The Credential Nobody Signed For: Bringing Unissued Access Cards Under Control

Access control audits tend to follow people. Joiners are added, leavers are removed, contractors are sponsored and time-limited. The credential stock that sits outside that lifecycle — the cards, fobs and tokens bought for contingencies and never allocated — is often left to a drawer and a memory. That is a compliance gap, not a housekeeping issue.

In 2026, client audits and insurance reviews are less likely to ask whether an organisation has a policy for access credentials. They are more likely to ask for evidence that the policy was operated. An unissued credential with no named custodian is difficult to evidence at all. The practical answer is not another document. It is a stock-and-owner check that can be repeated, signed and produced.

Why an unissued credential is still a live risk

An access card is a physical key with a database record attached. If it is never issued, the system may show it as dormant, but the plastic in the drawer can still be activated by anyone with sufficient system access. It can be loaned informally, carried off site, lost, or copied. The audit trail for that credential begins at activation, not at the point it left the supplier. That gap matters when a client asks who has held the organisation’s access devices, or when an insurer tests the control environment behind a theft or unauthorised entry claim.

The same logic applies to temporary passes and contractor fobs held ‘just in case’. If the stock is not counted, it cannot be reconciled. If it is not reconciled, it cannot be shown that the credentials in circulation match the credentials in the system. An unowned credential is an unmanaged one.

Count the stock before touching the system

Start with a defined scope. List the credential types in use: staff cards, contractor fobs, visitor passes, temporary tokens and any mechanical keys that are tracked alongside the access control system. Decide which ones fall inside this check and which are covered elsewhere. Ambiguity at this stage produces arguments later.

Count the physical stock in one session, ideally with two people present. Record the date, time, location and the names of the counters. Where credentials carry individual serial numbers, record them or record the ranges held. Where they are held in batches, record the batch identifiers and quantities. A photograph of the stock layout is useful supporting evidence, but it does not replace the count sheet.

The count should include the obvious storage point and the less obvious ones: reception drawers, security control rooms, facilities offices, contractor sign-in points and any satellite sites. The objective is to establish what exists physically before comparing it with what the system says exists.

Reconcile against the access control system

Export the credential records from the access control system. At minimum, the export should show the credential identifier, current status, assigned user or holder, issue date and any history of suspension, loss or replacement. Compare that export with the physical count.

The reconciliation will usually produce four categories:

• Credentials physically held by a named user and shown as active in the system.
• Credentials physically in stock and shown as unissued or dormant.
• Credentials shown in the system as issued or active but not physically accounted for.
• Credentials physically present but not found in the system, or found in the system but not physically present and not assigned to a user.

The last two categories are the exceptions. They need investigation and closure, not just a note in the margin. A credential that is physically present but shown as active may indicate a record that was never updated. A credential that is missing and unassigned may indicate loss, theft or an informal loan that was never recorded. Both are audit findings.

Put a name against every credential

Every credential should have either a named holder or a named custodian. The holder is the person entitled to use it. The custodian is the person accountable for its storage and movement while it is not issued. For stock, the custodian may be a role rather than an individual, but the register should still name the person currently performing that role.

Where credentials are retained as spare stock, set a minimum and maximum quantity and record the reason for holding them. ‘Just in case’ is not a reason that survives an audit. If the stock level is not justified, reduce it. Where credentials are withdrawn from stock for temporary use, record the issue and return in the same way as a permanent allocation. The fact that a credential is expected to come back does not remove the need for a record while it is out.

Credentials that are obsolete, damaged or no longer compatible with the system should be disposed of through a recorded process. That record should show the credential identifiers, the quantity, the date, the method of destruction or return, and the person who authorised it.

Make the quarterly check auditable

A quarterly stock-and-owner check is more useful than another policy document because it produces dated evidence. The check does not need to be elaborate. It needs to be consistent.

A one-page register can carry the date, the counters, the stock location, the credential identifiers or ranges, the system totals, the exceptions found, the actions taken and the signatures. The supporting file should include the system export, the count sheet, any photographs and the disposal records. If an exception is closed, the closure should be recorded with the date and the person responsible.

The check should also be repeated after significant changes: a site move, a contract transition, a system upgrade or a change of security provider. Those are the moments when stock is most likely to be moved without a record.

What the evidence file should contain

For each check, keep a small, defensible pack:

• The signed count sheet showing date, time, location and counters.
• The access control system export used for reconciliation.
• The stock register showing named custodians and quantities.
• The exception log showing what was found and how it was closed.
• Disposal or return records for credentials removed from stock.
• A short statement confirming that the reconciliation was completed and reviewed.

That pack answers the question an auditor or insurer is likely to ask: can you show that the credentials you hold are the credentials you think you hold, and that someone is accountable for them?

The policy is not the proof

A policy can describe how credentials should be controlled. It cannot demonstrate that the drawer has been counted, that the system export matches the stock, or that a missing fob was investigated. The quarterly check does that. It is a small control, but it closes a gap that many access control audits leave open.

For UK facilities and security teams, the value is in the repetition. A check completed once is a project. A check completed every quarter, signed and filed, is evidence of operation. That is what client audits and insurance reviews are designed to test.