Expired Badges and Three Missing Keys

The guard was right, and the reason is not bureaucracy. Access control exists so that every person inside the fence can be accounted for during an incident. An expired badge means the system has already failed once; letting fourteen people through on a phone call converts a paperwork lapse into an unaccounted population next to a chlorine store.

The engineer's instruction is a genuine operational request from a senior person, so it cannot simply be ignored - it must be converted into an authorisation.

• Hold, do not humiliate. Keep the crew together in a shaded area at the gate, explain politely that they will be inside within minutes, and do not let them drift back to their vehicles, where tailgating becomes likely.
• Verify with the engineer directly (not by relay), then ask for a written authorisation listing names, ID numbers, the work scope and a validity date. A text or email from the engineer's own phone is enough to start; a note afterwards is better.
• Issue temporary visitor badges with a colour that matches the authorisation, require escort in the chlorine area, and log every exception: time, who authorised it, which names, expiry.
• Inform the plant manager and HR the same morning that a verbal override has been used, so it is recorded as an exception rather than becoming the new normal.
• If the written authorisation does not arrive within about 30 minutes, allow only escorted work away from the dosing room and reschedule the rest; the overhaul is three weeks long, the water supply is not.

The judgement point: the commercial pressure is real, but the consequence of a single unvetted person in the chlorine room is contaminated water for 900,000 people, which no schedule justifies.

The keys come first because they are still out there. A lock change is cheap; an unexplained opening of a chlorine store is not.

Today:

1. Change or supplement the lock on the dosing room and issue a new controlled key set. The old keys become scrap metal, not a mystery.
2. One keyholder per shift, signed out and signed back in, with a second signature on every entry to the room and CCTV coverage of the door.
3. Escort rule inside the chlorine area - no contractor enters without a plant employee, whatever the badge says.

Then investigate, factually: 4. Separate, contemporaneous interviews with the key custodians, asking who last held each missing key, not who is to blame. 5. Reconstruct the four unsigned openings from gate logs, CCTV, work orders and shift rosters. Names and times, not impressions. 6. The canvas bag: ask the contractor to show its contents in the presence of a witness and with his knowledge. Do not search a person alone, do not put hands in his pockets, and do not detain him - guards have no power of arrest beyond a citizen's arrest for an offence in progress. If he refuses or the contents are unexplained, call the police and let them handle it. 7. Report to the plant manager, HR and the police if anything is found, and notify the NSCDC office that monitors the site as critical infrastructure.

Do not treat a five-week gap and a Thursday incident as unrelated until the log reconstruction says they are. The pattern - keys gone, entries unsigned, an unescorted man in the corridor - is what an insider test looks like.

Structure that survives scrutiny: date and time; facts separated from opinion; decisions already taken; residual risk; what you are asking for.

Incident note - [date] What happened: On [date] 14 contractor staff were admitted on badges that expired [date]; a verbal instruction from the site engineer was recorded and later documented. On [date] a contractor was found unescorted in the chlorine dosing-room corridor at [time] with a bag, holding an expired badge. Three dosing-room keys have been untraceable since [date]; the room log shows four unsigned openings in that period. Action taken: lock changed; temporary badges and escort rule in force; key issue register introduced; contents of the bag [shown / not shown] to a witness; police informed / not informed. Residual risk: chlorine store integrity cannot be confirmed for the period of the unsigned openings; water quality testing at the outlet requested as a precaution. Request: approval of a 14-day access-control remedial plan and a formal instruction that gate overrides must be written.

What the monitoring officer is really assessing: whether you can account for everyone on site, whether sensitive areas have controlled access, whether records are contemporaneous, and whether you escalate or conceal. A clean, early, factual note is treated as evidence of a working system. A note written three weeks later, after someone else reports it, is treated as evidence of a broken one.