Concept. Book an assessment
A daylit lobby turnstile line, one person passing through and the rest of the floor empty.

Stage 04 of 06

Who goes where

Can you say who was allowed in that room last Tuesday, and who actually went in?

Six weeks later

Somebody asks who was in that room. What can you actually give them?

The request always arrives late, and it always names a room and a window. Press it on each and see what comes back.

The request

“Who had access to the records room between six and eight on the evening of the fourteenth?”

Internal audit · asked on 9 September · six weeks after the date

Both systems recorded everything. Both were working. Only one of them can answer a question.

3 people, with a reason each.

  1. Priya NairAdmin. Records room is in her zone18:31
  2. Anjali RaoAccounts. Signed in by Priya19:06
  3. Sunita DeviHousekeeping. Own card, own name, 19:40 to 19:5219:40

One group, no expiryForty-seven people could have opened that door, which is everybody with a card. Nine of them left the company. Two are contractors whose job finished last year. The system did its work perfectly and the answer is worth nothing, because being allowed in was never a distinction.

Zoned, and leavers removedThree people, each with a reason to have been there, and one of them is a cleaner at twenty to eight, which is exactly the entry an auditor asks about and exactly the one this system can explain. The answer took four seconds and it will hold.

A log is a list of people who were allowed in. If everybody was allowed in, the list is just a staff directory with times on it.

Two vendors normally share this stage, and a third party who was never consulted. The access control system is one contract and the door hardware (closers, locks, hinges, frames) belongs to the ironmongery package. The integration with HR belongs to an IT team who found out about it after the system was already installed.

What lives at this stage

The difference between a door that locks and a door that reports.

  • Credentials and readersCard, fob, mobile or biometric, chosen for who is using it and how often, not for what was in the catalogue.
  • Zoning and access levelsWhich groups may enter which areas, at which hours, defined as a policy rather than assembled door by door.
  • Contractor and temporary accessPasses that expire on their own, because the ones that do not are the ones still working two years later.
  • New joinees, transfers and exitsAccess that follows a person's actual status, so leaving the company removes the credential the same day.
  • Dual control and interlocksWhere two people are required, or where one door cannot open until another is closed.
  • The audit recordEvery grant, every denial, retained and searchable, which is the whole reason for having the system.

What fails here

Access control fails as an administrative problem, not a technical one.

These are the six we find most often on assessment. If two of them sound familiar, the rest are probably true on your site as well.

What fails here
What failsWhy it failsWhat it costs
Leavers still have access Nobody connected exits to the access system, so removal depends on somebody remembering. People who left the company are still valid on your doors. You will not know until you audit.
Everybody is in one group Zoning was too much work at commissioning, so all staff got all doors. The system records who went where and it means nothing, because everybody was allowed everywhere.
Contractor cards never expire Issued permanently because setting an expiry was an extra step. Cards in circulation belonging to firms you no longer employ.
Doors propped during working hours The access design fought the way the building actually works. The door is open all day. The record shows one entry at 9am.
Held-open alarms disabled Nuisance alarms in month two, silenced rather than re-configured. The one alert that tells you a controlled door is not controlled is switched off.
The audit log is never read No report was ever configured, so the data accumulates and nobody looks. You have the answer to every access question and no way to ask one.

2

Two vendors normally share this stage. Neither of them owns the gap between.

The access control system is one contract, and the doors, closers, locks and ironmongery are the builder's. Every failure above lives in the space between the two, and the BoQ never said whose job that space was.

So on the day it matters, there is nobody to call. Each vendor can show you their own scope, correctly delivered. Nobody has to answer for the join.

How we specify it

Six decisions that determine whether this stage works in year seven.

  1. Zoning defined as a policy before a single reader is placedWritten with the client, in a document, so it can be checked later against what the system actually does.
  2. Joining, moving and leaving connected to the access systemBecause access that depends on somebody remembering to revoke it will not be revoked.
  3. Every temporary credential carries an expiry at the moment it is issuedNo exceptions, including for our own engineers.
  4. The door hardware specified with the reader, by one partyA reader on a door that does not close reliably is a reader on an open door.
  5. Held-open and forced-door alarms tuned, not silencedConfigured against how the building is really used, so the alert stays credible and stays on.
  6. A monthly access report that somebody actually receivesNamed recipient, fixed date. A log nobody reads is storage, not security.

Sector variations

Who goes where means something different depending on what you are protecting.

Banking & financial The audit is the product. Access records must survive an inspection, which means retention, integrity and the ability to produce them on demand.
Media & broadcast Freelancers and visiting crews churn weekly. The system has to issue and expire hundreds of credentials a year without an administrator per project.
Manufacturing Zoning follows the process, not the floor plan. Who may be near which machine at which shift is a safety question as much as a security one.
Cold chain Doors are opened by people carrying things, in gloves, in the cold. If the credential is awkward it will be defeated by the end of the first week.
Corporate & technology Who may reach what is the entire argument, and it is the stage that governs it. Server rooms, labs and floors leased to different companies sit behind the same lobby, and the credential is the only thing separating them.

Year seven

Access control is the only system that gets worse without anything breaking.

Every joiner, every leaver, every contractor, every temporary card, every "just for today" exception accumulates. Nothing fails. The database simply drifts further from the truth every month until the record it produces is no longer evidence of anything.

The hardware will still be working perfectly on the day you discover that four hundred valid credentials belong to people who no longer work for you.

What decides whether this stage still works in three years is Maintenance cover and whether anyone has produced a signed condition report since.

Technical reference

Find out

How many valid credentials on your system belong to people who have left?

A signed condition report naming what works, what has failed, and what was never commissioned.

The assessment is chargeable, quoted against the site, and adjusted in full against the first year if you take cover. Where cover is not taken, the fee covers our team’s time on site and the report we leave behind, and the report is yours either way.

Book an assessment