Product Overview

Summary: This Access Control and Security Measures SOP sets out a clear, repeatable system for managing who can enter your workplace, when, and under what conditions. It helps Australian businesses protect workers, visitors, information and assets by integrating physical security, visitor management and WHS duty of care into one practical procedure.

Unauthorised access to workplaces is a growing risk in Australia, with potential consequences ranging from theft and vandalism through to assaults, data breaches and serious WHS incidents. This Access Control and Security Measures Safe Operating Procedure provides a structured, end-to-end approach to controlling physical access to your premises, work areas and sensitive information. It covers the full lifecycle of access management, including issuing and revoking access cards or keys, managing visitors and contractors, securing critical areas, and responding to security breaches or suspicious behaviour.

The document is designed for organisations that need to demonstrate strong governance over who is allowed on site and how they are managed once inside. It helps you integrate your security controls with WHS obligations, emergency management arrangements and privacy requirements. By standardising access control processes across all sites and shifts, this SOP reduces reliance on informal practices, supports consistent induction and training, and provides clear evidence of due diligence if an incident occurs or a regulator makes enquiries.

Key Benefits

• Strengthen protection of workers, visitors and assets through clearly defined access control rules and responsibilities.
• Ensure compliance with WHS duties, privacy obligations and security expectations for Australian workplaces.
• Reduce the likelihood of theft, violence, vandalism and unauthorised entry by standardising access permissions and monitoring.
• Streamline visitor and contractor sign‑in processes, improving traceability and emergency roll‑call accuracy.
• Support rapid, coordinated responses to security breaches, lost access cards and suspicious behaviour.

Who is this for?

• Business Owners
• WHS Managers
• Health and Safety Representatives (HSRs)
• Security Managers
• Facilities Managers
• Site Supervisors
• Reception and Front-of-House Staff
• IT and Systems Administrators
• HR Managers
• Compliance and Risk Managers

Hazards Addressed

• Unauthorised entry to the workplace or restricted areas
• Workplace violence, aggression or assault from intruders or unmanaged visitors
• Theft, sabotage or damage to plant, equipment and critical infrastructure
• Security breaches involving sensitive information or records
• Inability to account for people on site during emergencies or evacuations
• Tailgating and piggybacking through controlled entry points
• After‑hours lone work and personal security risks
• Misuse or loss of keys, access cards and identification badges

Included Sections

• 1.0 Purpose and Scope
• 2.0 Definitions and Key Terms
• 3.0 Roles and Responsibilities
• 4.0 Risk Assessment and Security Zoning
• 5.0 Access Control Principles and Hierarchies
• 6.0 Issuing, Managing and Revoking Access Cards, Keys and IDs
• 7.0 Visitor and Contractor Management Procedures
• 8.0 After‑Hours Access and Lone Worker Considerations
• 9.0 Physical Security Measures (Doors, Gates, Barriers and Surveillance)
• 10.0 Integration with WHS, Emergency and Evacuation Procedures
• 11.0 Incident Reporting, Security Breaches and Response Actions
• 12.0 Training, Induction and Communication Requirements
• 13.0 Recordkeeping, Privacy and Data Retention
• 14.0 Audit, Review and Continuous Improvement

Legislation & References

• Work Health and Safety Act 2011 (Cth) and mirror state and territory WHS Acts
• Work Health and Safety Regulations 2011 (Cth) and state/territory equivalents
• Safe Work Australia – Managing the Work Environment and Facilities Code of Practice
• AS/NZS ISO 31000:2018 Risk management – Guidelines
• AS 3745:2010 Planning for emergencies in facilities
• AS 4806 (series): Electronic security for buildings and property (where applicable)
• Privacy Act 1988 (Cth) and Australian Privacy Principles (for handling visitor and access data)