I've spent years protecting people on the street and inside buildings, and I keep seeing the same thing: the weakest point in company security is rarely the locks or the cameras. It's that brief moment at reception. Here I set out how to build access control that protects the business without slowing it down. Much of it you can put in place yourselves.
Nobody broke in. They just walked in
When a company asks me to review its entry procedures, I usually start by simply sitting in the lobby and watching. Without a word, phone in hand, like anyone else waiting for someone. Sooner or later the same things tend to happen. Someone holds the door for the person behind them. The receptionist steps away from the desk for a moment. A technician walks past with a toolbox and nobody asks him anything, because he's wearing a hi-vis vest and looks as if he knows where he's going.
Over the years I've learnt that nobody breaks into most companies. They simply walk in. They don't need a crowbar, just good manners and a moment when nobody is looking. That's actually good news, because you defend against it mainly with organisation and agreed rules, not by buying more technology. The foundation is rules that somebody actually follows.
The rest of this article is about putting those rules together, from the front door to the warehouse, without slowing down day-to-day operations.
Divide the premises into zones, not just outside and inside
Most companies think in just two levels: outside and inside. Once someone is through the entrance, they can go almost anywhere. It's the most common structural flaw I find on site reviews.
Divide the premises by level of risk. A public area anyone can reach: the lobby and reception. An internal area with offices, for staff and escorted visitors. Staff facilities. And a critical zone, typically the warehouse, server room, archive or a room holding cash and sensitive documents.
Each zone then has to pass a simple test. If you can't answer any of the questions below, it isn't a zone. It's a corridor, and that's exactly where problems start.
For each zone, answer three questions:
- Who is allowed in, and how do the security staff or the system recognise them?
- Can an outsider be there alone, or only when escorted?
- Which named person is responsible for the zone?
Reception is a security post, not an information desk
Reception decides whether everything else even gets a chance to work. Yet it is often the least supported post in the building. The person on reception is expected to greet clients, take in parcels, put calls through and also be the one who stops anyone who doesn't belong. That's a lot of roles at once.
When I work with reception teams, I look at two things first. One: does the receptionist have written guidance on what to do when someone turns up unannounced? Not a vague instruction to verify them, but exactly who to call, what to say and where to seat the visitor while things are sorted out. Two: does anyone have their back? A receptionist who knows that one press of a button brings a colleague or a security officer to help behaves differently from one who knows she's on her own.
A visitor log, a check on the purpose of each visit and a visible badge are the bare minimum. But until reception has the authority to stop someone going any further, and the confidence that management won't hold it against them, it's just paperwork.
Visitors, contractors and couriers aren't one category
A visitor shouldn't move around the premises alone. A named member of staff receives them, escorts them, then brings them back and signs them out. It sounds formal, but in practice it cuts down on people wandering onto floors where they have no business.
Contractors and service technicians are a different category. They come back repeatedly, know the building and often get into places a regular employee can't. For them, a dedicated entrance, time-limited authorisation and an agreed range of movement make sense. If a technician turns up outside the agreed slot, that's a reason to check, not a reason to wave them through so they aren't held up.
Couriers shouldn't get into internal areas at all. A handover point right by the entrance deals with this and closes off one of the easiest ways to get inside on a pretext.
People decide, not cards and cameras
Access control systems, electronic locks, turnstiles and cameras all have their place. They show who was where, and in an incident they shorten the time it takes to work out what actually happened. On their own, though, they stop nobody.
On the technical side, a few things matter most to me. Every employee should have their own identity and never share a card with a colleague. Access should be granted only where the job genuinely requires it, not everywhere just in case. When someone leaves, their access should be revoked the same day, not whenever somebody remembers. And a camera shouldn't be a mere recording device: there has to be a person who knows what to do when something shows up on it.
No system helps if the door to it is wedged open because that's the way deliveries come in. I see this regularly, and behind it there is usually a process someone designed without regard to how people in the company actually work.
When it fails, and how to tell that it works
Access control also needs scenarios for when something goes wrong. A lost card. A system outage. An unauthorised person inside. An aggressive individual at reception. For each of these, staff should have a simple procedure: who to call, what to do until help arrives and what not to do.
With an aggressive visitor in particular, reception's job isn't to restrain anyone. It is to keep a distance, call for help and avoid making things worse. This can be drilled fairly quickly, and I consider it time well spent.
Then there's the final part, the one most often forgotten. A security regime goes out of date quietly. People leave and their cards stay active. A new warehouse is added and nobody assigns it a zone. I recommend a regular review: go through the list of active access rights, assess incidents from the previous period and, every so often, have someone who doesn't work there walk through the premises as a test. That outside eye picks up things the people who work there stopped noticing long ago.
Key takeaways
Access control isn't about turning a company into a fortress. It's about knowing who is inside, why they are there and where they're allowed to go. In my experience, what matters is this: clearly divided zones, a reception team that knows what to do and has backup, separate procedures for visitors, contractors and couriers, technology backed by accountable people, and the habit of reviewing it all regularly. The rest is detail that adapts to the particular premises.
One thing I want to say plainly: no measure gives absolute certainty, and nobody can honestly promise it to you. A well-designed entry regime exists to reduce risk, make getting in harder and shorten the time before someone reacts to a problem.
Much of what I've described you can put into practice yourselves, without major investment in technology. It's mostly a matter of decisions and consistency. Outside help pays off most in the initial assessment of the premises and in drilling unusual situations with staff.
If you're not sure where your company stands, I'm happy to come and take a look and go through your entry procedures with you, with no obligation. Sometimes the outcome is a few small adjustments you can make yourselves. Sometimes it turns out more is needed. Both are legitimate outcomes, and I'll tell you plainly which one applies.
“Nobody breaks into most companies. They simply walk in. All it takes is good manners and a moment when nobody's looking.”— Robert Václavík
