Consider a commercial building that has been operating for several years. A routine credential audit might uncover active credentials tied to contractors who finished their engagements months ago, former employees, or individuals whose access is no longer necessary. The access control system processed every one of those credentials correctly. It opened the doors it was configured to open. The system was working. That was the problem.
Access control failures don't always start with a malfunctioning reader or a failed controller board. They can start with the operational layer: the policies, processes, and ownership structures that determine how the system is managed after installation. Even when the technology functions as intended, gaps in how it is managed can create security risks.
The credential that keeps working
Every organization issues credentials at a predictable rate. New hires, temporary contractors, visiting vendors, consultants brought in for a specific project: each gets a badge, and the system records it. Deactivation can be far less systematic. When an employee leaves, HR processes the paperwork. If the access control database sits under facilities management or IT, the notification may never travel that far. The badge gets surrendered at the front desk, or it doesn't, and the credential stays active either way.
Contractors compound the problem. A vendor who accessed your mechanical room for a two-day inspection in March may still hold a valid credential in November because the work finished, everyone moved on, and nobody owns the cleanup. Multiply that across years of vendor relationships, and the access list can drift far from reality. The gap between who your system thinks can enter your building and who actually should may be larger than anyone realizes until something prompts an audit.
Permission drift
Even among active employees with current, legitimately issued credentials, access levels change over time and don't always get reviewed. Someone who worked in a sensitive operations role and later moved to a different department may still carry access to spaces they haven't needed in years. Someone who received temporary access to a restricted area for a specific project may retain that access long after the project closed because nobody reviewed it at completion.
This matters because access control is only as effective as the accuracy of its permission structure. A card reader correctly identifying a valid credential is doing exactly what it was designed to do. It has no way to know that the person presenting the credential hasn't needed access to that building zone for three years. That knowledge has to exist somewhere else in the organization, which means someone has to maintain it.
Access level reviews help catch this problem. They need to happen on a defined, risk-appropriate schedule, with a named person who has authority to make changes, rather than a process requiring three departments to coordinate before anything gets updated.
Hardware that degrades quietly
Access control hardware can also develop problems that aren't immediately obvious. Electric strikes and locking mechanisms may experience wear, misalignment, or inconsistent operation. Card readers can develop intermittent misreads that appear in system logs but go unnoticed. Door contacts may shift out of alignment, causing occasional incorrect door-status readings. In facilities where hardware maintenance is reactive (waiting for someone to report a problem before dispatching service), these issues can accumulate until they produce a visible incident.
The harder issue is that degraded hardware can still appear to function. A door with a misaligned locking mechanism may close normally most of the time. A reader with an intermittent fault may continue granting access during routine use. Problems may become more apparent under heavy traffic, environmental changes, or repeated operation. By then, a minor maintenance issue may have developed into a larger security concern.
Scheduled preventive maintenance on access control hardware is generally straightforward, but it requires a defined program: appropriate inspection intervals, checks of locking hardware and door alignment, reader functionality testing, and verification of door contacts and system alerts according to equipment requirements. Reactive maintenance is not a substitute.
The ownership gap
What connects these three failure modes is the same underlying condition: unclear ownership. In many commercial facilities, access control is someone's responsibility in a general sense but no one's job in a specific sense. Credential issuance happens through HR. Deactivation requires a facilities request. Hardware maintenance is a budget item that competes with everything else. Access level reviews require HR, IT, and security to coordinate, and that meeting may happen infrequently, if at all.
The practical fix requires naming owners, not necessarily upgrading hardware. Someone specific should own the credential lifecycle: who creates credentials, who deactivates them, and what event triggers deactivation. Someone should own the access level review schedule, conduct reviews at intervals appropriate to the facility's risk, and have the authority to make necessary changes. Someone should own preventive hardware maintenance rather than waiting for a report that a reader isn't working.
For organizations with the internal capacity to maintain this consistently, it is a process problem with a process solution. For others, maintaining consistent access management can be difficult alongside competing operational responsibilities. That is where managed or co-managed access control services can help: supporting credential administration, scheduled reviews, system monitoring, and preventive maintenance according to the organization's needs and service agreement.
At Southeastern Security Professionals, we help organizations design, install, and support commercial access control systems while providing ongoing service and management options that fit their operations.
The access control hardware may be working exactly as intended. The question worth asking is who owns the work that keeps the entire system secure.