To improve delivery access controls, separate permission to deliver goods from permission to move around your premises. Agree who receives the delivery, where the driver waits and what happens when the expected recipient is unavailable.
A booking, branded vehicle or familiar face can help establish context. None answers every access question. Your process needs to connect a legitimate delivery to an authorised receiving person and a defined route.
This approach is for ordinary business deliveries at offices, workshops and mixed-use premises. Specialist cargo, dangerous goods and suspicious packages need their own competent assessment and response arrangements.
Follow a delivery from arrival to departure
Observe the real process with the receiving team. Include a busy period and an exception, such as a delivery arriving while the goods receiver is at lunch. Ask permission before observing; do not stage an unannounced intrusion.
Record where the delivery is expected, who checks it and where responsibility changes. A diagram can be simple: arrival point, waiting point, receiving point, destination and exit. Add the people who make decisions at each stage.
Look for informal shortcuts. A courier may be told to find the recipient upstairs. A regular supplier may use yesterday's access arrangement. Staff may hold a controlled door open because the loading queue blocks a work area. These are different problems and need different corrections.
Record the reason for the shortcut as well as the act. A procedure that ignores unloading space, staffing and actual delivery times is unlikely to survive a busy morning.
Define three separate permissions
Delivery authorisation establishes that the business expects or agrees to receive the goods. The order reference, booking or recipient confirmation supports that decision.
Receipt of goods establishes who takes custody, records discrepancies and sends the goods onwards. The person signing for a parcel may have no authority to grant building access.
Movement permission establishes where the driver or contractor may go, for what purpose and with what supervision. Delivering to reception and installing equipment in a restricted room are different jobs.
Write these permissions into your process in plain language. For example: “Reception may accept ordinary parcels for named staff. Access beyond reception requires the receiving department to nominate a host and confirm the permitted destination.” Adapt that rule to your premises; it is an example, not a universal requirement.
Give exceptions a workable route
An unexpected delivery is not automatically malicious, and a familiar supplier is not automatically authorised for every destination. It does require a decision through a trusted business contact, rather than whichever phone number the visitor provides.
Choose a safe place for ordinary deliveries to wait while that decision is made. Keep emergency exits, pedestrian routes and traffic arrangements clear. If there is no suitable waiting area, agree whether the delivery is deferred or redirected through the supplier's established contact.
After-hours arrangements need their own owner. A daytime procedure is incomplete if nobody can authorise receipt at night. Avoid transferring every decision to a lone guard who has neither the information nor the authority to resolve it.
For suspect items, stop using the routine goods process and follow the site's emergency arrangements. Do not ask an untrained receiver to open or move something to prove it is harmless. UK ProtectUK mail-handling guidance distinguishes risk-based delivery planning from the response to a suspicious item. It also stresses including different delivery streams in planning. Use local emergency advice for your jurisdiction.
Worked example: a shared loading entrance
A fictional design business receives office supplies and specialist equipment through a loading entrance shared with other tenants. Drivers sometimes enter the office corridor to find someone to sign. The business wants to maintain deliveries without giving recipients an informal access-control role.
| Situation | Agreed decision | Evidence to keep |
|---|---|---|
| Expected parcel during receiving hours | Receiver accepts it at the nominated point; driver remains in the delivery area | Order or recipient reference and receipt record |
| Equipment needs installation inside | Department confirms the work, host and authorised destination before movement | Job confirmation and host acceptance |
| Recipient cannot be reached | Receiver uses the agreed fallback contact or defers receipt | Exception and decision, without unnecessary personal data |
| Shared entrance is unattended | Building manager and tenant apply their agreed temporary arrangement | Named owner and end time for the arrangement |
The proposed control is not “all deliveries are safe”. It is that receiving goods does not silently authorise wider access. The assessment should still consider goods custody, theft, traffic and relevant delivered-item threats separately.
Test the handovers
Walk through an expected delivery and an ordinary unexpected one with willing staff. Use harmless sample paperwork and a clearly agreed exercise boundary. Confirm that the receiver can contact the decision-maker without abandoning the receiving point.
Check whether the driver can understand the instructions and whether the physical layout supports them. A sign cannot repair a process requiring someone to cross a controlled boundary to obtain assistance.
Include the handover after receipt. Goods left indefinitely in a public area may create a different loss or safety problem. Name the person or team that collects them, how receipt is acknowledged and what happens to unclaimed items.
Record where the process failed. If the fallback contact was unavailable, adding another signature field will not fix the contact gap. If the waiting area caused congestion, involve facilities and operations before tightening the rule.
Keep records proportionate
Record enough to connect the delivery, receiving decision and any access permission. Avoid collecting identity documents or personal details merely because a form contains a field. Apply your organisation's privacy, retention and access rules.
Keep sensitive routes, access settings and emergency arrangements in controlled instructions for the people who need them. Public delivery instructions should explain where to arrive and how to seek help without revealing the site's security configuration.
Review repeated exceptions as operational evidence. If most deliveries need an exception, the normal process probably does not describe the work. Change the receiving hours, staffing or supplier instructions through an authorised decision rather than normalising bypasses.
Keep receiving responsibilities in the security plan and define shared-building boundaries in the assessment scope.
Your next action
Choose one delivery route and trace it with the people who order, receive and escort. Identify the first point at which responsibility becomes unclear, then agree and test a correction.
The paid SRMBOK Physical Security Risk Assessment Tool provides a workbook for recording the delivery scenario, existing controls, treatment owner and review date. Use it to keep the access decision connected to the risk and the evidence from your test.