The Badge That Outlasts the Contract: Reconciling Leavers to the Access Control Register

Why a leaver is an access control event

In most UK facilities, a leaver triggers a predictable sequence: payroll closes, IT suspends the network account, HR files the paperwork. The physical badge is often handled separately, sometimes by a line manager, sometimes by reception, sometimes not at all. That separation is where risk accumulates. A card returned on a Friday can sit in a drawer for a week before anyone deactivates it; a contractor badge may never be returned; a visitor pass may remain active because the host forgot to sign it out. None of these events is dramatic on its own. Together they create a population of active credentials that no longer correspond to a legitimate holder.

The audit question is not whether the site has a deactivation policy. It is whether the site can demonstrate, for a given date, that the people holding active credentials were entitled to them. That requires a reconciliation between the authoritative HR record and the access control system, supported by evidence that exceptions were investigated and closed.

Start with the authoritative list

Access control audits fail when they start with the cardholder database. The database is the thing being tested, not the source of truth. The starting point should be the HR leaver report for the period under review, supplemented by contractor end dates from the purchasing or facilities contract register, and visitor records from the front-of-house system. These are separate lists, and they will not agree. The disagreements are the audit findings.

For each leaver, the audit trail should show the date employment ended, the date access was removed, the credential or credentials affected, and the person who authorised and performed the removal. Where a leaver retained a card for a legitimate reason — a notice period, a phased return, a consultancy arrangement — the file should record that decision and its expiry. An open-ended exception is not an exception; it is an uncontrolled credential.

Reconcile, don't just revoke

The instinct when a ghost credential is found is to revoke it immediately and move on. That closes the technical issue but not the audit issue. A revocation without a record explains nothing about how the credential survived, whether it was used, or whether other credentials from the same source are also active. The better approach is to reconcile first, then revoke as a controlled action. The reconciliation should match HR identifiers to cardholder records, not just names. Name matching is unreliable in any organisation with common surnames, rehires, or contractors who share a first name. Employee numbers, contractor references and start/end dates should be used wherever the systems allow.

Last-used reports: evidence of dormancy, not proof of absence

Many access control systems can produce a last-used report by cardholder or by door. These reports are useful, but they are often over-read. A card with no recent use is not necessarily a card that has been lost; it may belong to a member of staff who works in an area without readers, or a contractor who attends only for annual maintenance. Equally, a card with recent use may be in the hands of someone who should no longer hold it. Last-used data is therefore a triage tool. It helps prioritise which credentials need a human check, but it does not replace the reconciliation against HR and contract records.

The audit file should show how last-used reports were used: the date range reviewed, the thresholds applied, the population of dormant credentials identified, and the outcome of each check. A report printed and left in a folder is not evidence of a control. A report with a short commentary explaining why each exception was closed is.

Access-level reviews expose the orphaned credential

Leaver reconciliation catches people who have left. Access-level reviews catch a different problem: people who are still employed but hold access they no longer need. A maintenance engineer who transferred to another site six months ago may still hold a master key group. A project manager who finished a fit-out may still have access to the plant room. These are not leavers, but they are orphaned credentials in everything but name.

A periodic access-level review should test a sample of cardholders against their current role, not their role at induction. The review should be signed by the line manager or budget holder who can confirm the requirement, and it should record any access removed as a result. In UK operations, this is particularly relevant for contractor credentials, where the contract may have ended without the individual leaving the site entirely. Contractor Governance and Compliance & Audit overlap here; the practical control is the same.

Deactivation as a controlled process

Removing a card should be treated as a security change, not an IT chore. That means a defined request route, an approval step, an execution step and a verification step. The request should identify the holder, the credential and the reason. The approval should come from someone with authority over the site or contract. The execution should be performed by a named administrator and logged by the system. The verification should confirm that the credential no longer grants access — not merely that a tick box was completed.

For sites with multiple systems — door controllers, visitor management, car park barriers, lift access — deactivation must cover every system where the credential exists. A common audit finding is a card disabled in the main access control system but still active in a standalone visitor or car park system. The deactivation record should list the systems checked, not just the primary one.

The audit file: what good looks like

A defensible audit file for leaver and ghost credential control contains four things. First, the source lists: HR leavers, contractor end dates and visitor records for the period. Second, the reconciliation: a matching exercise that shows active cardholders against those lists, with exceptions identified. Third, the evidence of action: deactivation records, access-level review sign-offs and last-used commentary. Fourth, the exception log: any credential that could not be closed, why, and what compensating control applies.

None of this needs to be elaborate. A quarterly routine with a clear owner, a fixed data set and a short management summary is more useful than an annual panic. The point is to make the control visible before an auditor asks for it.

A quarterly routine, not a spring clean

Access control is a living system. People join, leave, change roles and return as contractors. The register will always drift. The control that keeps it defensible is not a perfect database; it is a repeatable reconciliation that produces evidence. In 2026, with hybrid working and high contractor turnover, the ghost credential is less an anomaly than a predictable by-product of normal operations. Treat deactivation as a security control with an evidence trail, and the badge that still works becomes a finding you can close — not one that closes the audit for you.