In my line of work, I spend a lot of time on the road visiting customers. Hanging around in a corporate lobby waiting for my host to arrive is an everyday occurrence. So, for better or worse, I have a good deal of experience in how corporations handle visitors.
Out of 10 companies I might visit, I am lucky if one painlessly verifies my identity and issues a personalized visitor credential. Most have me sign the old paper log, assume I must be who I say I am, and hand me a dog-eared visitor badge left over from the Nixon administration. At least one or two out of the 10 doesn’t even use a log book; just a wave to “come on back.” Let’s just say that visitor management is pretty low on the list for most companies.
This always strikes me as strange since the vast majority of the companies I visit are in the security business. It seems they should know better since securing the lobby has been a first line of defense since the dawn of the industrial age. Perhaps that is the issue — we have been doing it for so long we have forgotten why, and a reminder is required. So without further ado, here are the top five reasons why you should consider improving your visitor management and purchasing a computerized system:
1. You need to have a record of who is in your building.
Let’s start with the basics: why do we care? For some companies, it is a matter of compliance. Sarbanes-Oxley, for example, requires public companies to report on the adequacy of their internal control over financial reporting. Those controls are typically taken as control over information systems, but it will be hard to prove if the auditors see loose controls over visitors to the data center. Similarly, companies many be bound by other regulations such as HIPAA or CFATS (Chemical Facility Anti-Terrorism Standards) that can require control over who can access a facility and when. This is not, however, an issue that is brought about by U.S. regulation. “We are seeing global demand and are now providing our system in five languages,” says Paul Terschuren, vice president of Sales and Marketing for STOPware, a supplier of visitor management systems.
Even if regulatory compliance is not an issue for your firm, avoidance of legal liability is. Failure to provide a safe workplace is a lot harder to prove if a company has taken reasonable steps to provide access and visitor control. In addition, almost any company has intellectual property, private data or high-value assets that may be available to any visitor who finds himself in the right place at the right time. Without accurate records, there is no hope of recovery.
2. No one else should know who is in your building
One of the areas often overlooked by companies with a paper log book is loss of privacy. Any salesperson can tell you that the visitor log is an invaluable source of information and can tell quite a story about the deals a company is pursuing or what competitors may be bidding on a job. In the case of a multi-tenant facility, these privacy concerns can create a real liability for the landlord that can outweigh the need for security.
This is a concern that completely goes away with an automated system, since the history data in the system will not be available to any visitor. “Information about who is visiting you should be confidential,” says Howard Marson, CEO of Easy Lobby. “It’s not (confidential) with the paper book — everybody looks through it”
3. A paper log says “I never really intend to look at this again”
Have you looked at your paper log lately? How many of the names are legible? Are the purpose of the visit and the host’s name filled out? How about the arrival and departure times? Most people fill out the arrival time, but hardly anyone bothers on the way out. Even if they did, the times are notoriously inaccurate and certainly not verifiable.
If your procedure calls for verifying identity with a driver’s license, can you prove the procedure was followed? What about the logs themselves? Do you know where all old logs are? Has anyone “accidentally” removed a page? Are there back-up copies off-site? Are you gathering all of the data you should be gathering, or are you limited by the log you use and the time it takes to fill it out? How long does it take you to search through the data to find the entries you need?
If you are not sure about the answers to any of these questions, stop and think about the risk you are placing your company under if an incident does occur. A simple electronic visitor log program can solve all of these issues.
4. Many of your visitors are customers
One of the key reasons companies are moving to visitor management systems and away from paper logs is the impression it makes on their customers. Not only do the badges have a professional look and the potential for personalization with a photo, but the lobby process leaves the right impression. A company with long lines of visitors waiting to check in starts out a visit on a really bad note. Having Bob the security guard misspell your customer’s name is even worse.
In fact, one of the best features of these new systems from both a security and an image point of view is the ability to scan a Driver’s License or Passport automatically. Not only is the information correct and complete, it is much faster than typing. “A scan of a license can be completed in about ten seconds” Marson says.
Having the capability to allow the visitor to self-enroll is another feature that many new systems have that leaves a high-tech impression on visitors. Even if it is followed up with an ID verification and badge printing a guard station, the overall process will be faster, more reliable and less of an aggravation for the visitor.
Customers or not, you also have a responsibility to protect visitors. In the event of an emergency, you have the responsibility to ensure that all employees and visitors have been marshaled to a safe area. Visitors represent a significant issue since they will have no idea what the proper evacuation procedures are. Additionally, you want to make sure none elect to remain inside with your assets while they are unsupervised.
While visitors can be accounted for using a paper log — the log must be available at potentially multiple marshaling points outside, and the information it contains must be correct. Both assumptions are easier to accomplish with a computerized visitor system.
5. Some of your visitors may not be friends
Visitor management systems have capabilities far beyond those of the paper log, and those features can make an enormous difference in your overall security. Take for example, the ability to screen visitors using a watch-list. This capability is becoming very popular in the educational sector using a sexual predator list. It also has obvious applications in the government space using terrorist watch-lists. In the commercial arena, this capability can be used with internally generated lists such as terminated employees. “We also have customers that turn that idea around and use the watchlist capability to give VIPs special treatment,” Terchuren says.
Most systems today also allow the option of visitor pre-enrollment using either a link to the company’s Outlook system, or an internal Web page. This can be a significant security improvement, since all visitors must be invited by an employee of the company. It is certainly possible to pre-approve visitors using a manual system, but it would be inefficient, error prone and require far too much lead-time to be practical.
It is also now possible to allow the use of visitor management systems by mobile guards. “We have all of our systems available on handhelds so they can be used at the guard shack, a gated facility, a distribution center or a warehouse,” Marson says.
A visitor management system also allows a user to require each visitor to execute a legal document such as an NDA or a general release. In a high-tech design company, executing an NDA with each visit is a standard practice, and reminds the visitor that the company considers all disclosure as confidential.
Logging meetings, dates and attendees can also be very useful in disputes over intellectual property. In the case of manufacturing or process plants, executing a general release helps the company avoid liability for accidents by making it clear the visitor knew the risks of being on premises. In the case of either the NDA or general release, the visitor management system makes it practical to consistently execute these types of documents and retrieve them on demand.
If your company is like many that I visit, maybe it’s time to have another look at the way you deal with visitors. Not only can you improve security, make your investigations easier and lower your risk, but you have a real chance to enhance your company’s image with its customers.
Rich Anderson is the president of Phare Consulting, a firm providing technology and growth strategies for the security industry. A 25-year veteran of high-tech electronics, Mr. Anderson previously served as the VP of Marketing for GE Security and the VP of Engineering for CASI-RUSCO. He can be reached at [email protected].
