An access review should answer whether today's permissions and issued keys match today's authorized needs. It should not end with someone approving a spreadsheet that was never compared with the cabinet, the access system, or recent personnel changes.
This worksheet-style guide helps NYC property and hotel managers examine evidence within a bounded scope. It supports the key and credential control program. The review methods and sample record fields are operational recommendations. The appropriate schedule depends on applicable requirements, contracts, property risks, and management decisions.
Define the review boundary and source date
Choose a scope that can be completed meaningfully: one building, one contractor population, or one credential class. Identify the reviewer, the responsible decision-maker, the record sources, and the date and time of each extract. A report from last month and a roster from today may disagree because of timing rather than an actual control failure.
State what the review excludes and who owns those exclusions. For example, a physical-key review may not establish the status of mobile credentials. If a system owner cannot provide a reliable list, record that as a limitation and assign a next step rather than treating the missing data as an empty population.
NIST SP 800-53A PE-02 and PE-03 provide a useful evidence model: examine records, interview responsible personnel, and test relevant processes or mechanisms. These are adaptable assessment procedures. They do not authorize intrusive testing or set a mandatory quarterly audit for NYC buildings.
Reconcile four populations
Compare current authorized people or roles, issued physical assets, active electronic credentials, and open exceptions. The property may maintain those records in different systems. A consistent internal identifier helps connect them without exporting more personal information than the reviewer needs.
Within the agreed scope, have an authorized custodian reconcile keys in storage and documented items on loan against the register, including unissued spare keys where relevant. Record missing, extra, or unidentified items.
Look for both unsupported access and unsupported records. An active credential without a current sponsor may require removal or a documented authorization decision. A returned key still marked as issued may indicate an inaccurate custody record. A register entry with no matching physical item may require a missing-key assessment. Different findings require different owners.
| Comparison | Example discrepancy | Next decision |
|---|---|---|
| Authorized people to active credentials | Access remains after assignment end | Confirm current need or authorize removal |
| Issued assets to custody records | Holder cannot be established | Reconcile custody and assess exposure |
| Returns to system status | Returned badge still active | Verify required system action |
| Exceptions to closure evidence | “Fixed” note without confirmation | Obtain evidence or reopen the item |
The purpose is not to assume every mismatch is misconduct. Establish the facts, source timing, and responsible process before reaching a conclusion.
Sample real transactions and observe the process
Select samples that reflect the property's risks: a recent departure, a changed role, a temporary contractor loan, a replacement credential, and an overdue return. Define how the sample was chosen. A small targeted sample can reveal a problem, but it does not prove that every unsampled record is correct.
For each selected item, trace authorization, issue, custody, changes, and closure. Ask staff to show where the current instruction is stored and how they would reach the approver. If a system or device check is needed, have the authorized operator use an approved test method within the review scope. Do not experiment with occupied guest rooms or sensitive areas.
- Can the reviewer connect the approval to the exact credential?
- Does the record show the actual holder and any authorized transfer?
- Is the expected end condition clear?
- Is closure supported by physical and system evidence where relevant?
Use the contractor key workflow and offboarding checklist as trace guides. They help identify which step failed without replacing the property's approved procedure.
Assign corrections that can be verified
Record the discrepancy, exposure or operational consequence, owner, authorized corrective action, due date, and verification method. Keep the evidence reference close to the finding. Avoid a vague instruction such as “clean up access” that cannot be checked by the next reviewer.
Escalate high-consequence findings promptly instead of waiting for the review report. An unaccounted-for master key or an unexplained active credential may require the property's incident process. A review cadence is not a reason to postpone an identified risk.
Track the age of open findings and whether previous corrections recur. These measures are more actionable than a single percentage labeled “compliant” without a defined basis. If management accepts a temporary exception within applicable legal and contractual requirements, record its scope, owner, review point, and approved compensating measures.
Copy these fields into a finding record
Use one record per discrepancy. Keep detailed credential identifiers and access mappings in the restricted evidence location rather than a broad management report.
- Finding reference and review scope
- Evidence source, extract date, and restricted evidence location
- Expected state, observed state, and known uncertainty
- Responsible decision-maker and correction owner
- Authorized action, target date, and next review point
- Verification method, reviewer, completion date, and remaining exception
These fields are a starting template. Add fields only when they support a defined decision or recordkeeping requirement.
Publish a useful management summary
The management summary should state the scope, evidence dates, sample approach, confirmed findings, unresolved limitations, and decisions needed. Restrict detailed key mappings, credential identifiers, and personal data to the appropriate audience. The FTC's business guidance supports collecting and retaining only necessary information and protecting it according to its sensitivity.
Conclude with the next verification point. That may be confirmation of a system change, a physical reconciliation, or a repeat sample after the procedure is revised. Describe what was checked accurately. A completed access review is evidence about its stated scope, not a guarantee that every security risk or legal requirement has been resolved.