Algeria AgencySecurity & surveillance
The badge that never came back: issuing, revoking, counting
A badge can be withdrawn — provided somebody withdraws it. The register, the badge lost on a Friday evening, and the departure handled in a minute.
The companion article opens on a true sentence: a key cannot be withdrawn and a badge can. That is this family’s whole argument and it is what justifies the expense.
The sentence is true and it is conditional. A badge is withdrawn **if somebody withdraws it**, and nothing in the installation prompts that act. No light comes on the day a person leaves.
So the routine is what separates an access-control system from an expensive lock. It fits in three acts — issue, revoke, count — and takes a few minutes a month.
We deliberately leave aside what the companion article already handles: the visitor and the contractor, the shared badge, the journal, and the three access levels. What follows is about the life of the credential itself.
What can be withdrawn does not withdraw itself
We have opened up three-year-old installations whose system worked perfectly and whose list of active badges held twice the number of people present in the building.
Nothing was broken. Every badge issued had been correctly registered, every door opened as intended, and the journal recorded everything — including the entries of people who had not worked there for eighteen months.
That is this family’s particular failure and it has no technical symptom. An access-control system does not degrade, does not slow down, does not send an alert: it correctly executes a list nobody maintains any more.
So an uncomfortable thing has to be admitted before going on. The equipment turns a physical problem — getting an object back — into an administrative one — updating a list. That is an enormous improvement, and it does not remove the work, it moves it.
Everything that follows exists to make that work small enough to actually get done. A five-column register, one act on departure, and a count each quarter: that is the whole burden, and a heavier one than that does not survive six months.
The badge register: five columns, one sheet
The system already holds the list of badges. The register is not that list: it is what ties each badge to a person and a date, which the system almost never does properly because nobody fills in its fields.
Five columns are enough: the number engraved on the credential, the person’s name, the date of issue, the access profile assigned, and the date of return — left blank, and it is that blank column that does all the work.
The engraved number matters more than it looks. The system’s internal number is not readable on the object, so a badge found in a drawer cannot be tied to anything without it. If your credentials are not numbered, number them with an indelible marker: it takes an hour, once.
A sheet in a folder is enough and is better than a file. The quality wanted is not sophistication, it is that it gets filled in every time — and it does when it lives in the drawer where the blank credentials are kept.
The register has a second use nobody anticipates: it is what lets you answer "whose badge is this?" when a credential turns up, which happens several times a year and otherwise has no answer at all.
Issuing: three minutes on the first day
Handing over a badge is the one moment the person is listening, and it is the moment almost nothing gets said. Three well-spent minutes avoid most of the problems in the ten sections that follow.
Say what the badge opens and what it does not. That sounds trivial and it prevents the commonest case of badge lending: somebody who has to get into a room they have no access to and borrows a colleague’s, for want of knowing who to ask.
Say that the badge is personal and registered in that person’s name. That is not a threat, it is information: people readily lend an object they believe is anonymous, and much less readily one that carries their name on a list.
Have the issue signed for in the register. The signature is not worth much legally at this scale; it is worth something because it marks the object as the company’s and as expected back, which is exactly the information missing at the moment of departure.
And say what to do if it is lost, with a number to call. That is section 3, and half its problem is settled here: a loss reported the same evening costs a badge, a loss reported on Monday costs a weekend.
The badge lost on a Friday evening
Loss is the commonest event on this page and the worst handled, because it invariably happens when the person who knows how is unreachable.
The order is the same everywhere and is almost always inverted: revoke first, replace second. The natural reflex is to start by making a new badge so the person can work on Monday, and to deactivate the old one "when there is time".
Revoking takes thirty seconds and is what the installation was bought for. The replacement can wait until Monday, and the person can be let through the door by a colleague for a day at no cost at all.
What makes that order workable is an organisational decision taken calmly: at least two people must be able to revoke a badge, and at least one of them must be reachable outside office hours. A system where only one person can act is a system that cannot answer a Friday evening.
One useful point about the actual risk: a badge lost in the street is rarely a threat, because it carries neither an address nor any indication of what it opens. A badge lost **inside** the business or immediately around it is one, and that is the only distinction that changes the urgency.
The temporary badge that becomes permanent
A badge is issued for three days, to a temp, to an intern, to somebody who forgot theirs. Three days later nobody thinks about it, and that badge will live for three years.
It is the main source of the gap between active badges and people present, more so than departures — because a departure is an event somebody remembers, whereas a three-day loan is not.
The solution that does not work is relying on memory, and it is the one everybody tries. The solution that works is that the badge stops by itself: most systems accept an expiry date at the moment of creation, and that field is almost always left empty.
Take the opposite habit: every badge issued to somebody who is not an employee gets an expiry date, and it is a short one. A badge that expires too soon produces a thirty-second phone call; a badge that never expires produces the situation in section 1.
If your system does not handle dates, the physical version works too and costs a few hundred dinars: a batch of credentials in a different colour, reserved for temporaries, with one simple rule — a badge of that colour still around after a week gets handed back. The colour makes the anomaly visible without anybody consulting anything.
Departure: the minute that decides everything
Withdrawing a badge on departure is the central act on this page, and it fails for the same reason every time: it is attached to a conversation rather than to an event.
Attached to the exit interview, it depends on that interview happening, on its atmosphere, and on whoever runs it remembering the badge. In a contested departure — precisely the case where withdrawal matters — that interview is short or does not take place.
The rule that holds is to attach the revocation to the administrative event that exists anyway: the last day worked, the one that appears on the payroll. That day is known in advance in nearly every case, it is written down somewhere, and it depends on nobody’s mood.
Revocation and physical return are two different things and the second must not be waited for before doing the first. The badge may never come back — it is lost, it is at the person’s home, they no longer answer — and none of that matters if the line was revoked on the right day.
Record the return date in the register, or record "not returned" with the revocation date. The second entry is as useful as the first: it says a credential is out there, which matters on the day you wonder how many physical badges exist against how many active lines.
Who is allowed to create a badge
This whole page assumes the list is maintained by somebody. The next question is rarely asked: who exactly can add a line to that list?
In the majority of installations we open, the answer is broader than the owner imagines. The installer’s account is still active. A former manager still has their credentials. The administration password has been the same since commissioning and three people know it.
That is a complete inversion of the subject and it should be named plainly: a system where four people can create a badge is not an access-control system with four administrators, it is a building four people hold the complete keyring to.
The correct shape is the one this whole pillar uses. Two named administrators, each with their own account. The installer’s account disabled after handover, and re-enabled on request when they have to intervene. The factory password changed and written down with the company’s documents.
Check this point before all the others if you only check one. The register, the temporary badges and the departure procedure all lose their meaning if anybody can create a line without it appearing anywhere.
Leave, sick leave, suspension: the states in between
An employee is not only present or gone. They are on leave for three weeks, off sick for two months, seconded to another site, or suspended while a procedure runs.
The question is rarely asked and has a simple answer in most cases: touch nothing. Three weeks’ leave does not justify a revocation, and revoking produces a Monday morning where somebody is left outside without knowing why.
Two situations deserve the opposite and are better decided calmly. A long absence, beyond one or two months, where the badge has no reason to open a door during that period. And a suspension tied to a procedure, where access is exactly the subject.
Use the system’s suspension rather than deletion in both cases, and it is a distinction that matters: deleting erases the badge’s link to the person, suspending keeps it. On the day of return a suspension is lifted in ten seconds, while a deletion is recreated with a new number and a register line to correct.
Write the rule in two sentences on the register’s first page. That is not procedure for its own sake: without it the decision is made afresh each time by whoever is asked, and it is made differently depending on who that is.
Counting: two numbers, one quarter
This page’s audit is two numbers and takes twenty minutes. The number of active lines in the system, and the number of people who ought to have one.
The gap is never zero and that is not the subject. The subject is knowing what it is made of: the temporaries from section 4, the departures from section 5, service badges — reception’s, the maintenance technician’s — or lines nobody can explain.
That last category is the only one that really matters, and it is what the count exists to isolate. A badge nobody in the room can say the holder of is a badge to revoke the same day, even if it gets restored when somebody speaks up. It is the one rule on this page where you act without knowing.
We will not publish a normal gap, and the absence is deliberate. What you count depends on what you decide to count — does a contractor’s badge count? does a blank in the drawer? — and two businesses with identical practice would report different numbers. Yours is valid in your building and nowhere else.
So what makes the count useful is not the level but the comparison with your own from last quarter. A gap that stays stable describes an organisation; a gap that grows quarter on quarter describes a register that has stopped being kept.
The credentials: what to keep in stock
The physical side of this page is short and nevertheless produces most of the delays. A badge is replaced with a blank credential, and nobody has one in stock on the day one is needed.
Keep a small margin, five to ten depending on the size of the business, in the same drawer as the register. It is not a serious outlay and it turns a three-day replacement into a three-minute one.
Check one thing at purchase that nobody checks: the credential’s technology and its availability. Some older systems use credentials that can no longer be found, and that is discovered on the day of a loss, which is the worst moment to discover that the system has to be changed.
The choice between card, fob and phone is made on actual use rather than price, which is comparable. A card goes in a wallet and stays in the wallet; a fob follows the car keys and therefore goes home in the evening; a phone is always there and becomes a problem the day the person changes device or leaves the company with their own.
And engrave or mark the number on each credential before putting it in stock, not at the moment of issue. That is column one of the register, and it is the kind of act that never happens if it is supposed to happen in a hurry.
What has to be written before going on leave
Everything above rests on one person who keeps the register and knows how to revoke. This page would not be honest without covering the three weeks when that person is away.
Half a page is enough, in the folder, next to the register. It contains four things and not one more: how to open the software, how to revoke a badge, who else is allowed to, and the installer’s number.
The revocation procedure is written in four numbered lines, with the exact words that appear on screen. A procedure written in general language — "go into settings and remove the access" — is a procedure that will not be followed by somebody who has never opened the software.
The second holder must have opened the software at least once, with the first person present, before needing to. An access never tried is an access you discover at the wrong moment has expired, or whose password has changed.
It is the same act as rehearsing a restore or a line switchover, and it fails for the same reason: everybody is certain it will work, and nobody has done it once.
What we do, and what we refuse to do
What we refuse first: remaining the sole holder of the administration account after handover. It is comfortable for us, it guarantees a phone call for every badge to be created, and it makes us a dependency on a function your business has to hold itself.
We also refuse to create or revoke a badge on a telephone request whose origin we cannot verify. That looks excessive until the day the call comes from somebody who has just been dismissed, and that day arrives.
And we refuse to sell an access-control system to a business that has named nobody to keep the list. That is not a moral position: it is that an installation sold in those conditions produces, at three years, the situation in section 1 — equipment in perfect working order around a false list.
What we do fits in half a day: the register opened with your existing badges counted one by one, expiry dates enabled on the temporaries, the administration accounts handed to two named people, and the half-page procedure written with whoever will have to use it.
And one thing to do this week without us, in twenty minutes: open the list of active badges and count it, then count the people who ought to have one. You do not need the rest of this article to know what to make of the gap.
Frequently asked questions
How many surplus active badges is normal?
We do not publish a figure, and the absence is deliberate: what you count depends on what you decide to count — a contractor’s badge, a blank in the drawer — and two businesses with identical practice would report different numbers. Count yours and compare it with your own last quarter. A stable gap describes an organisation, a growing one describes an abandoned register.
A badge is lost on a Friday evening. What do we do?
Revoke first and replace second, and it is almost always done the other way round. Revoking takes thirty seconds; the replacement can wait until Monday and the person can be let through the door for a day. What makes that order workable is a decision taken calmly: at least two people able to revoke, one of them reachable outside office hours.
Should we revoke the badge of an employee on leave?
Not for ordinary leave: that produces a Monday morning where somebody is left outside. Yes for a long absence beyond one or two months, and yes for a suspension tied to a procedure. In both cases use the system’s suspension rather than deletion — deleting erases the badge’s link to the person, suspending keeps it and is lifted in ten seconds.
How do we stop temporary badges accumulating?
By not relying on memory. Most systems accept an expiry date at creation and that field is almost always left empty: make it a habit that every badge issued to a non-employee gets a short one. If your system does not handle it, a batch of credentials in another colour reserved for temporaries makes the anomaly visible without consulting anything.
When is a leaver’s badge withdrawn?
On the last day worked, the one that appears on the payroll, and not at the exit interview. Attached to a conversation, revocation depends on that conversation happening — and in a contested departure, precisely the case where it matters, that interview is short or does not take place. Physical return is a separate question and is not to be waited for.
Who should be able to create a badge?
Two named people, each with their own account, and not one more. Check this before everything else: in the majority of installations we open, the installer’s account is still active and a former manager still has their credentials. A system where four people can create a line is a building four people hold the keyring to.
Where we come in
Count the active lines in the system and the people who should have one. Twenty minutes, and the gap is almost always made of people who left.
- We list your existing badges one at a time, and date the temporary ones.
- We hand you the administration account at handover, not later.
- We require a written request to create or disable one, never a phone call.
If nobody at your company is named to withdraw a badge on the day somebody leaves, do not install this system: it will become a list of ghosts.
Read next
Access control: a key cannot be revoked
Everything sits in that sentence. A badge is cancelled in one action; a key is taken back by changing the lock — and nobody ever changes the lock.Security and surveillance: the order matters more than the product
It is the only family in the pillar bought against a fear rather than a need. And fear buys in the wrong order: what can be seen, first.What the insurer asks for: declaring, proving, being paid
The only third party that will ever examine your security does it once, after the loss. What it will ask for, and what has to exist beforehand.
Let us talk about your project
A free audit, no commitment: we look at your online presence and tell you what is holding it back.