Access control is not only a door, barrier or electronic system. It is the complete process for deciding who may enter, where they may go, how their authority is checked and what happens when something is wrong.
ProtectUK advises that physical security is most effective when it combines suitable measures, procedures and positive security behaviour. Expensive equipment can be undermined by weak visitor processes, shared credentials or staff who are uncertain about challenging unauthorised access.
1. Doors are held open for unknown people
Tailgating and informal door holding allow a person to enter without presenting a pass, using an intercom or being authorised by reception. The behaviour may appear polite, especially during busy arrival periods, but it bypasses the access decision.
- Explain that every person must use their own authorised access method.
- Position reception or security staff where they can observe vulnerable entrances.
- Use signage and staff communications that support respectful challenge.
- Review door closing, intercom and barrier performance.
- Provide an escalation route where staff feel unsafe challenging someone.
2. Visitors are signed in without meaningful verification
A visitor book records a name but does not necessarily confirm identity, host approval or purpose. A stronger process starts before the visitor reaches the secure area.
- Confirm the host and purpose of the visit.
- Check identification where proportionate and required by policy.
- Issue a clearly distinguishable visitor pass.
- Explain relevant safety and security requirements.
- Record arrival and departure so the site knows who remains present.
ProtectUK notes that visitor and contractor records can be important during an emergency evacuation. The process must remain proportionate and comply with data-protection requirements.
3. Contractors arrive without advance authority
Contractors may require access to plant rooms, roofs, loading areas or spaces not open to ordinary visitors. Unplanned attendance creates pressure on reception and can lead to access being granted without adequate checks.
- Use an approved-contractor or authorised-visit process.
- Require advance details where practicable, including company, individual, vehicle, host and task.
- Confirm permits, inductions or escorts required for the work.
- Restrict access to the areas and times needed.
- Record completion, departure and the return of keys or passes.
Emergency contractors will sometimes need an accelerated process. That exception should still identify who authorises entry and how the visit is recorded.
4. Passes, keys and codes are shared
Shared credentials remove accountability. The site may know that a pass was used without knowing who used it. Shared door codes can remain active long after the person who received them has left.
- Issue individual credentials wherever the system permits.
- Prohibit sharing and explain the reason.
- Record key issue and return.
- Change codes following compromise, staff departures or contractor completion.
- Review permissions so users retain only the access required for their role.
5. Lost credentials remain active
A lost pass, key or device is a security incident, not an administrative inconvenience. The reporting route should be simple and available outside ordinary office hours where necessary.
- Disable electronic credentials promptly.
- Assess whether locks, codes or alarm details are compromised.
- Record when and where the item was last known to be secure.
- Issue a temporary replacement with controlled permissions.
- Review repeated losses or suspicious circumstances.
6. People are not challenged in restricted areas
An access system controls entry at a point in time. It does not prevent a person from moving into an unauthorised area later. Staff and security personnel need to recognise restricted spaces and understand how to respond.
- Use clear zoning, signs and pass permissions.
- Train staff to make a polite, safe challenge or contact security.
- Avoid creating a culture where only the security team notices access problems.
- Escalate repeated or deliberate breaches.
- Review whether doors, barriers or staffing are suitable for the traffic level.
7. Access rights are not removed when circumstances change
Permissions can accumulate as people change roles, contractors return for new work or temporary passes are extended. A leaver process that depends on somebody remembering to contact reception is not reliable.
- Connect HR, facilities, IT, reception and security leaver processes.
- Set expiry dates for temporary and contractor access.
- Review high-risk permissions periodically.
- Recover physical keys, cards, parking permits and identification.
- Update alarm, call-out and emergency contact lists.
Test the process, not only the technology
Access-control reviews should follow a person’s journey through the site: approach, reception, entry, movement, restricted areas and departure. Observe how the process works during busy periods, deliveries, shift changes and out of hours.
The review should also consider what happens when technology fails. Manual records, temporary passes and alternative communication may be needed, but temporary controls should not become permanent weaknesses.
The role of security and reception personnel
Manned guarding and concierge or reception security can support access decisions, visitor processing, contractor control and incident escalation. The role must be clearly defined so that personnel know what they may authorise and when approval is required from the customer.
Assignment instructions should align with the customer’s access policy, emergency procedures and data-protection requirements. They should also provide a safe process for dealing with confrontation or a person refusing to comply.
A practical review checklist
1. List every pedestrian, vehicle, delivery and emergency access point.
2. Identify who owns the decision to grant access at each point.
3. Observe the process during the busiest and quietest operating periods.
4. Test visitor, contractor, delivery and lost-pass scenarios.
5. Review access permissions, expiry dates and leaver controls.
6. Confirm how breaches are reported, investigated and closed.
7. Record improvement actions with owners and target dates.
Strengthen the full access chain
A reliable access-control system combines physical measures, clear authority, accurate records and people who understand the process. Correcting small procedural weaknesses can be as important as installing new equipment.
Tornado FM Ltd provides manned guarding, concierge or reception security, security assessments, mobile patrols, keyholding, alarm response, lock and unlock services and vacant-property inspections.
Arrange a review of access, visitor and contractor controls at your premises.
