Access Credential Management: Issuing, Auditing and Removing Cards and Mobile Access

Access credential management is the process of approving, issuing, reviewing and removing the cards, tags or mobile credentials people use at controlled doors. The important question is not just whether a reader accepts the credential. It is whether the right person has the right permission for the right period, and whether changes reliably reach every relevant controller. NZ site operators should agree that lifecycle before the first credential is issued.

Establish ownership and approval responsibilities

Name the person or role authorised to approve access and the operator allowed to make the change. Separate ordinary issuing from permissions for high-risk areas or administrative control. A receptionist may issue a pre-approved visitor credential without having authority to add unrestricted access to a server room. Document the approval route so urgency does not turn into an informal permanent exception.

Define who supplies joiner, mover and leaver information. The access system cannot remove a departing contractor if nobody reports the departure. Agree response times appropriate to the site risk and a route for urgent lost-credential reports. Include after-hours arrangements so the process still works when the usual administrator is away.

Create a credential record that can be audited

Associate each credential with a verified person or approved operational purpose. Record the relevant identifier, issue date, approver, access group, expiry and status. Avoid a drawer of active unassigned cards that cannot be traced. Where temporary pool cards are necessary, record who holds each one and when it must be returned.

Collect only the personal information needed for the access purpose and protect it appropriately. Access logs can reveal personal movements. Set a justified retention and access policy rather than keeping every record indefinitely. The Office of the Privacy Commissioner provides NZ guidance on organisational privacy obligations; ask the site's privacy officer to confirm the implementation for the actual system and use.

Do not print sensitive access permissions or unnecessary personal details on the physical card. Decide what visible identification is useful and what creates risk if the card is lost. Keep the administrative record protected separately from the credential, and document how an operator verifies a person requesting a replacement.

Use access groups with clear boundaries

Build permissions around roles, areas and times rather than granting every new employee a copy of a long-serving colleague's access. Copying can carry forward obsolete exceptions. Define an access group in plain language, such as warehouse staff during approved operating hours, then map it to the exact doors and schedules.

Test the difference between normal access, denied access and an expired credential. Include holidays, overnight shifts and access across midnight where relevant. RBH's published material describes access levels and audit trails, but the available workflow depends on the exact platform and version. Verify supported features and controller behaviour before promising automated expiry or remote revocation.

Keep administrative rights separate from door permissions. A person who can enter an office should not automatically be able to create other users. Protect privileged and remote accounts with strong authentication, including MFA where supported and appropriate. Record who can approve elevated rights and review those accounts separately from ordinary credential holders.

Issue physical and mobile credentials deliberately

Confirm card technology, format, reader compatibility and the intended secure configuration before ordering. A card described as MIFARE or DESFire does not prove that the installed reader and controller use its security features as intended. Verify the actual credential data path and supported configuration with the supplier.

For mobile access, define invitation, enrolment, phone replacement and lost-device procedures. Check licensing, account ownership, supported phones and offline behaviour for the selected service. A mobile credential may coexist with a physical card; removing one must not leave the other unintentionally active. Keep all credentials associated with the same person's record where the platform supports it.

Demonstrate permitted doors and denied doors when issuing access. Explain how to report a loss and whether sharing is prohibited. Confirm the user understands any PIN or mobile-account responsibilities. Do not send administrative passwords or sensitive recovery information with routine credential delivery instructions.

Audit permissions using both records and controller state

Review active users against current staff, tenant and contractor lists. Check expired assignments, duplicate credentials, long-unused cards and temporary permissions. A low-use credential may still be legitimate, so investigate before removal. Obtain the responsible manager's decision and retain a record of approved changes.

Check whether controllers have received the current database. An administrator's screen showing disabled is not enough when an offline controller still holds old permissions. Determine the platform's update and offline behaviour and verify the affected doors. Test with a designated credential under an agreed procedure, avoiding disruption to legitimate access or emergency exit.

Make removal a complete workflow

For example, a contractor may return a physical card while retaining a mobile credential issued for the same project. Closing only the card transaction leaves an incomplete leaver process. Use a person-based checklist covering every credential and administrative account, with the exact actions adapted to the installed platform.

Keep audit evidence useful and proportionate

Retain approval, change and verification records in the agreed secure location. Avoid exporting full user and movement databases into unsecured spreadsheets or shared inboxes. Limit report access to people with a valid operational purpose. When a client requests an audit, agree the scope and privacy handling before moving data outside the access system.

Record unresolved issues, such as an offline controller or an unreturned card that has been disabled. Assign a responsible person and due date. A useful audit ends with verified actions, not just a large list of users. Review the process after staffing changes, tenancy changes or an incident, and adjust access groups when the organisation's real operating pattern changes.

Equipment selection and technical references

Use these access control options as a starting point for a project specification. The pictured items are equipment candidates, not a pre-approved complete design. Confirm model, accessories, interface support and suitability before ordering.

Related installer guidance: Card vs mobile vs biometric access credentials.

Primary references checked 24 October 2026: RBH Access – education access control solutions; Office of the Privacy Commissioner – organisational obligations; NCSC – multi-factor authentication.

Get project specification help

Contact Essential Security Supplies with your site layout, proposed equipment and operating requirements. Ask for model-specific technical support or a trade quotation before finalising the design.