SCM-NUMS
System Architecture
Supply Chain Management – Nurse Uniform Management System
For Management & Auditors · Audit-Ready Architecture
Table of Contents
| 1. Executive Summary |
| 2. System Overview & Scale |
| 3. Enterprise Architecture Layers |
| 4. Governance & Audit Framework |
| 5. Security Architecture |
| 6. Role-Based Access Control (RBAC) |
| 7. Data Architecture & Database Schema |
| 8. Process Flows |
| 9. Integration Points |
| 10. Deployment & Infrastructure |
| 11. Audit Assurance & Compliance |
| 12. Management Benefits |
1. Executive Summary
The Supply Chain Management – Nurse Uniform Management System (SCM-NUMS) is a centralized, secure, enterprise-scale web application designed to manage the entire lifecycle of nursing uniforms across KwaZulu-Natal.
🎯 Purpose: To provide a unified, transparent, and auditable platform for nurse registration, uniform ordering, supervisor approval, distribution tracking, financial reporting, and compliance monitoring.
- Provincial standardisation of uniform ordering
- Real-time visibility of orders and approvals
- Complete financial accountability
- Audit-ready transaction logs
- Fraud prevention and detection
- Every transaction is logged and time-stamped
- Full traceability to individual users
- Continuous audit evidence
- Internal & external audit support
- PHSDSBC Resolution 1 of 2022 compliant
2. System Overview & Scale
2.1 System Purpose
SCM-NUMS is a provincial enterprise platform that digitizes and automates the uniform management process for all nurses in KwaZulu-Natal. It replaces manual paper-based systems with a secure, web-based solution that provides end-to-end visibility and control.
2.2 Scale & Reach
2.3 Stakeholder Groups
| Stakeholder | Role | System Access |
|---|---|---|
| Nurses | Place uniform orders, view history | Nurse Portal |
| Supervisors | Approve/reject orders, activate nurses | Supervisor Dashboard |
| District Administrators | Manage district operations | District Admin Portal |
| Head Office | Oversee province, manage settings | Head Office Portal |
| Auditors | Review logs, verify compliance | Audit Reports |
3. Enterprise Architecture Layers
A four-layer architecture designed for security, scalability, performance, and maintainability
Session-based login with password hashing
Role-Based Access Control with data filtering
Complete transaction logging with IP tracking
Supports 32,000+ users with high availability
4. Governance & Audit Framework
A comprehensive governance model ensuring accountability, transparency, and compliance at every level of the organisation.
- All actions traceable to individuals
- Clear role-based responsibilities
- Audit trail for every transaction
- Real-time visibility of orders
- Status tracking for all orders
- Open reporting and analytics
- PHSDSBC Resolution 1 of 2022
- KZN Health ICT governance
- Public service regulations
4.1 Audit Trail Architecture
4.2 Audit Logging Tables
| Table | Logged Actions | Key Fields |
|---|---|---|
| admin_audit_log | Admin actions: activate, deactivate, edit | admin_id, action, description, ip_address, created_at |
| supervisor_approvals | Order approvals, rejections, re-openings | supervisor_id, nurse_id, action, rejection_reason |
| document_audit_trail | Document uploads and changes | user_id, action, filename, file_size, ip_address |
| uniform_orders | Order status changes | id, status, approved_by, approved_date |
Audit Assurance: The system provides continuous audit evidence rather than retrospective manual verification. All electronic records are time-stamped and tamper-evident.
5. Security Architecture
Multi-layer security protecting all system components and data
- Password hashing (bcrypt)
- Session-based authentication
- Session timeout (30 minutes)
- Secure password reset flow
- Failed login attempt tracking
- Role-Based Access Control (RBAC)
- Menu-level permissions
- Action-level permissions
- Data-level filtering
- Input sanitization
- Prepared statements
- XSS prevention
- CSRF protection
- SSL/TLS encryption
- Admin action logging
- Supervisor approval logging
- IP address tracking
- User agent tracking
5.1 Security Controls Summary
| Control Type | Implementation | Purpose |
|---|---|---|
| Access Control | RBAC with role-based permissions | Ensure only authorised users access data |
| Data Protection | Encryption, sanitization, prepared statements | Protect data from unauthorized access |
| Audit Trail | Complete logging of all transactions | Provide evidence for compliance |
| Session Management | Secure session handling with timeout | Prevent session hijacking |
| Infrastructure Security | SSL/TLS, Linux, Apache security | Secure hosting environment |
6. Role-Based Access Control (RBAC)
Clear role hierarchy with defined permissions and responsibilities
Head Office Admin
- Full System access
- Manage all districts & facilities
- System settings & configuration
- Financial reporting (province-wide)
- Bulk user activation
District Admin
- Limited Manage nurses in their district
- District-level reporting
- Single nurse activation
- View district orders
Supervisor
- Restricted Approve/reject supervisee orders
- Activate nurses under supervision
- Re-open approved orders for correction
- View supervisee order history
Nurse
- Basic Place uniform orders
- View own order history
- Edit pending orders
- Track order status
7. Data Architecture & Database Schema
Centralized data management with 14 core tables organised into logical domains
7.1 Database Platform
Relational database architecture
ACID compliance with rollback
Single source of truth
Optimized for reporting
7.2 Entity Relationship Diagram
8. Process Flows
8.1 User Registration & Activation
Registration
Persal Validation
Pending
Supervisor Activates
Active
8.2 Order Placement & Approval
Nurse Orders
Pending
Supervisor Review
Approve
Reject
Re-open
Approved
Delivered
Rejected
9. Integration Points
- HR Database – Persal validation during registration
- Excel/CSV Export – Financial and operational reporting
- Browser Print – Physical report generation
- SCM Stores Module – Inventory and vendor ordering
- Active Directory/LDAP – Single Sign-On
- Mobile App – iOS and Android platform
10. Deployment & Infrastructure
Development
- Local XAMPP/WAMP stack
- Developer machines
- Version control (Git)
Staging
- Mirror of production
- Dedicated server (Linux)
- UAT & Performance testing
Production
- Red Hat Enterprise Linux
- Live provincial operations
- Daily backup protection
11. Audit Assurance & Compliance
Audit Assurance Statement: SCM-NUMS provides continuous, tamper-evident audit evidence for all uniform management transactions. Every action is logged, time-stamped, and traceable to an individual user.
11.1 Audit Evidence Captured
| Audit Area | What is Captured | Where | Retention |
|---|---|---|---|
| User Activity | Logins, logouts, failed attempts | System logs | Indefinite |
| Account Changes | Activations, deactivations, edits | admin_audit_log | Indefinite |
| Order Lifecycle | Creation, approval, rejection | uniform_orders | Indefinite |
| Catalogue Changes | Add, edit, delete, activate | admin_audit_log | Indefinite |
| System Configuration | Order cycles, settings changes | admin_audit_log | Indefinite |
12. Management Benefits
SCM-NUMS provides the KwaZulu-Natal Department of Health with a fully auditable, transparent, and efficient uniform management platform.
SCM-NUMS · KwaZulu-Natal Department of Health · Information Technology Division
Version 3.0 · August 2026 · Proudly South African