FROM A SAMPLE ASSESSMENT
F-06Every employee arms and disarms the alarm with the same code
Priority: Immediate
Observed. The alarm system is armed and disarmed using a single code shared by all staff. Three former employees were never removed from the system because there was nothing individual to remove. Every event in the system log is recorded against the same user.
Why it matters. An alarm log is only useful if it tells you who, not just when. With one shared code, an after-hours entry cannot be attributed, a repeat false alarm cannot be traced to the person who needs retraining, and a departing employee walks out with working access that cannot be revoked without changing the code for everyone. The system is working correctly. It is simply recording nothing you can use.
Recommended. Issue an individual user code to every person who opens or closes. Most panels installed in the last fifteen years support this at no cost, and it is a configuration change rather than a purchase. Revoke individually at separation. Review the log against the schedule once a month.