First Impressions, Last Defence: Testing Reception's Entry Controls

Reception is often the only physical control between the street and the workplace. Yet many organisations treat the visitor book as though it were the control itself. A book is a record. Control is the sequence of decisions and actions around it: challenging an unfamiliar face, confirming identity and purpose, checking with a host, issuing a badge, recording departure, and being able to account for visitors during an evacuation. If any part of that sequence is missing, the book creates an impression of security rather than the substance of it.

A record is not a control

The distinction matters because it changes what a manager should test. Reading the visitor book tells you who signed in. It does not tell you whether anyone would have stopped a person who did not. It does not show whether a contractor was expected, whether a host confirmed the visit, or whether reception could produce an accurate list if the fire alarm sounded. A short, low-disruption exercise can answer those questions more usefully than a paperwork review.

The aim is not to catch reception staff out. It is to find where the process breaks between intention and practice, and to leave behind a small set of fixes that reception, facilities and site security can own.

Set up a low-risk test

Choose a quiet mid-morning slot, avoiding the Monday rush, lunchtime and any known deliveries. Tell the facilities lead or site manager that a test will take place, but do not brief reception. The point is to see the normal process, not a rehearsed version. Keep the exercise to about twenty minutes and do not interfere with genuine visitors or fire safety arrangements.

Present your real name and organisation. The test is whether the process is followed, not whether staff can be deceived by a false identity. If you are challenged, comply fully and note how the challenge was handled. If you are not challenged, continue politely through the normal visitor route and observe what happens. Do not attempt to enter restricted areas, take photographs of personal data, or create a security incident.

What to observe at the door

At the front desk, note whether anyone looks up and acknowledges you. Does reception ask your name, organisation and the person you are visiting? Is the host contacted before you are allowed further? Are you asked for identification, and is that requirement consistent with the site's written visitor policy? Not every workplace needs photographic ID for every visitor, but the process should be clear about when ID is required and why.

Watch how the visitor book is used. Is it completed by reception or by the visitor? Does it capture arrival time, host, purpose and departure time? Is a badge issued, and is it visible? Are you escorted or given directions into the building? Tailgating is a useful observation: if someone follows you through a controlled door without challenge, note it without attempting to test the door itself.

Contractors deserve a separate look. A contractor sign-in should usually confirm the company, the person expected, the work area and any site induction or permit requirements. Rather than inventing a contractor visit, review the last twenty contractor entries with the facilities lead or walk through the process with a known contractor. Check whether reception can distinguish a contractor from an ordinary visitor and whether the contractor list is kept separately for evacuation purposes.

The evacuation question

Ask reception a direct question: if the alarm sounded now, how would you account for visitors in the building? Can they produce a current list quickly? Does the book record departures, or only arrivals? Are contractors included in the same list, or held on a separate sheet that the fire marshal may not have? Is the list available at the assembly point or from a nominated person?

A tabletop check is usually enough. Ask reception to show how they would generate the list and how long it would take. If the book shows arrivals but not departures, the list will overstate the number of people inside. If visitor badges are not returned, the same problem appears in reverse. The test should end with a clear answer, not a reassuring assumption.

Personal data at the front desk

Visitor books often contain more personal data than managers realise: names, employers, host names, vehicle registrations, telephone numbers and arrival times. Under UK GDPR, the organisation needs a lawful basis for collecting that information, should collect only what is necessary, should tell visitors how it will be used, and should keep it no longer than needed. In practice, the front desk is where those principles either hold or fail.

Check whether the book is left open on the counter where other visitors can read it. Is it stored securely at the end of the day? Does the site have a retention period, or are old pages kept indefinitely? Is there a short privacy notice visible to visitors, or a line in the sign-in process explaining the purpose? Do not photograph or copy completed pages during the test. Record observations and counts instead.

The one-page fix list

End the exercise by writing a single page with five columns: observation, risk, owner, action and review date. Typical entries include no host confirmation before entry, no departure time in the visitor book, contractor and visitor lists kept separately, no visible privacy notice, or badges not returned at exit. Keep the language factual and avoid attributing blame to individual reception staff.

Separate fixes into same-day, two-week and quarterly actions. Same-day fixes might include moving the book out of public view, adding a privacy notice and briefing reception on the host-confirmation script. Two-week actions might include revising the visitor form to capture departure time and aligning contractor sign-in with the evacuation list. Quarterly actions might include a visitor-inclusive evacuation drill and a repeat of the twenty-minute test.

A visitor book has a legitimate place. It supports evacuation accounting, provides an audit trail and helps a host know who is expected. But it cannot challenge an uninvited person, verify a contractor's credentials or decide whether a host has agreed to a meeting. Those are human and procedural controls. A short test at the front desk shows whether they are working, and a one-page fix list gives the site something practical to act on before the next unexpected arrival.