Reviewing the level of access to the production environment directly addresses whether access to critical IT resources is appropriately restricted to authorized personnel. When computer hardware is missing, internal audit should consider whether physical or operational access controls permitted unauthorized individuals to enter areas containing sensitive equipment. Surveillance recordings may help investigate what occurred after the fact, but they are primarily detective evidence. Employee background checks are personnel controls and may reduce hiring risk, yet they do not determine who actually had access to the missing hardware. System development and project management protocols concern software or technology projects rather than physical custody of equipment. Evaluating access privileges and restrictions therefore provides the most relevant control assessment for determining whether inadequate access management contributed to the loss of critical computer hardware.