A card, fob, mobile token, or PIN is a permission, not just a piece of inventory. Reconciliation must show who has each credential, which doors or zones it opens, the schedule attached to it, and why that access remains appropriate. A box of returned fobs does not prove the corresponding permissions are disabled.
This guide covers administrative reconciliation. The operator and security owner decide access policy, exceptions, investigations, and emergency changes.
Establish the populations to compare
Export active credentials from the access-control system for a stated date and time. Include credential ID, type, assigned profile, state, zones, schedule, issue date, last-use event where permitted, and expiry. Keep raw access logs restricted.
Build separate authoritative rosters for members, employees, contractors, vendors, tenants, and keyholders. Use stable person or organization IDs rather than names alone. A staff member may also be a member, and two people may share a name.
Declare exclusions such as archived sites, offline readers, temporary event credentials, or systems unavailable during the review. Without a defined population, a tidy total can conceal unreviewed access.
Match one credential to one accountable holder
Compare every active token with the correct roster. Confirm the holder, relationship type, source approval, intended location, access schedule, issue event, and expected end condition. Generic labels such as "trainer fob" or "cleaner code" need an accountable owner.
Flag credentials assigned to no profile, several profiles, an inactive profile, a former relationship, or an unexpected credential type. Also flag people with several active tokens when the register does not explain why.
Do not resolve a mismatch by choosing the closest name. Preserve the token ID and conflicting records, then route identity questions through the approved verification path.
Reconcile zones and schedules, not only active status
A credential can be correctly assigned and still have excessive access. Compare its door groups, location, allowed hours, holidays, after-hours permissions, and any override with the approved role or membership.
Look for inherited permissions left from an earlier job, transferred location, temporary promotion, construction project, or event. A member who moved home clubs should not automatically retain staff-only or after-hours zones from the old site.
Show differences field by field. The security owner can then approve removal, continuation, or a time-limited exception without reading an unstructured note.
Treat physical media and digital permissions separately
Record whether a physical card or fob is issued, held, reported lost, returned, destroyed, or awaiting collection. Separately record whether the system credential is active, suspended, expired, or revoked.
A returned fob that remains active is a control failure. So is a disabled token still marked as issued to someone else. Reconcile both sides before closing the item.
For mobile credentials, track the token and approved device event without collecting unnecessary device contents. For PINs, do not place the code itself in the reconciliation sheet. Use a credential reference and rotate or revoke through the controlled system.
Investigate before disabling an apparent duplicate
Two credentials may reflect a replacement in progress, separate sites, a testing token, or an approved fallback. Check issue dates, last-use events, return records, service tickets, and the person's role before taking action.
Prepare a proposed change list showing the credential, current permission, reason, source record, and impact. High-risk, disputed, after-hours, staff, vendor, and master-level permissions should receive the security owner's review.
The administrator should not disable access merely to make totals balance. A careless removal can prevent an opening shift, emergency responsibility, or contracted service.
Process departures and relationship changes promptly
Tie employee and contractor offboarding to access removal. The case should name the effective time, credentials expected back, zones to revoke, system owner, and verifier. Membership cancellation or freeze should follow the business's approved access rule rather than an assumption.
For vendors, set an expiry at issuance where possible. Project completion should trigger both physical return and digital revocation. Shared vendor codes are harder to attribute and should be replaced with individual, bounded access where the system and policy allow.
If a token cannot be recovered, record it as lost and revoke its permission. Do not wait for the plastic to appear before controlling the system state.
Apply approved corrections with an audit trail
Record the old zones, schedule, holder, and state before editing. Then make only the approved changes. Capture the access-system event, actor, time, approval reference, and any physical-media action.
Avoid deleting history. A revoked credential may still be needed to understand earlier entry events or a later dispute. Use status and retention rules instead of erasing the assignment.
Where a correction affects several doors or sites, verify each permission group. A global-looking checkbox can conceal a location-specific rule that did not update.
Test readers without exposing security details
Select a risk-based sample of corrected credentials and appropriate test accounts. Confirm expected acceptance and denial at relevant readers and times. Record the reader event reference, not door codes or a map of restricted areas.
Review failed-entry patterns for configuration problems, but do not infer misconduct from a failure alone. A reader outage, expired schedule, mobile-device issue, or stale controller can produce the same event.
If testing reveals broader exposure or unexpected successful entry, stop routine reconciliation and route the finding through the security incident process.
Close with three quantities that agree
The access platform, source rosters, and physical inventory should reconcile. Explain every remaining difference with an owner and due date. Report active credentials, unmatched credentials, excessive-permission exceptions, items awaiting return, revoked-lost tokens, and completed corrections for the stated review window.
Sample closures to confirm that evidence supports the change and that temporary access expired. Schedule the next review according to risk, turnover, vendor activity, and changes to doors or locations.
The FTC advises businesses to know what personal information they hold, keep only what they need, protect it, dispose of it securely, and prepare for incidents. CISA recommends strong unique passwords and multifactor authentication. Those practices support individual administrator accounts, narrow exports, protected access logs, and prompt offboarding. The listed sources were checked October 1, 2026.
A fitness virtual assistant can compare registers, prepare exceptions, track returns, execute approved routine edits, and verify closure. Access policy, high-risk permissions, investigations, and disputed identities remain with the security owner. State that boundary in the broader Fitness VA task list.