Tailgating, Contractor Badges and Fire Egress in a 14-Storey Office Tower
A 14-storey office tower holds 1,200 tenant staff and about 350 visitors on a typical day. The lobby has two swing-gate turnstiles, one reception desk staffed by a single officer, and a service lift that reaches every floor from the loading bay. In the last quarter there were 15 lost or stolen access cards, six confirmed cases of staff lending cards to colleagues, and a tenant survey observed tailgating on roughly 40 percent of peak-hour entries. Contractor badges are generic, read 'CONTRACTOR', have no expiry date and are not tied to a company or a work permit. Three fire-escape doors on floors 3, 7 and 11 are routinely propped open with chairs for ventilation. The building manager wants tighter access but is worried about slowing entry and about blocking fire egress. You are the security supervisor asked to propose a workable design.
1. Propose an access-control design that reduces tailgating and card sharing while preserving fire egress and reasonable entry speed. Explain the trade-offs you are making.
Read the worked answer
I would design around zones and evidence rather than simply adding turnstiles. First, zone the building: lobby as public, lift lobbies and tenant floors as controlled, service corridors and plant rooms as restricted, and the loading bay as a controlled interface. Access rights should follow the zone, not the individual's seniority.
For the lobby, the binding constraint is throughput. Two swing gates with one reception officer cannot both verify visitors and stop tailgating at peak. I would add a second officer or a concierge post at the visitor lane during peak hours, and use a mantrap or a weighted 'one entry per valid read' gate only if the lobby layout allows it without narrowing the escape route. A turnstile that is cheap but slows egress is not a good trade; fire egress capacity must be calculated, not assumed. The correct sequence is to consult the fire safety plan and building control before ordering hardware.
For card sharing, technology helps but policy enforces. Anti-passback on controlled doors, a photograph on the access system screen, and anomaly reports (same card at two readers within an implausible time) give supervisors evidence. Disciplinary policy must state that lending a card is a serious breach. I would not rely on guards challenging everyone, because that shifts the burden onto the lowest-paid person in the lobby and produces inconsistent enforcement.
For the propped fire doors, the answer is not to lock them but to fix the underlying ventilation complaint, fit door alarms that sound locally and report to the desk, and require a documented inspection. A door held open for ventilation is a fire risk and also a bypass of the whole access system.
Trade-off: some entry delay and visitor friction is acceptable; blocking egress is not. I would measure queue time and review after two weeks.
2. Design a contractor access lifecycle for the tower, from request to badge return. Explain how each stage reduces a specific risk you observed in the setup.
Read the worked answer
The current generic 'CONTRACTOR' badge creates three risks: it is not tied to a person, it does not expire, and it does not show where the holder is allowed. I would replace it with a lifecycle.
Request: the tenant or building maintenance raises a work request naming the company, the individual workers, the task, the floors and the dates. This ties access to a legitimate purpose and creates a record the security team can check. Risk addressed: unknown persons holding a building-wide credential.
Vetting and induction: identity document check, company confirmation, and a short induction covering fire routes, prohibited areas, and reporting. Risk addressed: contractors who do not know evacuation procedures or wander into plant areas.
Badge issue: photo badge, unique number, expiry date matching the work permit, and access rights limited to the work zone and the nearest safe route. If the service lift is needed, that is a specific entitlement, not a default. Risk addressed: a contractor badge opening every floor.
Escort or check-in rules by risk tier: high-risk work in plant rooms or risers requires an escort or a lone-worker check; low-risk painting in a vacant office may not. Risk addressed: unobserved work in sensitive areas.
Daily sign-in and sign-out, with a supervisor audit of badges that have not signed out.
Return and deactivation: badge returned at completion, access rights disabled the same day, and a weekly reconciliation of active contractor badges against open permits. Risk addressed: expired credentials circulating, which is how generic badges end up lent or lost.
I would also add a lost-badge procedure with immediate deactivation, because the 15 lost or stolen cards show the existing process is not controlling the credential after issue.
3. What performance measures would you use to judge whether the new access regime is working, and how would you avoid the measures creating perverse incentives?
Read the worked answer
I would use a small balanced set rather than a single tailgating count. Operational measures: tailgating observations per 100 peak entries from independent spot checks; percentage of entries via a valid read at controlled doors; anti-passback exception rate; queue time at peak; and visitor wait time. Credential measures: number of active contractor badges against open work permits; days from contractor completion to deactivation; lost/stolen cards deactivated within one hour. Egress and safety measures: number of propped fire doors found on inspection; time for a full evacuation drill; door-alarm response time.
Perverse incentives are the main danger. If guards are measured on tailgating catches, they may over-challenge visitors or record false catches; if measured on zero incidents, they may suppress reports. So I would pair enforcement measures with service measures (visitor wait time, complaint rate) and with a reporting measure that rewards near-miss reporting rather than punishing it. Spot checks should be done by someone other than the officer being measured, and the sample method should be consistent so the number is comparable month to month.
I would also avoid treating a low card-sharing count as success, because detection depends on anti-passback and anomaly review actually being done. A better indicator is the proportion of anomalous reads investigated and closed, not just the raw count.
Finally, I would set review triggers: a rise in peak queue time above an agreed threshold, a failed egress drill, or a second propped-door finding on the same floor should each prompt a design review rather than a demand for more enforcement.