Access control audit trails: who opened which door?

A modern access control system does more than open doors. It records who went where, when, and whether the door was opened or refused. That record is often the difference between a quick resolution and a costly dispute.

What an audit trail actually records

• Credential - card, fob, mobile credential or PIN.
• Door - which reader or door was used.
• Time - date and time, synced to a reliable clock.
• Result - granted, denied, door held open, forced open or tamper.
• User - the person or contractor the credential belongs to.

Good systems also record failed attempts, door-held-open events and changes to user permissions. Those events are often more useful than the successful entries.

Why building managers need it

When a resident reports a theft, a car park incident or a contractor dispute, the first questions are usually: who had access, when, and did the door actually close? An audit trail answers those questions with evidence instead of recollection.

It also helps with insurance claims, police requests, strata disputes and routine contractor management. Instead of re-keying an entire building, you can disable one credential and see exactly where it was used.

Anti-passback and tailgating

Audit trails become more useful when the system enforces rules. Anti-passback prevents one credential being used twice without an exit, and tailgating detection flags doors that stay open or are forced. These events can trigger alerts to building management, especially after hours.

No system can eliminate tailgating at a busy lobby, but a combination of door hardware, reader placement, signage and reporting makes it easier to spot and manage.

Reports that are actually read

• Daily exception report - forced doors, held doors, denied access.
• Contractor report - who entered plant rooms or restricted areas.
• After-hours report - access outside agreed hours.
• Credential review - active fobs and users that should no longer have access.

A report that nobody reads is not a control. Agree a short weekly or monthly review with your building manager or concierge, and act on the exceptions.

Privacy and retention

Access records are personal information. Limit who can run reports, keep retention aligned with your policy, and avoid using the system to monitor staff or residents beyond a legitimate security purpose. If you use mobile credentials, make sure lost or replaced phones can be revoked immediately.

WIS Security designs and supports access control for Melbourne apartments, offices and commercial buildings. See our access control service or request an assessment.

WIS Security designs, installs and supports security systems across Melbourne. See our access control service or request a free assessment.