Access Control Anomaly During a Sensitive Meeting
A board meeting is underway in room 3 on the second floor. You are monitoring access control and CCTV. At 15:30 a card belonging to a cleaner, who is on leave, is used at the second-floor stairwell door. The door opens and closes within two seconds. Camera 9 covers the corridor but the view is partly blocked by a filing cabinet. You see a figure in a high-visibility vest walk away from the door toward room 3. The meeting is due to end at 16:00. There have been two recent thefts from offices on the same floor.
1. Assess the risk and decide what you should do in the next few minutes.
Read the worked answer
The combination is high risk: a credential used by someone on leave, a short door-open time consistent with tailgating or a cloned card, a partly blind camera, and a person moving toward a sensitive meeting during a theft spree. It cannot be dismissed as a cleaner working overtime.
Actions:
- Do not confront over CCTV alone. Use the radio to alert a guard or the duty manager discreetly, giving the location and description.
- Ask for a discreet check of the second floor, and consider asking the meeting chair to pause or secure the room if the figure approaches.
- Track the figure on camera across all available views, and note the time and direction. If the person enters room 3, escalate immediately.
- Preserve the access log for the cleaner's card and check whether it was reported lost.
- Record the observation and actions in the log.
The judgement is that you act on the pattern, not on a single ambiguous frame, and you use people on the ground rather than guessing from a partial view.
2. The guard reports the person is a contractor in a high-vis vest who says he is 'checking the fire doors'. He has no escort and no permit on record. What now, and what evidence do you keep?
Read the worked answer
Treat the explanation as unverified. A contractor without an escort or permit in a restricted area during a board meeting is a security concern, even if innocent.
Actions:
- Have the guard politely escort him to reception and ask for ID, company, and work order. Do not let him continue unescorted.
- Verify with facilities whether any fire-door work is scheduled. If not, treat as unauthorised access.
- Check whether the cleaner's card was used by him and how he obtained it. If the card is missing, deactivate it.
- Inform the duty manager and consider a discreet word to the meeting chair.
- If he cannot account for himself, call police and preserve the scene.
Evidence to keep:
- Access-control logs for the stairwell door and the cleaner's card.
- Exported CCTV of the corridor and any other views, with timestamps.
- Guard's statement and reception sign-in records.
- A written incident report covering times, descriptions, and decisions.
The reasoning is that 'checking fire doors' is a common pretext. The operator verifies through records and people, and documents everything in case it becomes a police matter.