Tailgating at the Service Gate
At a 24/7 logistics hub, 340 badge holders and 60 contractors pass through the main lobby turnstile, but the service gate is a single glass door controlled by a guard. During a 40-minute CCTV review you count 11 tailgating events: drivers following employees through, a guard propping the door with a rubber wedge during a smoke break, and a contractor entering with an expired badge that still reads ‘active.’ The access-control system shows seven active credentials for contractors who left more than 30 days ago. The site has no visitor management at the service gate; deliveries are signed on a clipboard. Patrols are documented by a guard initialing a paper checkpoint every hour, but the checkpoint at the service gate is inside the office, out of sight of the door.
1. What immediate access-control actions do you take within the next 24 hours?
Read the worked answer
I would secure the door first and investigate second. The rubber wedge comes out immediately, and the guard is instructed in writing that propping the door is a disciplinary matter because it defeats the entire access-control system. I would place a temporary guard directly at the service gate with a clear post instruction: one person, one badge, one entry; challenge every tailgater; no entry on an expired or unreadable badge; deliveries verified against the manifest and signed for by the receiving clerk, not left on a clipboard.
I would ask the client to deactivate the seven stale contractor credentials today and to provide a current contractor list. Until that is done, I would use a paper exception sheet at the gate for any contractor whose badge is suspect, with name, company, time, and supervisor approval. I would also check whether the door has a door-position switch or alarm; if it does, I would enable it, and if it does not, I would request a temporary door alarm or CCTV view of the door.
The test is not whether the guard ‘looks busy.’ The test is whether an unauthorised person can get through the door in the next 24 hours. I would log every action and notify the client’s security manager and my account manager the same day.
2. How do you investigate the seven active credentials for departed contractors without damaging the client relationship?
Read the worked answer
I would frame the audit as a joint access-control review, not an accusation. Start with the access-control system export and match it against the client’s active contractor roster. For each of the seven, identify the sponsor, the termination date, the last badge use, and whether the badge was returned. Then deactivate the credentials and document the time and authorizer.
The sensitive part is why they stayed active. Possible causes include a client sponsor who forgot to notify security, a contractor company that did not return badges, or a guard who reactivated a badge informally. I would ask the client’s contract owner to confirm terminations in writing and to nominate one person who owns contractor access changes. I would not discipline a guard until I know whether the guard had authority to change the system; many access-control problems are process failures, not dishonesty.
I would also check the CCTV for any of the seven badges being used after the termination date. If there is evidence of misuse, preserve it and escalate to the client and, if appropriate, the police. The output should be a corrected roster, a badge-return rule, and a monthly reconciliation schedule.
3. How should patrols and physical controls be redesigned so the service gate is actually covered?
Read the worked answer
The current paper checkpoint is in the wrong place. A guard can initial it without looking at the door, so the record proves a visit but not coverage. I would move the service-gate checkpoint to a position that forces the guard to face the door, or replace it with a random patrol scan point plus a door-contact log. The patrol route should include the gate at irregular intervals, not only on the hour, because predictable patrols are easy to defeat.
Physically, I would ask for a badge reader at the service gate, a door-position alarm that annunciates at the guard desk, and CCTV coverage of the door from an angle that shows faces and badges. If the client will not fund a reader, the temporary guard post stays. For deliveries, I would create a controlled delivery window and a manifest check rather than a clipboard in the open.
I would measure the fix: tailgating events per shift from CCTV, door-alarm activations, expired-badge attempts, and patrol scan compliance. After two weeks, review the data with the client. If tailgating continues, the problem is not the patrol route; it is the door hardware or the site culture, and the client must choose a stronger control.