When people think of internal audit, physical security rarely comes to mind first. But CCTV coverage, access control logs, and visitor management are control points just like a payment approval workflow — and weaknesses here create real financial and operational risk.
Where Physical Controls Intersect With Audit Scope
- Asset protection — inventory and fixed-asset audits rely on physical access being restricted to authorised staff; a warehouse with uncontrolled access undermines any stock count
- Cash handling — branches and cash offices are reviewed for camera coverage of till points and safes as part of cash-control testing
- Data centre and server room access — physical access to servers is an IT general control, not a separate concern; anyone who can physically reach a server can potentially bypass logical access controls entirely
- After-hours activity — access logs are cross-referenced against approved working hours to flag unusual entry patterns
What We Actually Test
An audit does not assess camera resolution or alarm brand. It tests whether the physical security control achieves its intended purpose:
- Are entry/exit logs retained for a sufficient period and actually reviewed, or just recorded and forgotten?
- Is access revoked promptly when an employee leaves or changes role?
- Do camera blind spots cover high-risk areas such as till points, stock rooms, or server racks?
- Is there a documented incident-response process when a security event is flagged?
A Common Finding
One of the more frequent findings in this area: access control systems exist and function correctly, but no one has reviewed the access list in over a year. Former employees and contractors often retain active badges or credentials well after their engagement has ended — a control gap that is simple to test and simple to fix once identified.
A control that exists but is never reviewed provides far less assurance than its presence suggests.
Where This Fits in an Engagement
Physical security controls are typically assessed as part of a broader operational or asset-management audit programme, rather than as a standalone engagement — but for organisations with high-value inventory, cash operations, or sensitive data centres, it is often worth scoping as a dedicated review.
Contact BAC Practice if you would like physical and access controls included in your next audit scope.
