A physical security audit is a walk with a clipboard and a grudge. You are looking for the gap the client has stopped seeing: the gate that stopped latching in spring, the camera aimed at a wall, the badge that still opens the server room.

Walk the perimeter, the access points, the cameras, the alarms, the interior, life safety and the procedures, in that order, using the same list every time. Test rather than observe: pull the door, ask for playback, check the extinguisher tag. Then write each finding as location, condition, consequence and fix, graded by risk.

An audit of a workplace is partly a life safety audit. Several items below are federal OSHA requirements, not best practice, and they go in the report even if the client only asked about theft.

How do you run the audit so the findings mean something?

Walk it twice. Daylight shows fence condition and sightlines. Darkness shows which lights are out and which cameras relied on ambient light nobody costed.
Test, do not observe. Pull the door instead of looking at the lock. Ask the client to play back yesterday afternoon instead of watching the live wall.
Photograph as you go, and grade every finding. A photo ends the argument about whether the gap is a gap; an ungraded list of forty items gets none fixed.

For a new-contract proposal the emphasis shifts toward scope and staffing; the site security assessment checklist covers that. CISA also fields Protective Security Advisors who help critical infrastructure owners with vulnerability assessments at no cost.

What do you check on the perimeter?

The property line is the first thing an intruder deals with and the last thing anyone maintains. Walk the whole boundary, back corners included; what looks intact from the main entrance often is not.

Fencing and barriers

A distribution yard and a residential community need different answers here.

☐ Fence height matched to the threat and consistent, with no gaps, cuts or bent sections

☐ Bottom edge secured against crawling under, including where grading has eroded

☐ Gates latching and locking, hinges intact, no sag

☐ Vehicle barriers matched to the threat: bollards, planters, wedge gates

Perimeter lighting

Lighting degrades silently. Nobody reports a burned-out pole light, and a year later half the lot is dark. Assess this section after sunset only.

☐ All perimeter areas illuminated, checked at night, with no dark pockets or blind approaches

☐ Fixtures aimed to light the ground, not to blind the observer or the camera

☐ A lamp replacement routine that exists and is followed

Landscaping

The landscaper and the security consultant have opposite goals. Mature planting is where concealment comes from.

☐ No concealment near entrances, windows or ground-floor glass

☐ Trees trimmed clear of fence lines, roof edges and balconies

☐ Sightlines from the guard post and cameras still intact after growth

☐ Nothing climbable near the fence: benches, dumpsters, pallets, stacked material

How do you evaluate access control?

Audit the decisions about who goes where and the machinery that enforces them. A perfect reader on a door with a soft frame is a decorative reader.

Entry points

☐ Every entry point identified, including roof hatches, utility doors and delivery openings

☐ Doors and frames sound, no warping, no spread at the strike

☐ Non-removable hinge pins outside, strike plates anchored into the framing

☐ Glazing matched to the risk: laminated, tempered, or filmed

☐ Emergency exits alarmed and non-openable from outside

Electronic access control

The system is usually fine. The administration is not. Ask for the credential list and compare it against the current employee roster before you look at any hardware.

☐ All readers and controllers responding, on backup power as well as mains

☐ Credentials for departed staff and finished contractors deactivated, with dates

☐ Access levels reviewed within the last year and still matched to roles

☐ Audit trails generated, retained, and actually read by someone

☐ Fail-safe or fail-secure behavior on each door matched to whether it is a life safety egress

That last item is where security and life safety collide, so resolve it with the fire marshal rather than in the report. More in access control beyond badge readers.

Key control

Mechanical keys outlive the electronic systems installed to replace them, and a loose master key defeats everything above it.

☐ Key inventory current, with every key physically accounted for

☐ Keys stored in a locked cabinet when not issued

☐ Issue and return logged with a signature and a date

☐ A written rekey trigger for a lost key, and evidence it has been used

☐ Master key holders documented and reduced to the minimum

With no written policy behind that list, attach the key control policy template to the finding.

Does the camera system actually do anything?

Cameras get installed once and audited never. Three failures recur: coverage that no longer matches the layout, silent recording failure, and footage nobody can retrieve.

Coverage

☐ Critical areas covered: every entrance and exit, high-value storage, cash handling

☐ Parking covered to the perimeter, not just the aisles near the door

☐ No blind spots from new obstructions, shifted mounts or failed units

☐ Image quality good enough to identify a person, verified at night

Functionality

Do this with the client next to you. Pick a random hour from two days ago and ask them to pull it up.

☐ Every camera live with a clear image, not just a green light on the NVR

☐ Recording confirmed as continuous, with no gaps in the last week

☐ Retention long enough for the client's realistic discovery window

☐ Playback demonstrated by the person who would have to do it under pressure

☐ Export produces a file somebody else can open, and remote access is restricted

☐ Backup power keeps the recorder running, not only the cameras

Retention length is a business decision: however long it takes the client to discover the loss they actually suffer, plus a margin. Video analytics for security covers the rest.

Is the alarm system real?

An alarm that false-activates gets ignored; an alarm nobody tests fails silently. Both end in the same place.

Detection coverage

☐ Intrusion detection on every vulnerable opening, glass break on vulnerable glazing

☐ Interior motion coverage in the paths between openings and valuables

☐ Panic and duress devices present, working, and known to the staff who would use them

☐ Roof access, mechanical rooms and utility spaces covered

System integrity

☐ Testing performed on a schedule and documented

☐ No zones bypassed or shunted "temporarily"

☐ Signal path verified end to end, with a second path if the primary is a phone line

☐ Codes managed, and changed after every departure

What needs protecting inside?

Layer interior protection by what a space contains: what a person could take, damage or reach from it.

☐ Server rooms and IDF closets on separate access control with their own audit trail

☐ Cash handling areas protected to the amount actually held

☐ Pharmaceutical, chemical and controlled substance storage secured to the applicable regulation

☐ Inventory and warehouse controls sufficient against internal loss, not only external

☐ Safes and vaults rated for what is in them, and anchored

☐ Offices secured after hours, documents and portable IT locked when unattended

☐ Visitor access controlled, escorted where required, and logged

Visitor handling fails most often, because it depends on a person at a desk making a judgment. A visitor management SOP is the usual remediation.

What does life safety add to a security audit?

The federal floor, which is not optional and not the client's opinion. Three OSHA standards drive most of what a walk turns up.

Under 29 CFR 1910.37, exit routes must be unobstructed, with nothing stored in them even temporarily, and sprinklers, alarms, fire doors and exit lighting must be in working order. Each exit needs an illuminated sign, and any doorway that could be mistaken for one has to be marked as not an exit.

Under 29 CFR 1910.157, portable extinguishers must be mounted, identified and accessible, kept charged and in their designated places, inspected visually every month, and given a dated annual maintenance check.

Under 29 CFR 1910.38, a required emergency action plan must be written, kept in the workplace, and cover reporting an emergency, evacuation and exit route assignments, who shuts down critical operations, how people are accounted for, what rescue and medical personnel do, and who to ask about the plan.

☐ Exit routes clear, with nothing stored in them even briefly

☐ Exit signs present and illuminated, and non-exit doors marked as such

☐ Fire alarm and sprinkler systems tested and current on inspection

☐ Extinguishers accessible, charged, in place, with a monthly inspection and a dated annual check

☐ Emergency lighting functional on the actual battery, not on mains

☐ A written emergency action plan on site, covering all six required elements

☐ Assembly points designated, drills documented, and arrangements for people who cannot use stairs

The client-facing version belongs on a wall, not in a binder: see the emergency response quick reference.

Which operational gaps do audits miss?

The ones that are nobody's equipment. Hardware gets replaced because someone can point at it; procedure rots quietly.

☐ Security policies written, current, and findable by the people they govern

☐ Visitor procedures followed at 4pm on a busy Friday, not just described

☐ Contractor access controlled, badged and escorted per the policy

☐ After-hours access procedures enforced rather than posted

☐ Background screening at the level each role requires, and a termination checklist that revokes access the same day

☐ Incident reporting known to staff, with evidence anyone has used it

Test procedure by watching it under load. Standing in the lobby at shift change beats reading the policy, which is the logic behind a security post inspection.

How do you write findings that actually get funded?

"Improve perimeter security" buys nothing. A finding is four things, and it needs all four.

Location, specific enough that a facilities tech can walk to it: "northeast fence line, 40 feet east of the maintenance gate."
Condition, what you observed, with the photo attached.
Consequence, what it lets somebody do. This is the sentence that gets the fix funded, and the one most reports leave out.
Remediation, a specific fix with a rough cost if you can give one.

Then grade it, so the client knows what to do first.

Priority	Target	Meaning
Critical	Immediate	Actively exploitable now, or a life safety violation
High	30 days	Serious weakness that needs a funded plan
Medium	90 days	Real gap, or a meaningful improvement
Low	When convenient	Minor issue or good practice

Then book the re-walk. Findings never re-checked teach the client that audits are a document, not a process.

Key Takeaways

Walk the site twice, once after dark. The two visits find different problems.
Test rather than observe. Pull the door, request playback, check the extinguisher tag.
Compare the access credential list against the current roster before you look at a reader.
Blocked exits, inaccessible extinguishers and a missing action plan are OSHA violations, not preferences.
Write findings as location, condition, consequence and fix, graded by risk. Consequence gets it funded.

An audit of a workplace is partly a life safety audit. Several items below are federal OSHA requirements, not best practice, and they go in the report even if the client only asked about theft.

How do you run the audit so the findings mean something?

Walk it twice. Daylight shows fence condition and sightlines. Darkness shows which lights are out and which cameras relied on ambient light nobody costed.
Test, do not observe. Pull the door instead of looking at the lock. Ask the client to play back yesterday afternoon instead of watching the live wall.
Photograph as you go, and grade every finding. A photo ends the argument about whether the gap is a gap; an ungraded list of forty items gets none fixed.

What do you check on the perimeter?

The property line is the first thing an intruder deals with and the last thing anyone maintains. Walk the whole boundary, back corners included; what looks intact from the main entrance often is not.