Office Security Audit Checklist

Audit five layers: entries (who can walk in), assets (what can walk out), procedures (what happens at open and close), people (who holds keys and alarms) and night cover (what protects the empty office). Most office breaches exploit the same gaps — unlogged visitors, shared keys, unwatched service entries and no closing routine. Walk the checklist below once a quarter and fix findings in priority order.

List every way in: main door, service entries, basement links, terrace access, windows near ledges. Check who holds keys or codes, when codes were last changed, and whether visitors are logged or waved through. Test the entry yourself as a stranger — if you can reach the work floor unchallenged, so can anyone. Entry discipline and access-control support are core to /services/business-security deployments.

Inventory what theft would hurt: cash and petty cash, laptops and devices, servers and backup drives, signed documents and client records, sample stock and display items. For each, note where it sits overnight and who can reach it. Server and record rooms need restricted access with a key log; devices need a sign-out register. Insurance inventories should match this list.

Review opening and closing routines, key-holding lists, alarm codes and their change history, ex-employee access revocation, vendor and housekeeping supervision, and the incident reporting chain. Interview the guard and the receptionist separately — if their versions of the procedure differ, you have no procedure, only habits.

Check | Pass looks like | Fail looks like Visitor logging | Every stranger logged with purpose | Wave-through at reception Key control | Named holders + change log | Shared keys, unknown copies Service entries | Locked + logged use | Propped open for convenience Closing routine | Checklist signed nightly | Lights-out-and-hope Night cover | Manned or verified patrol | Empty building, no checks Incident chain | Named contacts displayed | Nobody knows who to call Score each line pass or fail, then fix fails starting with entries and night cover. Campus-scale audits with account management are covered under /services/enterprise-security.

Empty offices are the real exposure. Verify shutter and lock checks, patrol frequency if guards are posted, alarm and sensor coverage of blind areas, and who responds to an alarm at 2 am. If the answer to the last question is nobody, that is your top finding regardless of everything else.

Once a quarter, test your own office: walk in as a stranger and see how far you reach, try the service entry and terrace door, ask for a key you should not get, and call the displayed emergency number after hours to see who answers. Log every breach without blaming the guard on the spot — the failure is the procedure's, not the person's. Share results with the team and fix the procedure first; retraining follows the fix, not the other way round.

Fix entries before cameras, night cover before decor, and key control before everything cosmetic. Priority one: stop unchallenged stranger access and secure the empty building at night. Priority two: key and code control with ex-employee revocation. Priority three: registers, reporting chains and review rhythms. Budget-constrained offices should price priority one as a standalone phase — a guarded gate and verified night cover transform the risk profile even before the full program is funded.

Every audit finding needs a named owner and a deadline: facility manager for locks and keys, IT for device registers, the guard supervisor for post discipline, HR for ex-employee revocation. Review open findings monthly until closed — audits without ownership become annual rituals that change nothing. File the audit with photos of each entry point and gate; next quarter's auditor compares against the file instead of starting blind. Ownership plus evidence is what turns a checklist into a security program.

Train reception as a security post, not just a welcome desk: challenge strangers politely, log every visitor with purpose and host name, hold deliveries at the desk instead of waving riders to floors, and never announce who is in which cabin to unknown callers. The receptionist and the guard should run one shared procedure — interview them separately during audits, because differing versions mean the procedure exists only on paper.

One: audit entries, assets, procedures, people and night cover. Two: test entries as a stranger. Three: mismatched staff versions of a procedure mean no procedure. Four: fix entries and night cover first. Five: repeat quarterly — offices drift.