11/06/2026
Visitor Management: It's Not About Signing In – It's About Controlling Risk
Today I had the pleasure of joining Dave Willoughby and the team at FacilityOS for a webinar exploring how organisations can build safer, more compliant workplaces through effective visitor and contractor management.
A huge thank you to everyone who attended, participated, and contributed to the discussion. It was encouraging to see so much engagement around a topic that is often viewed as an administrative task, when in reality it is a critical safety, operational, and compliance control.
One of the key messages I shared during the webinar was simple:
Visitor management isn't about signing people in. It's about controlling risk.
Too often organisations focus on whether someone has completed a sign-in process. Whilst this remains an important step, it only tells us that a person arrived on site. It does not tell us whether they are authorised to be there, whether they understand the site's hazards, whether they have received the information they need, or whether they can be effectively accounted for during an emergency.
From an auditor's perspective, these are the questions that matter.
When I arrive on site, I am not looking for impressive reception areas, visitor badges, or perfectly presented sign-in books. Those things are positive indicators, but they are not evidence of control on their own.
The real test comes when I ask questions such as:
Who is currently onsite?
Why are they there?
Who is responsible for them?
What risks apply to their activities?
Have they received the appropriate information?
Can the organisation demonstrate this through records and evidence?
This is where the difference between attendance and control becomes clear.
Throughout my auditing career, I have seen organisations with excellent front-end processes that appear robust at first glance. However, when we begin sampling records and speaking to people, gaps sometimes emerge. Contractor documentation may be stored separately from visitor records, induction evidence may be difficult to locate, insurance documents may have expired, or emergency evacuation lists may not be current.
Individually these issues may seem minor. Collectively, they can create significant blind spots.
The discussion also highlighted the importance of preparation before visitors and contractors arrive on site. Discovering missing RAMS, competency evidence, permits, or insurance documentation at the gate is often too late. By that stage work has been planned, resources allocated, and expectations set.
Effective organisations complete these checks before arrival, allowing the sign-in process to confirm readiness rather than identify non-compliance.
Perhaps the greatest test of any visitor management process is an emergency situation.
In an evacuation, nobody wants assumptions or guesswork. They need immediate answers:
Who is onsite?
Who has evacuated safely?
Who remains unaccounted for?
Where systems are fragmented or records are incomplete, these questions can quickly become difficult to answer.
As a final reflection, I would encourage every organisation to ask themselves four simple questions:
Can I tell who is onsite right now?
Can I demonstrate they are authorised to be there?
Can I account for them during an emergency?
Can I demonstrate they are competent and working in accordance with approved controls?
If the answer is yes, your organisation is likely in a strong position.
If the answer is no, there may be opportunities to strengthen your arrangements.
Visitor management is not a reception process. It is a safety, compliance, and operational risk control that deserves the same attention as any other critical control within an organisation.
Thank you again to FacilityOS, HSE People, Dave Willoughby, Michael Foster, Rebecca and everyone who attended today's webinar. It was a pleasure to be involved and contribute to such an important discussion.
