Bank lobby: unverifiable auditor and a tailgated delivery
You are the lobby security officer at the regional headquarters of a bank: 30 floors, about 620 staff, three visitor turnstiles and one officer at the desk. At 09:15 a man in a suit says he is from an external audit firm and is expected by the Finance team at 09:30. He has no appointment letter; he shows a photo on his phone of an email that has no letterhead and no name matching his NRIC, which he declines to show, saying he will only show it to Finance. The Finance manager is in a meeting until 10:00 and is not answering calls. At the same time, a staff member badged through the staff lane and held the secure door open for two men in polo shirts carrying a box marked 'server parts'; neither man badged in. The visitor, now impatient, says he will report you and starts walking toward the turnstile. Bank policy requires all visitors to be pre-registered, issued a pass and escorted at all times; contractors must be escorted by the facilities team.
1. How do you verify the visitor, and what do you do when he walks toward the turnstile?
Read the worked answer
Verification is documentary and independent. A photo of an email on a phone proves nothing. Check the pre-registration list first. Then call the Finance manager's line and, failing that, the Finance director or the audit firm's published switchboard number - not a number the visitor supplies. Photo ID (NRIC, FIN or passport) is required for a pass; he may refuse, and you cannot force him, but without ID there is no pass. Offer real alternatives: wait in the visitor lounge until 10:00, or reschedule with the host.
When he moves toward the turnstile. Do not grab, shove or block with your body weight. Step in front, hand up, and give one clear instruction: 'I cannot let you through without a pass.' Let the turnstile do the physical stopping. If he pushes past, call police and the bank's security manager; that is the escalation point, not a wrestling match.
Legal limits. A security officer cannot arrest for simple unauthorised entry. The occupier can ask a person to leave and use reasonable force to protect property or remove a trespasser who refuses, but force against a person who has not been violent is a poor and legally risky choice.
Record it. Time, name given, refusal, exact words, action taken.
2. Two unbadged men are already inside with a box. What do you do, bearing in mind you are the only officer at the desk?
Read the worked answer
First, do not abandon the desk. You are the only officer; leaving three turnstiles and a lobby unstaffed to chase a delivery creates a bigger hole than the one you are plugging.
Act in parallel. Call the facilities team immediately and ask them to intercept the pair at the loading lift or the server floor. Track them on CCTV and note the floor they exit. If a second guard or a trained staff member is available, send them; otherwise attend yourself once relieved or once the pair is contained.
When you approach. Friendly and non-confrontational: 'I need to get you signed in before you go further.' Verify with facilities whether server parts were expected, check the consignment note, take names and ID, issue contractor passes, escort to destination and escort out. 'We are just delivering' is unverified until facilities confirm.
The real control failure is the staff member holding the secure door - that is the tailgating vector, and it will happen again tomorrow. Report it factually, recommend anti-tailgating alarms, anti-passback and a delivery procedure, and review 30 days of door events for the same pattern. If the men refuse to cooperate or to leave, call police.
3. The visitor log holds names, NRIC numbers, phone numbers and vehicle plates, and the visitor later demands to see and delete his entry. A marketing colleague also asks for the list. How do you handle the data?
Read the worked answer
What the log is. Personal data collected for a security purpose. Collect only what is needed (name, ID reference, contact, host, times), notify the purpose at the desk with a clear sign or statement, and mask or avoid photocopying identity documents unless there is a genuine need. Store it with restricted access - not on a personal phone or a WhatsApp group - and apply your organisation's retention period, then dispose of it securely.
The access and deletion demand. Under the Personal Data Protection Act an individual may request access to and correction of his own data. Do not argue the point at the desk and do not hand over the log: log the request, give the person the proper channel, and route it to the Data Protection Officer within the policy timeframe. Blanket refusal is wrong, and so is instant compliance.
The marketing request. Refuse. The data was collected for security, not for marketing; passing it on without consent or DPO approval is a disclosure breach. Refer the colleague to the DPO.
Confidentiality. The same restraint applies to anything you see on CCTV or in the log: no sharing, no social media, no discussion of who visited whom.