit

Complete transaction logging with IP tracking

☁️ Scalable

Supports 32,000+ users with high availability

SCM · NUMS
KwaZulu-Natal Department of Health
Governance & Audit Framework
Page 6

# 4. Governance & Audit Framework

A comprehensive governance model ensuring accountability, transparency, and compliance at every level of the organisation.

🔑 Accountability

- All actions traceable to individuals
- Clear role-based responsibilities
- Audit trail for every transaction

👁️ Transparency

- Real-time visibility of orders
- Status tracking for all orders
- Open reporting and analytics

📜 Compliance

- PHSDSBC Resolution 1 of 2022
- KZN Health ICT governance
- Public service regulations

## 4.1 Audit Trail Architecture

👤
Who
User ID, Role
🕐
When
Date, Time
📝
What
Action, Values
📍
Where
IP, Device
❓
Why
Reason

## 4.2 Audit Logging Tables

Table | Logged Actions | Key Fields
--- | --- | ---
admin_audit_log | Admin actions: activate, deactivate, edit | admin_id, action, description, ip_address, created_at
supervisor_approvals | Order approvals, rejections, re-openings | supervisor_id, nurse_id, action, rejection_reason
document_audit_trail | Document uploads and changes | user_id, action, filename, file_size, ip_address
uniform_orders | Order status changes | id, status, approved_by, approved_date

Audit Assurance: The system provides continuous audit evidence rather than retrospective manual verification. All electronic records are time-stamped and tamper-evident.

SCM · NUMS
KwaZulu-Natal Department of Health
Security Architecture
Page 7

# 5. Security Architecture

Multi-layer security protecting all system components and data

🔐 Layer 1: Authentication

- Password hashing (bcrypt)
- Session-based authentication
- Session timeout (30 minutes)
- Secure password reset flow
- Failed login attempt tracking

Secure
🛡️ Layer 2: Authorization

- Role-Based Access Control (RBAC)
- Menu-level permissions
- Action-level permissions
- Data-level filtering

RBAC
🔒 Layer 3: Data Security

- Input sanitization
- Prepared statements
- XSS prevention
- CSRF protection
- SSL/TLS encryption

Protected
📋 Layer 4: Audit

- Admin action logging
- Supervisor approval logging
- IP address tracking
- User agent tracking

Audited

## 5.1 Security Controls Summary

Control Type | Implementation | Purpose
--- | --- | ---
Access Control | RBAC with role-based permissions | Ensure only authorised users access data
Data Protection | Encryption, sanitization, prepared statements | Protect data from unauthorized access
Audit Trail | Complete logging of all transactions | Provide evidence for compliance
Session Management | Secure session handling with timeout | Prevent session hijacking
Infrastructure Security | SSL/TLS, Linux, Apache security | Secure hosting environment

SCM · NUMS
KwaZulu-Natal Department of Health
Role-Based Access Control
Page 8

# 6. Role-Based Access Control (RBAC)

Clear role hierarchy with defined permissions and responsibilities

#### Head Office Admin

- Full System access
- Manage all districts & facilities
- System settings & configuration
- Financial reporting (province-wide)
- Bulk user activation

#### District Admin

- Limited Manage nurses in their district
- District-level reporting
- Single nurse activation
- View district orders

#### Supervisor

- Restricted Approve/reject supervisee orders
- Activate nurses under supervision
- Re-open approved orders for correction
- View supervisee order history

#### Nurse

- Basic Place uniform orders
- View own order history
- Edit pending orders
- Track order status

SCM · NUMS
KwaZulu-Natal Department of Health
Data Architecture & Database Schema
Page 9

# 7. Data Architecture & Database Schema

Centralized data management with 14 core tables organised into logical domains

## 7.1 Database Platform

MariaDB 10.4+

Relational database architecture

Transaction-Safe

ACID compliance with rollback

Centralized

Single source of truth

Indexed

Optimized for reporting

## 7.2 Entity Relationship Diagram

🔑 PK = Primary Key 🔗 FK = Foreign Key
nurses_users
🔑 id INT PK
🔑 persal_number VARCHAR(100)
surname, name, district
facility, gender
🔗 position_id FK
🔗 department_id FK
is_supervisor, is_active
uniform_orders
🔑 id INT PK
🔗 user_id FK
order_date, status
approved_by, approved_date
rejection_reason
total_amount DECIMAL(12,2)
uniform_catalogue
🔑 id INT PK
category, item_name, color
price DECIMAL(10,2)
sizes TEXT
max_quantity_per_order
is_active TINYINT
order_items
🔑 id INT PK
🔗 order_id FK
🔗 uniform_id FK
item_name, size, quantity
price, subtotal DECIMAL
admin_users
🔑 id INT PK
username UNIQUE
password, email
full_name, role
district, is_active
admin_audit_log
🔑 id INT PK
🔗 admin_id FK
action, description
ip_address, user_agent
created_at TIMESTAMP
SCM · NUMS
KwaZulu-Natal Department of Health
Process Flows
Page 10

# 8. Process Flows

## 8.1 User Registration & Activation

Registration
→
Persal Validation
→
Pending
→
Supervisor Activates
→
Active

## 8.2 Order Placement & Approval

Nurse Orders
→
Pending
→
Supervisor Review
Approve
←
Reject
←
Re-open
Approved
→
Delivered
←
Rejected
SCM · NUMS
KwaZulu-Natal Department of Health
Integration & Deployment
Page 11

# 9. Integration Points

✅ Active Integrations

- HR Database – Persal validation during registration
- Excel/CSV Export – Financial and operational reporting
- Browser Print – Physical report generation

Active
⏳ Future Integrations

- SCM Stores Module – Inventory and vendor ordering
- Active Directory/LDAP – Single Sign-On
- Mobile App – iOS and Android platform

Planned

# 10. Deployment & Infrastructure

#### Development

- Local XAMPP/WAMP stack
- Developer machines
- Version control (Git)

#### Staging

- Mirror of production
- Dedicated server (Linux)
- UAT & Performance testing

#### Production

- Red Hat Enterprise Linux
- Live provincial operations
- Daily backup protection

SCM · NUMS
KwaZulu-Natal Department of Health
Audit Assurance & Management Benefits
Page 12

# 11. Audit Assurance & Compliance

Audit Assurance Statement: SCM-NUMS provides continuous, tamper-evident audit evidence for all uniform management transactions. Every action is logged, time-stamped, and traceable to an individual user.

## 11.1 Audit Evidence Captured

Audit Area | What is Captured | Where | Retention
--- | --- | --- | ---
User Activity | Logins, logouts, failed attempts | System logs | Indefinite
Account Changes | Activations, deactivations, edits | admin_audit_log | Indefinite
Order Lifecycle | Creation, approval, rejection | uniform_orders | Indefinite
Catalogue Changes | Add, edit, delete, activate | admin_audit_log | Indefinite
System Configuration | Order cycles, settings changes | admin_audit_log | Indefinite

# 12. Management Benefits

✓
Full Visibility
Real-time order tracking
✓
Financial Control
Complete order value reporting
✓
Audit Readiness
Continuous audit evidence
✓
Fraud Prevention
Full traceability of actions
✓
Operational Efficiency
Eliminates manual processes
✓
Provincial Standardisation
Consistent across all districts

SCM-NUMS provides the KwaZulu-Natal Department of Health with a fully auditable, transparent, and efficient uniform management platform.

SCM-NUMS · KwaZulu-Natal Department of Health · Information Technology Division
Version 3.0 · August 2026 · Proudly South African