AUDITRIBE
PRACTICAL AUDIT GUIDE

Security & Access Control

Evaluate whether physical access, visitor management, keys, badges and security incidents are adequately controlled.

Key Risks

  • Unauthorised entry
  • Theft or asset loss
  • Uncontrolled visitor access
  • Shared or unreturned access credentials
  • Weak incident response

Documents & Data

  • Access list
  • Visitor register
  • Badge/key register
  • CCTV coverage records
  • Security incident log
  • Exit clearance records
  • Guard post instructions

Key Controls

  • Approved access rights
  • Visitor identification and escort
  • Badge/key issuance and return
  • CCTV monitoring
  • Restricted-area controls
  • Incident escalation

Practical Audit Procedures

  1. Compare active access rights with current employees and approved roles.
  2. Test exited/transferred employees for timely access removal.
  3. Review visitor records and escort evidence.
  4. Inspect controls around high-risk/restricted areas.
  5. Review lost badges, keys and security incidents for follow-up.
  6. Assess CCTV coverage and retention for critical locations.

Questions to Ask

  • What could prevent this process from achieving its objective?
  • Which controls are considered critical, and who owns them?
  • What evidence shows the controls actually operated during the period?
  • What exceptions, incidents or recurring problems occurred?
  • What has management changed since the last review?

Need a ready-to-use audit checklist?

Use Steal My Checklist to move from understanding the audit area to performing practical fieldwork.

Get Steal My Checklist