How to Audit Door Permissions Effectively

A former employee’s credential still opening a plant room at 02:00 is not a minor administration error. It is a gap between the access control system you believe you operate and the one your premises are actually relying on. Knowing how to audit door permissions gives facilities, security and estates teams a practical way to close that gap without disrupting legitimate work.

For commercial and industrial organisations, a permission audit is more than a report of cardholders and doors. It tests whether access rights match current roles, working patterns, site risks and physical controls. Done well, it reduces unnecessary access, creates evidence of control and makes everyday changes easier to manage.

Start with the risk, not the credential list

A common mistake is to export every cardholder from the access control platform and work through the list alphabetically. That may identify obvious leavers or duplicate records, but it does not tell you where excess access creates the greatest exposure.

Begin by grouping doors according to the assets, activities and risks behind them. A main reception entrance, for example, requires a different level of scrutiny from a server room, medicines store, cash office, loading bay, control room or restricted production area. Include doors protecting keys, tools, sensitive documents, IT infrastructure and high-value stock. Do not overlook secondary entrances, connecting corridors, comms cupboards and out-of-hours access routes.

For each area, decide what a person must be able to do there and when. A maintenance engineer may need escorted daytime entry to a technical room, while an authorised facilities lead may require independent emergency access. The aim is not to remove access indiscriminately. It is to ensure each permission is justified by an operational need.

This risk-led approach also helps determine audit frequency. High-security areas, sites with shift working, frequent contractor attendance or substantial staff turnover may need monthly review. Lower-risk office doors may be suitable for a quarterly or six-monthly cycle. The right interval depends on change, consequence and how quickly your team can revoke access when circumstances alter.

Build an accurate picture of every controlled door

Before reviewing people, confirm that the door estate itself is correctly represented. Your audit should use a current door schedule that records the door name, location, security classification, reader type, locking arrangement, normal operating hours and the access group or time zone applied.

Names matter more than they appear to. A vague label such as “Door 14” makes approval difficult, particularly across multiple sites. A clear description such as “Birmingham warehouse - dispatch cage” allows a manager to assess access without local knowledge or guesswork. Standard naming conventions are especially valuable where cloud management gives central teams visibility of distributed estates.

Check whether permissions exist at door level, group level or through role-based access profiles. Group-based access is usually easier to maintain and audit because it provides consistency. Direct exceptions are sometimes necessary, but they should be visible, time-limited where possible and supported by a recorded reason. An estate filled with individual overrides becomes difficult to verify and harder to secure.

The audit should also identify access paths outside the main platform. Mechanical keys, override cylinders, keypad codes, intercom release, free egress settings and emergency break-glass arrangements can all change the real level of control at a door. A permission report is not a complete security assessment if the same restricted room can be opened with an unmanaged key.

How to audit door permissions across a live estate

Once the door schedule and risk categories are in place, review permissions against reliable personnel data. The most effective process brings together access control records, HR or contractor records, departmental ownership and event history.

First, identify every active credential. This includes cards, fobs, mobile credentials, temporary passes and any shared credential still in circulation. Each active credential should have an identifiable owner, a status, an issue date and, where relevant, an expiry date. Shared credentials should be treated with caution because they weaken accountability. Where operationally unavoidable, record who holds them, when they are used and who authorises their continued issue.

Next, compare the active population with current employment and contractor information. Look for leavers, long-term absentees, agency staff who have completed an assignment, transferred employees and dormant contractor records. Automating joiner, mover and leaver workflows can reduce the amount of manual checking, but the workflow still needs an accountable owner and periodic testing.

Then ask the appropriate line manager or area owner to approve access for their people. Their approval should be specific enough to establish whether the individual needs access to a particular area, not simply whether they remain employed. A manager may know that a technician belongs to their team but not realise the technician still holds out-of-hours access to a former work area.

Use access events as supporting evidence, not as the only decision-maker. A credential that has not been used for six months may be unnecessary, lost or simply intended for an infrequent emergency duty. Investigate it. Conversely, regular use does not make a permission appropriate if the access was granted informally and no longer aligns with the holder’s role.

Where your system supports it, apply expiry dates to temporary roles, contractors and project teams from the outset. Expiring access is preferable to relying on someone to remember a revocation date. It gives the business a clear decision point if work is extended.

Test the quality of the data and the physical operation

A permissions audit should not remain a desk exercise. Select a sample of high-risk doors and test the outcome on site. Confirm that approved users can gain entry during their assigned hours, that removed users are denied access and that door names and event records correspond with the physical location.

This is also the point to check conditions that can undermine otherwise good permissions. A poorly closing fire door, an incorrectly configured maglock, a failed reader or a door routinely propped open can defeat the intention of the access policy. CCTV coverage, door contacts, forced-door alarms and intercom records can provide useful corroboration where risk justifies an integrated approach.

Consider normal operational pressure. A busy loading area may need fast, reliable access for authorised teams, but it should not become a reason for uncontrolled entry. In some settings, timed permissions, mobile credentials, visitor workflows or appropriately managed turnstiles can reduce friction while retaining a clear audit trail.

Record decisions in a form that stands up to scrutiny

Every audit needs an evidence trail. Retain the date of review, the data sources used, the person approving access, changes made, exceptions accepted and the date for re-review. This supports internal governance, external assurance and incident investigation.

An exception register is particularly useful. It should state why a non-standard permission exists, who authorised it, the compensating controls in place and when it will expire or be reconsidered. Examples include a lone worker with temporary extended hours, a contractor supporting a shutdown or a senior responder who requires emergency access across several locations.

Avoid treating a completed spreadsheet as the end of the process. Track actions to closure. If a credential should be removed, confirm that it has been disabled. If a door needs a revised access group, test the revised configuration. If a mechanical key creates an unmanaged route, decide whether it should be recovered, restricted through a key management system or replaced with an electronically controlled solution.

Make permission reviews part of business change

The strongest audits are built into normal operations rather than launched only after an incident. New starters should receive role-appropriate access, movers should trigger review of previous permissions and leavers should have credentials revoked promptly. Contractors and visitors need defined sponsors, controlled durations and clear handback procedures.

For multi-site organisations, a centrally managed platform can provide consistent rules, rapid permission changes and clearer reporting, while local managers retain responsibility for operational approval. That balance matters. Central control without local context can create delay; local control without standards can create inconsistency.

Loktec Security Group can help organisations design, commission and support access control arrangements that make this discipline more manageable, from intelligent SALTO credentials and cloud-managed permissions to the wider door, key and surveillance infrastructure around them.

A door permission audit is ultimately a test of whether security supports the way your organisation actually works. Keep the process risk-led, give every access right an owner and treat unusual permissions as decisions that need an expiry date. That creates stronger control without placing unnecessary barriers in front of the people who keep the site running.