SCM-NUMS
System Architecture
Supply Chain Management – Nurse Uniform Management System
For Management & Auditors · Audit-Ready Architecture
- Provincial standardisation of uniform ordering
- Real-time visibility of orders and approvals
- Complete financial accountability
- Audit-ready transaction logs
- Fraud prevention and detection
- Every transaction is logged and time-stamped
- Full traceability to individual users
- Continuous audit evidence
- Internal & external audit support
- PHSDSBC Resolution 1 of 2022 compliant
Table of Contents
2. System Overview
SCM-NUMS is a provincial enterprise platform that digitizes and automates the uniform management process for all nurses in KwaZulu-Natal. It replaces manual paper-based systems with a secure, web-based solution that provides end-to-end visibility and control.
Stakeholder Groups
| Stakeholder | Role | Access |
|---|---|---|
| Nurses | Place orders, view history | Nurse Portal |
| Supervisors | Approve/reject, activate | Supervisor Dashboard |
| District Admins | Manage district operations | District Admin |
| Head Office | Oversee province | Head Office Portal |
| Auditors | Review logs, compliance | Audit Reports |
3. Enterprise Architecture Layers
A four-layer architecture designed for security, scalability, performance, and maintainability
Session-based login with password hashing
Role-Based Access Control with data filtering
Complete transaction logging with IP tracking
Supports 32,000+ users with high availability
4. Governance & Audit Framework
A comprehensive governance model ensuring accountability, transparency, and compliance at every level of the organisation.
- All actions traceable to individuals
- Clear role-based responsibilities
- Audit trail for every transaction
- Real-time visibility of orders
- Status tracking for all orders
- Open reporting and analytics
- PHSDSBC Resolution 1 of 2022
- KZN Health ICT governance
- Public service regulations
4.1 Audit Trail Architecture
4.2 Audit Logging Tables
| Table | Logged Actions | Key Fields |
|---|---|---|
| admin_audit_log | Admin actions: activate, deactivate, edit | admin_id, action, description, ip_address, created_at |
| supervisor_approvals | Order approvals, rejections, re-openings | supervisor_id, nurse_id, action, rejection_reason |
| document_audit_trail | Document uploads and changes | user_id, action, filename, file_size, ip_address |
| uniform_orders | Order status changes | id, status, approved_by, approved_date |
Audit Assurance: The system provides continuous audit evidence rather than retrospective manual verification. All electronic records are time-stamped and tamper-evident.
5. Security Architecture & 6. RBAC
Multi-layer security with clear role hierarchy
- Password hashing (bcrypt)
- Session-based authentication
- Session timeout (30 minutes)
- Secure password reset flow
- Failed login attempt tracking
- Role-Based Access Control (RBAC)
- Menu-level permissions
- Action-level permissions
- Data-level filtering
- Input sanitization
- Prepared statements
- XSS prevention
- CSRF protection
- SSL/TLS encryption
- Admin action logging
- Supervisor approval logging
- IP address tracking
- User agent tracking
Role Hierarchy
Head Office
- Full System access
- All districts & settings
District Admin
- Limited District ops
- District reporting
Supervisor
- Restricted Approve/reject
- Activate supervisees
Nurse
- Basic Place orders
- View own history
7. Data Architecture & Database Schema
Centralized data management with 14 core tables
Relational database
ACID compliance
Single source of truth
Optimized for reporting
8. Process Flows
Registration & Activation
Order & Approval
9. Integration Points
- HR Database – Persal validation
- Excel/CSV Export – Reporting
- Browser Print – Report generation
- SCM Stores Module – Inventory
- Active Directory/LDAP – SSO
- Mobile App – iOS & Android
10. Deployment & Infrastructure
Development
- Local XAMPP/WAMP
- Git version control
Staging
- Mirror of production
- UAT & Performance
Production
- Red Hat Enterprise Linux
- Daily backups
11. Audit Assurance & Compliance
Audit Assurance Statement: SCM-NUMS provides continuous, tamper-evident audit evidence for all uniform management transactions. Every action is logged, time-stamped, and traceable to an individual user.
11.1 Audit Evidence Captured
| Audit Area | What is Captured | Where | Retention |
|---|---|---|---|
| User Activity | Logins, logouts, failed attempts | System logs | Indefinite |
| Account Changes | Activations, deactivations, edits | admin_audit_log | Indefinite |
| Order Lifecycle | Creation, approval, rejection | uniform_orders | Indefinite |
| Catalogue Changes | Add, edit, delete, activate | admin_audit_log | Indefinite |
| System Configuration | Order cycles, settings changes | admin_audit_log | Indefinite |
12. Management Benefits
SCM-NUMS provides the KwaZulu-Natal Department of Health with a fully auditable, transparent, and efficient uniform management platform.