Bank Branch: Dead Cameras, a Faulty Duress Button and a Password Request
You are the guard at a bank branch with three teller counters. The branch has 12 cameras, a digital recorder with 21-day retention, a duress button at each teller, and a key register. On Monday morning the branch manager tells you: (1) four cameras covering the ATM lobby and the rear car park have shown ‘no video’ for nine days and the maintenance company has not come; (2) the duress button at teller 3 has a loose wire and keeps triggering false alarms, so the manager wants you to disconnect it during customer hours; (3) he wants to test the intruder alarm at 11:00, when the branch is full, ‘to see if it works’. He also asks you to give the recorder’s admin password to an IT technician who has no written request. The branch opens at 09:00.
1. Rank the three faults by risk and give one compensatory control for each.
Read the worked answer
Ranking by impact on life, then on evidence, then on disruption:
Duress button at teller 3 - highest. It is a life-safety device. A disconnected button means that teller has no silent alarm during a robbery, and repeated false alarms train staff and police to ignore the real one. Control: do not disconnect it. Take teller 3 out of cash-handling duty or move that teller to non-cash work until repaired; give the teller an alternative means of raising the alarm (a handheld pendant, a direct-line phone, or a pre-arranged code word to the guard); log every activation and the time; escalate to maintenance with a written deadline and inform the branch’s security manager.
Four dead cameras for nine days - second. The ATM lobby and rear car park are exactly where cash-in-transit and robbery risk sit, and the 21-day retention is useless if nothing is recorded. Control: temporary camera or a guard patrol of the ATM lobby and rear car park at fixed intervals with a written log; schedule cash loading and ATM replenishment for daylight only; request a written repair date.
Intruder alarm test at 11:00 - lower impact but avoidable. Testing a live alarm with customers inside causes panic and a false police response. Control: test before 09:00 or after close, with the monitoring company and police notified in advance.
2. The manager asks for the recorder’s admin password to be given to an IT technician with no written request. How do you respond?
Read the worked answer
Refuse, politely and specifically, and offer a workable alternative.
The recorder holds the bank’s evidence. An admin password gives the holder the ability to delete footage, change time stamps and disable recording. That is not an IT convenience; it is control of evidence. A technician without a written request has no demonstrated authorisation, and ‘the manager asked’ is not the same as the branch’s access-control procedure.
Say: ‘I cannot release the password. I can log the technician in, stay with him while he works, and record what he does, if you give me a written request naming him and the work.’ Then implement that: written authorisation signed by the manager, identity check against CNIC, entry in the key and password register, the guard present throughout, and a note of the time in and out and which menu functions were used. Change the password after the session and record who holds the new one.
The reasoning is least privilege and separation of duties: the person who can alter footage should not be the same person who is unsupervised with it. If footage from the ATM lobby is later needed for a fraud case, the chain of custody must show that no unauthorised person had access.
3. The manager says ‘just do it, I will take responsibility’. What do you do?
Read the worked answer
Get the instruction in writing, state your advice in writing, and do not falsify a record.
First, repeat the risk in one short paragraph and your recommendation, in an email or a memo that the manager can reply to: the duress button should not be disconnected; the alarm test should be outside customer hours; the password should not be released without written authorisation. Ask for a written instruction if he still wants it done. That converts a corridor conversation into a document.
Second, record the conversation in the occurrence book with time, who said what, and what you advised. If the manager refuses to put anything in writing, note: ‘Advice given, instruction noted, no written instruction provided.’
Third, escalate to the security manager or the regional security officer of the bank or the security company, because the risks are not the branch’s alone - a robbery with a dead duress button, or missing footage in a fraud case, will be investigated nationally.
Finally, do not disconnect the button, do not release the password, and do not test the alarm during customer hours. ‘I will take responsibility’ does not transfer the guard’s own duty of care, and a guard who follows an unsafe instruction and writes nothing is the person who carries the blame when the incident report is read.