Product Overview

Summary: This Safe Operating Procedure provides a clear, step-by-step framework for managing electronic and physical access control systems across Australian workplaces. It helps organisations protect people, information and assets by standardising how access is granted, monitored, reviewed and revoked in line with WHS and security obligations.

Access control systems are a critical line of defence for Australian businesses, not only for protecting property and information but also for controlling who can enter potentially hazardous or restricted work areas. Without a robust, documented procedure, organisations can experience uncontrolled site access, unsecured plant rooms, tailgating into high‑risk zones, and confusion during emergencies when rapid, accurate access data is essential. This SOP establishes a consistent, auditable process for planning, operating and maintaining access control systems, including card readers, keypads, biometrics, turnstiles, gates and integrated visitor management solutions.

The document translates legal and technical requirements into practical steps that front-line staff, supervisors and system administrators can actually follow. It covers the full lifecycle of access permissions—from onboarding and induction, through role-based access assignment and periodic review, to suspension and termination—ensuring that only competent and authorised persons can access specific areas, plant, or information systems. By implementing this SOP, businesses can reduce security incidents, support WHS risk controls (such as isolating high-risk areas), and demonstrate due diligence to regulators, clients and insurers.

Designed specifically for the Australian context, this SOP aligns with WHS obligations to manage risks to health and safety, integrates with emergency management and contractor control processes, and supports compliance with privacy and information security requirements. It is suitable for a wide range of sectors, including construction, manufacturing, logistics, healthcare, education, local government, and professional services operating multi-tenant or multi-site facilities.

Key Benefits

• Strengthen site security by standardising how physical and electronic access is requested, approved, configured and revoked.
• Support WHS risk controls by restricting access to hazardous areas, high-risk plant rooms and sensitive operational zones to authorised, competent personnel only.
• Reduce incidents of unauthorised entry, theft, vandalism and data breaches through clear rules on credential use, storage and reporting of lost or stolen cards.
• Streamline onboarding, contractor management and visitor access with consistent, documented workflows that integrate with HR and site induction processes.
• Enhance incident response and investigations by ensuring accurate access logs, audit trails and reporting processes are maintained and regularly reviewed.

Who is this for?

• WHS Managers
• Security Managers
• Facilities Managers
• IT Managers and System Administrators
• Site Supervisors
• Office and Practice Managers
• Campus and Operations Managers
• Data Centre Managers
• HR Managers
• Risk and Compliance Managers

Hazards Addressed

• Unauthorised access to hazardous work areas (e.g. plant rooms, confined spaces, electrical switch rooms)
• Security breaches leading to theft, sabotage or damage to critical equipment and infrastructure
• Increased risk of workplace violence, aggression or intrusion due to uncontrolled public access
• Compromised emergency response due to inaccurate occupancy information or unsecured emergency exits
• Exposure of sensitive information or data through uncontrolled access to server rooms or secure offices
• Slip, trip, fall and crush hazards at access points (e.g. gates, turnstiles, barriers) when not properly controlled or monitored

Included Sections

• 1.0 Purpose and Scope
• 2.0 Definitions and System Overview
• 3.0 Roles and Responsibilities
• 4.0 Risk Management and WHS Integration
• 5.0 Access Levels, Zones and Area Classifications
• 6.0 User Onboarding, Induction and Access Requests
• 7.0 Approval Workflow and Role-Based Access Control
• 8.0 Issuing, Using and Securing Access Credentials (Cards, Fobs, PINs, Biometrics)
• 9.0 Visitor, Contractor and Temporary Access Management
• 10.0 Restricted and High-Risk Area Access Controls
• 11.0 Operation of Gates, Doors, Turnstiles and Barriers
• 12.0 Monitoring, Alarms and Incident Response
• 13.0 Lost, Stolen or Compromised Credential Management
• 14.0 Integration with Emergency Management and Evacuation Procedures
• 15.0 Access Log Management, Auditing and Reporting
• 16.0 System Maintenance, Testing and Change Management
• 17.0 Privacy, Data Protection and CCTV Considerations
• 18.0 Training, Communication and Competency Requirements
• 19.0 Non-Compliance, Breach Management and Corrective Actions
• 20.0 Document Control and Review

Legislation & References

• Work Health and Safety Act 2011 (Cth) and equivalent state and territory WHS legislation
• Work Health and Safety Regulations 2011 and state/territory equivalents
• Safe Work Australia – How to Manage Work Health and Safety Risks: Code of Practice
• AS 3745:2010 Planning for emergencies in facilities
• AS 2201.1:2018 Intruder alarm systems – Client's premises – Design, installation, commissioning and maintenance
• AS/NZS ISO 31000:2018 Risk management – Guidelines
• AS/NZS ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection – Information security management systems
• Privacy Act 1988 (Cth) and Australian Privacy Principles (for handling access and CCTV data)