The Annual Access Audit: A Calendar Item That Pays for Itself

Every building carries a quiet stack of annual obligations: fire systems tested, insurance renewed, lifts serviced, accounts closed. Doors are almost never on that list. Access gets configured at handover, signed off by everyone present, and then trusted to keep working while the people who use it quietly change underneath.

That gap is what an annual access audit closes. It is not a service visit and it does not need a specialist — it is one walk through the building with the credential list open, checking who holds access, what still works, and what has drifted since last year. What follows is a working access control audit checklist for operators, property managers and integrators who would rather meet problems on a schedule than in month eleven.

What the audit actually checks

An access audit is not a technical inspection. It is a comparison — between the list of who should have access and the building as it actually behaves — run along five lines of inquiry, each answerable with a printout and a walk.

• The register against reality. Start with the list itself: the spreadsheet, key register or badge list that should hold one line per person per door. The first task is finding where a door disagrees with the page, and where the page has no line at all.
• A function test at every door. Open each door with a credential from the list. Listen to the latch, check the handle for movement, look at the frame for wear. A door that sticks in October is a callback in February.
• The admin list. Note who holds management-level access on each lock. On a model like the DDL1, administration is documented at 3 admin positions, so a seat held by someone who left is a fixed resource spent on nobody.
• Temporary credentials that never expired. Contractor codes, visitor codes and seasonal staff credentials — issued for a week, still live a year later. The audit asks which are active and whether the original reason still exists.
• The people with no line. The counterpart problem: staff never issued their own credential, sharing someone else’s. Nothing on the register shows them until the walk reveals one code opening doors for three people.

Five checks, one page of notes, and a clear picture of where the list and the building disagree.

The ceiling is your friend

One documented property of the hardware makes all of this easier: capacity limits. A lock holds a finite list of credentials, and when that list is full, every new credential requires an old one to be removed. That single constraint turns access hygiene from a good intention into a decision with a deadline.

The documented ceilings differ by model and family. The DS-series deadbolts are documented with capacity for 100 fingerprints, 100 passwords and 100 cards. The DDL1 is documented with capacity for up to 297 users and 3 admin positions. The DDZ17 room-door model is documented with support for 300 users and temporary passwords.

These are planning numbers rather than sales numbers. An operator who knows the ceiling can size the register to the lock and treat a filling list as a signal instead of an accident — near the ceiling, the next addition cannot happen without deciding what to delete.

For anyone specifying hardware, the practical habit is to request the documented capacity of the exact model being quoted — spec sheets are available from CaremLock on request — and plan the register around that number.

The two-hour route

The checks are short; it is the route that makes or breaks them. An audit that wanders the building in the order problems occur to the auditor takes a day and still misses rooms. A fixed path takes about two hours at a mid-size property and finishes with a document.

If the first audit takes a full morning rather than two hours, that duration is itself a finding — about the register, not about the doors.

What to do with what you find

Findings fall into three buckets, and the discipline is that every line ends up in one of them.

Revoke. Any credential that cannot be matched to a current person working at or visiting the property. This is the annual walk meeting the same discipline that keeps staff offboarding and access revocation straightforward during the year: one credential per person, removed on the day they leave rather than at the next audit.

Re-issue and repair. Shared codes become individual credentials where documented capacity allows, hardware issues become work orders, and admin seats move to current staff.

Record. The audit’s real output is the operator’s own updated register — the spreadsheet, key register or property file where each credential maps to a name. The lock holds slots; the story about who holds each slot belongs to the operator’s records. That cleaned list is also the raw material when the property changes systems: the same starting point as moving access lists to a new platform.

And if the findings include doors that need replacing rather than repairing, that is a specification project of its own. The first step is fit, checked against the door compatibility and measurement guide before any model is chosen.

Start before it is needed

An audit is cheapest when nothing is pressing, so date it. Pick the week when other annual obligations already land — the fire inspection, the insurance renewal, the start of the budget cycle — and attach the access walk to them. An audit bound to an existing ritual happens; one waiting for a free week waits forever.

The second habit is accepting that year one is an investigation and every year after is a comparison. The first pass always finds the most: credentials nobody recognizes, admin seats held by former staff, a register describing a building two reorganizations ago. Later passes take less time and find less, which is the point.

What the walk buys is not certainty — doors still break, and people still leave — but one scheduled hour each year where the list and the building agree, on the record, before anyone else asks the question.