How do you audit an existing badge system?
Start with the list of who holds a badge rather than with the technology. Most findings in most audits are organisational: people who left and were never revoked, doors nobody has reviewed in years, and cards nobody can account for.
Start with people
Take the list of active badges and compare it against the list of current staff, contractors and visitors.
Every badge that does not match a current person is a finding, and there will be some. Leavers whose badge was never revoked are the commonest single result of any access audit.
Then check the reverse: people who should have access and do not, which produces workarounds such as propped doors and borrowed badges.
Neither finding requires touching a reader, and both are more consequential than anything technical you will discover.
Then the doors
List every door under control and who may pass each one. Compare it against who needs to.
Access accumulates. People change role and gain permissions without losing the old ones, so long serving staff often hold far more access than their job requires.
Look for doors nobody can explain, which appear in every system of any age.
And look for doors under control that are propped, wedged or bypassed in practice, because that is the system telling you the permissions are wrong.
Then the cards
Count the cards issued against the cards accounted for. The difference is cards in unknown hands.
Check the stock of blanks, since unissued cards that can be enrolled are a credential supply.
Check temporary and visitor badges specifically, which are the ones least likely to be returned and most likely to remain active.
And check for shared badges used by a role rather than a person, which defeat the audit trail entirely and are usually undocumented.
The technology comes last
Read a card with a phone and note what comes back. An identifier alone points at protected content, and full readable content points at something that is not a credential.
Ask what the reader verifies: a number compared against a list, or a cryptographic challenge. That single answer characterises the whole installation.
Ask how quickly a revocation reaches a reader that operates offline, and test it.
Note the age of the installation, since systems fitted long ago frequently use schemes nobody would specify today. That is a finding to record and plan around rather than an emergency, and it should be weighed against everything the people and doors review turned up.
Frequently asked questions
Where do most audit findings come from?
People rather than technology. Leavers who were never revoked and accumulated permissions are the commonest results by a wide margin.
How do I know what my cards are?
Read one with a phone. An identifier alone points at protected content, and fully readable content points at a data tag.
Should I replace an old system after an audit?
Not automatically. Record it as a finding, weigh it against the organisational issues, and plan rather than react.
What about propped doors?
They are evidence that permissions do not match how people work. Treat them as a finding about the permissions rather than about discipline.