Ensure that the access control program is formally documented, approved by senior management, and that employees and contractors are informed through training or other communication methods. Assign an owner to ensure regular reviews.