An electronic card reader can confirm that a credential was accepted; it cannot by itself establish that the right person entered the right area for an authorized business purpose. Effective access control is a combination of physical barriers, identity and privilege management, staff procedures, monitoring, incident response and periodic assurance. Audits should therefore examine the complete access-control process rather than just the presence of equipment.

Failures often occur between formal policy and day-to-day operations. A visitor may be issued a pass without a clear host, a contractor may retain access after completing work, or an access exception may become a permanent practice. Each condition can weaken an otherwise sophisticated installation.

1. Define the protected areas and access purpose

Begin with the site’s zoning and critical-asset map. Public reception, general office areas, storerooms, plant rooms, control rooms and sensitive data areas rarely need identical access treatment. The assessment should identify who authorizes entry to each zone, under what conditions and how exceptions are recorded. Security zoning should match the physical layout, not merely an organizational chart.

At a mixed-use facility, multiple employers, tenants and service providers may own different approval decisions. A reliable governance model states which party administers the platform, owns the risk and reviews permissions.

2. Examine the identity and credential lifecycle

The complete lifecycle includes request, approval, identity verification, issue, amendment, suspension, return and deactivation. Examine how lost credentials are reported, how temporary passes expire, and how the system prevents duplicate or untracked assignments. A control gap may arise when procedures exist but no team owns periodic cleanup.

Privilege design should follow the actual role and legitimate need. Role-based access can reduce administration burden, but exceptions still require approval, expiry and review. For high-consequence areas, stronger authentication or supervised entry may be appropriate based on the risk assessment.

3. Review employees who change roles or leave

New starters and departures attract attention, but internal transfers can also create privilege accumulation. The access rights review should compare current authorization with current role and identify outdated entitlements. A defined HR/security notification workflow is more reliable than waiting for an informal email. Audit evidence should show who approved additions, who removed permissions and when.

The audit should also test whether access rules are applied during unusual hours, holidays and contingency conditions. Exceptions should have an owner and a defined end date.

4. Assess visitors, contractors and deliveries

Visitor control should connect identity verification, host approval, escort rules, badge visibility and exit reconciliation to the area’s risk. Contractor arrangements need particular care because access periods, subcontractors and work locations change frequently. Controls may include time-bounded privileges, pre-approval, job-specific zone access and sign-out procedures.

Loading docks and delivery entrances can connect public, logistics and restricted spaces. Audit them as part of the overall circulation strategy, while safeguarding confidential details that should not be published.

5. Consider shared passage and tailgating risks

The design should account for authorized people being followed through controlled boundaries. The audit can evaluate visibility, reception processes, physical separation, guard awareness, alarm handling and staff reporting. Controls should support ordinary traffic volumes and accessibility requirements. Training and a clear challenge procedure are often as important as additional hardware.

Testing of such vulnerabilities should be conducted only through a separately authorized and safe assessment. A public article should focus on management controls rather than step-by-step entry bypass techniques.

6. Inspect door systems as assemblies

Readers, controllers and software are only parts of a protective boundary. The door leaf, frame, lock, closer, hinges, glazing, emergency-release interfaces and physical installation determine whether the boundary functions as intended. The auditor should examine routine faults, alarm history and maintenance records, not attempt destructive tests without authorization.

Emergency egress and life-safety requirements must take precedence over simplistic “keep the door locked” assumptions. Any proposed change to locking or release arrangements should be reviewed with the appropriate fire and building specialists.

7. Evaluate monitoring, alarm handling and logs

Door-held, forced-door and access-denied alerts are useful only when events are classified, displayed, recorded and acted upon. The security team should know which alerts require immediate verification, who investigates them, what evidence is retained and how repeat problems are escalated.

Event logs can support post-incident investigation, but retention, privacy and access to logs must be governed. Logs should not become unregulated employee surveillance data. Audit sampling can establish whether unusual events receive meaningful review.

8. Check resilience and administration controls

Consider the effect of network outages, loss of power, controller failure, server maintenance and vendor support delays. Business and safety requirements determine fail-safe or fail-secure behavior for each door; this is not a one-size-fits-all setting. Backup power, tested restoration procedures, configuration control and physical protection of critical controllers may be relevant.

Administrative access to the platform should be limited and logged. Different responsibilities may be required for approving, implementing and auditing high-impact changes. Integration with HR or identity systems should be governed, with a clear fallback when data feeds are incomplete.

Practical audit worksheet

Control domain Evidence to request Questions for management
Zoning Area schedule and access policy Are zones aligned with critical assets and operations?
Privilege approval Sample requests and authorization records Can we identify who approved sensitive access?
Joiner/mover/leaver HR notices and change logs Are changes timely and periodically reconciled?
Visitor control Visitor procedure, sample logs Is a host accountable for each visitor?
Contractor access Contract end dates, temporary privileges Do permissions expire when work ends?
Door functionality Maintenance, fault and incident records Are repeat faults resolved and tracked?
Alarm response Alert classification and operator SOP Is there an assigned response for important events?
Continuity Failure scenarios and recovery procedure Can essential access be managed safely during an outage?

These are representative controls; actual sampling, tests and documentation must match risk and scope.

Design, configuration and procedural failures are different

A design failure may arise when controlled doors are located or grouped in a way that conflicts with the required separation of spaces. A configuration failure might involve permissions that do not match the approved role model. A procedural failure occurs when approved processes for issuing, escorting, reviewing or revoking access are not followed. Treating each problem as an equipment fault can lead to ineffective investment.

A useful report classifies the root cause, affected process, consequence, recommended action, responsible owner and method of verification. A technician may resolve one issue, but a management policy change may be needed for another.

FAQ

How often should access rights be reviewed?

Set frequency according to the sensitivity of the zone, staff turnover, contractor activity and risk profile. High-impact privileges may require more frequent review and event-driven checks when personnel or responsibilities change.

Is biometric access always more secure?

Not automatically. Security depends on correct enrollment, exception handling, privacy controls, hardware placement, fallback procedures and whether the measure addresses the actual threat.

Can an audit be conducted without disrupting operations?

Most policy and configuration checks can be planned around operations; intrusive testing should be separately approved and controlled.

Further reading

The UK’s National Protective Security Authority (NPSA) publishes professional guidance on reviewing access rights, visitor processes and security zoning: https://www.npsa.gov.uk/national-security-act/defending-democracy/physical-security-10-steps-mitigate-state-threats. Its building entry-point guidance also addresses reception, emergency exits and deliveries: https://www.npsa.gov.uk/building-protection/video-surveillance-access-control-detection-control-rooms/building-entry-points. These are UK technical references, not statements of Singapore law or regulatory requirements.

Next step: Explore Security Planning & Assessment and Security Design for a site-specific review.