A premises can appear secure at 5 pm yet become exposed once the last member of staff leaves. A side gate left unsecured, an obsolete key still in circulation or an alarm call list that has not been updated can turn a minor oversight into a costly incident. Knowing how to audit physical security gives business owners and facilities teams a clear picture of these gaps before they are exploited.
A useful audit is not simply a checklist of doors, cameras and alarms. It considers how people move through the site, who can gain access, what happens when an incident occurs and whether the arrangements work outside normal hours. The aim is practical: reduce opportunity, protect staff and assets, and maintain continuity when the unexpected happens.
Start with the risks specific to your premises
Begin by defining what you are protecting. This may include stock, tools, machinery, data, keys, confidential records, controlled substances or the safety of employees and visitors. The value of an item matters, but so does the disruption its loss or damage could cause. A stolen laptop may be replaced quickly; a compromised master key, damaged production line or inaccessible building may have much wider consequences.
Consider the risks associated with the location and type of property. An industrial unit on a quiet estate faces different challenges from a town-centre office, healthcare setting or retail premises. Vacant buildings need particular attention because faults, unauthorised access and signs of occupation can go unnoticed for longer.
Review incidents and near misses from the previous 12 to 24 months. Look beyond break-ins. Repeated false alarms, tailgating, lost keys, unsecured delivery entrances, vandalism and complaints about poor lighting all reveal useful patterns. Speak to reception staff, cleaners, maintenance contractors and employees who open or lock the site, as they often see weaknesses that are absent from a written procedure.
How to audit physical security around the site
Walk the boundary of the premises during daylight and, where possible, after dark. Approach as a visitor, a delivery driver and someone attempting to enter without permission. The purpose is not to conduct unsafe tests or attempt forced entry. It is to identify where ordinary behaviour, poor visibility or neglected maintenance makes unauthorised access easier.
Inspect fencing, walls, gates, bollards and vehicle barriers for damage, gaps and climbing aids. Check whether bin stores, pallets, skips or parked vehicles have been placed where they could assist access to a roof, window or first-floor opening. Examine signage too. Clear signs can direct legitimate visitors to the right entrance, while excessive information about alarm systems, staff routines or vacant areas may create unnecessary exposure.
Lighting deserves more than a quick glance. It should provide useful coverage at pedestrian entrances, car parks, loading areas, access routes and the rear of the building, without leaving glare that prevents cameras or staff from seeing clearly. Record failed lamps, obstructed fittings and areas where trees or stored materials have reduced visibility.
Then inspect every external door, roller shutter, fire exit, window and roof access point. Confirm that locks engage properly, door closers work, frames are secure and emergency exits are not routinely propped open. Fire safety requirements always take priority: an exit must remain available for evacuation, but it should also be monitored, alarmed or managed to prevent misuse when the building is occupied.
Examine access control and key management
Access control is only effective when permissions reflect current roles. Review every keyholder, fob, card, PIN and remote access credential against an up-to-date staff and contractor list. Remove access promptly for leavers, transferred employees and contractors whose work has ended. Where access is shared, establish who is accountable for its use.
Physical keys require the same discipline as electronic credentials. A key register should show what each key opens, who holds it, when it was issued and when it was returned. Master keys, plant room keys and keys for high-value areas should have tighter controls than general office keys. If keys have been lost or copied without authority, changing locks or rekeying cylinders may be the proportionate response.
Check the handover process for keys used by cleaners, delivery teams, engineers and open-up staff. Keys should not be left in predictable hiding places, unsecured cabinets or vehicles. Also assess whether a single person carries responsibility for opening or closing alone. Key holder assist or managed open-up and lock-up arrangements can reduce the personal risk involved, particularly at isolated sites or outside standard hours.
Check that systems support the physical measures
Intruder alarms, CCTV, intercoms and access control can provide valuable evidence and deterrence, but technology does not compensate for poor site management. During the audit, confirm that each system has a defined purpose and that staff understand how to use it.
For CCTV, assess whether cameras cover the entrances, vulnerable boundaries, loading areas and routes to critical assets. Check image quality in low light, correct date and time settings, recording retention, camera cleanliness and whether vegetation or signage blocks the view. A camera pointing at an area is not necessarily useful if faces, vehicle registrations or actions cannot be identified.
For intruder alarms, review the zones, set and unset procedures, maintenance history and false alarm record. Test communications only with appropriate planning and, if the system is monitored, notify the receiving centre beforehand. The key question is what happens after activation: who is contacted, how quickly can they attend, and can they enter safely with the correct keys and information?
Audit people, procedures and response arrangements
Many physical security failures begin with a process rather than a broken lock. Observe how visitors are greeted, registered and escorted. Contractors should be expected to sign in, wear suitable identification and have access limited to the areas required for their work. Reception staff need a clear way to challenge unfamiliar people politely and escalate concerns.
Review procedures for deliveries, post, waste collection and out-of-hours work. Delivery entrances are often busy and may be temporarily left open for convenience. Set clear ownership for these areas, particularly where multiple tenants, warehouse teams or third parties share a site.
Your emergency and incident response arrangements should be current, documented and understood. Verify contact numbers, alarm response instructions, site plans, access codes and escalation procedures. Ask whether nominated keyholders are genuinely available at night, during holidays and when senior staff are away. A policy that relies on one person travelling across the region at 2 am is unlikely to provide dependable protection.
For businesses that do not want staff attending alarm activations, an accredited security provider can hold keys, respond to alarm calls and report on site conditions. KCS supports commercial clients with key holding, alarm response, mobile patrols and vacant property inspections, providing an independent response arrangement when it is needed most.
Prioritise findings by risk, not appearance
Record each finding with its location, the weakness identified, supporting evidence and recommended action. Photographs can be useful where appropriate, particularly for damaged fencing, poor lighting or defective doors. Avoid treating every issue as equally urgent. A faded sign may be worth replacing, but a rear fire door that does not secure or a former employee retaining a master key needs immediate attention.
A simple priority rating should consider the likelihood of an incident, the likely impact and the effort required to correct the issue. Quick wins often include updating key registers, removing unauthorised access credentials, repairing door closers and clearing obstructed camera views. Larger investments, such as improved perimeter protection or a revised access control system, may require budget approval and a phased plan.
Assign an owner and completion date to every action. Without this, an audit becomes a document rather than an improvement programme. Recheck completed work in person and retain evidence of repairs, tests and access changes for management, insurers or compliance reviews.
Make auditing a regular control
Physical security changes whenever staff join or leave, buildings are altered, new equipment arrives or operational hours change. Carry out a formal review at least annually and after a significant incident, relocation, refurbishment or change in tenancy. Higher-risk premises may benefit from more frequent checks, including evening or weekend inspections.
The most useful audit leaves your team with certainty about who has access, how the building is protected and who will act if something goes wrong. That clarity is a practical form of peace of mind – and it is best established before an alarm sounds or a vulnerability becomes an incident.
