Start a building access review by comparing active permissions with a current business need. Have the responsible sponsor decide what should remain and verify that approved removals took effect. Collecting a list of cardholders is only the beginning of that review.
This approach is for an authorised security or facilities team reviewing electronic building access. Coordinate changes with the relevant managers and access-system owners. A poorly controlled bulk removal can interrupt legitimate work, so establish a clear decision process before changing permissions.
Decide what the review must cover
Define the buildings, access groups, credential types and period in scope. Include staff, contractors, temporary workers and other users with continuing access. Identify who controls shared areas if a landlord or another organisation manages part of the building.
The NPSA guidance on automatic access-control systems explains how these systems manage access to areas. Review the person, place and permitted time together. A valid employee may still have unnecessary access to a particular area or outside the hours their work requires.
Separate entitlement review from incident response. If a specific credential presents an immediate concern, use the authorised response process rather than waiting for the next periodic review. Conversely, a stale record alone is not proof that its holder has done anything wrong.
Establish reliable comparison information
Obtain the current active-permission export from the system owner through an approved secure method. Record when it was produced and which systems it covers. An old spreadsheet may describe a previous configuration rather than the permissions currently in force.
Compare it with the minimum information needed to establish current need: employment or engagement status, approved role, sponsor, work location and relevant end date. Do not request a complete personnel file when a status confirmation will answer the question.
Agree how changes occurring during the review will be handled. A contractor may finish a project after the initial export. Keep a short change record or conduct a final reconciliation so the review does not approve a position that is already out of date.
Give sponsors an explicit decision
Ask the person responsible for the area or activity to confirm each material entitlement. Offer clear choices: retain, reduce, remove or investigate. Require a reason for retained access where the need is not obvious from an approved role.
Do not interpret silence as approval. Set an escalation route for unanswered requests. Whether access should be suspended while a decision is outstanding depends on the exposure, operational consequences and the organisation's approved rules. Make that decision through the responsible authority.
Keep security administration separate from sponsorship where practical. The administrator implements the approved decision. The sponsor confirms the business need. Record both actions so the administrator is not expected to invent a justification for access.
Work through the exceptions
The following fictional review covers a small office. The entries use invented roles and identifiers; they are not personal records.
| Review finding | Sponsor decision | Verification needed |
|---|---|---|
| A contractor's engagement has ended but the credential remains active. | Remove the entitlement under the approved offboarding process. | Confirm the system change, relevant propagation and the change-log entry. |
| An employee moved teams but retains access to the previous work area. | Retain ordinary staff access and remove the obsolete group. | Compare the resulting permission set with the approved role. |
| A recurring service technician has no recorded sponsor or expiry. | Refer to the service owner to establish the actual need and conditions. | Record the authorised decision, sponsor and review or expiry condition. |
| A current worker has not used the credential recently. | Check need before changing access; inactivity alone is inconclusive. | Confirm the worker's role and any planned return or infrequent duties. |
This review does more than remove old names. It identifies missing ownership, excessive scope and records that cannot support a decision.
Implement changes through a controlled list
Give the administrator an approved change list with enough detail to identify the correct credential and entitlement. Use the organisation's normal identifiers and secure transfer route. Similar names are a reason to check identity carefully, not to guess.
Record the old permission, approved change, approving authority and implementation reference. For a large review, use a staged approach with checks between groups of changes. Preserve the recovery information required by the normal change process without retaining unnecessary copies of personal data.
Consider linked systems and shared-building arrangements. Removing an entry from one local list may not remove it from the system that actually controls access. Ask the system owner how changes take effect and what evidence confirms the final state.
Do not carry out unannounced attempts to enter restricted areas using another person's credential. Where a functional test is necessary, use approved test credentials, a defined test plan and the responsible system owner's supervision.
Verify the outcome, not just the work order
A closed service ticket shows that someone recorded completion. Check the relevant system state or approved evidence of revocation as well. Reconcile the completed changes against the sponsor's decisions and investigate missing or different results.
For higher-consequence access, agree the assurance needed with the responsible manager. The appropriate check may differ from a routine office permission change. Record any limitation, such as a component that could not be checked during the review, and assign follow-up work.
Keep unresolved cases visible. A useful closure statement might be: “All approved changes for the defined building were verified except two supplier-controlled entries awaiting confirmation.” It should not say “access review complete” without making those exceptions clear.
Prevent the same backlog returning
Use the findings to improve joiner, mover and leaver processes. A recurring absence of sponsors may require better approval records. Repeated late removals may reveal a missing notification between the engagement owner and the security team.
Choose a review frequency appropriate to access exposure and the rate of change, while meeting applicable organisational requirements. Periodic review complements prompt event-driven changes; it should not become a reason to leave departed people active until the next calendar date.
Start with one high-priority access group. Identify its sponsor, reconcile active entitlements and verify the decisions. Use what you learn to plan the wider review.
Use the organisation's security risk policy to establish authority, and record unresolved access changes in an actionable register.
The paid SRMBOK Electronic Access Control System Audit Procedure provides an editable Word procedure and reporting structure for sponsor reviews of access rights. Adapt its review cycle to your organisation and retain evidence that each approved change was implemented.