In a regulated firm the visitor book stops being a courtesy and becomes evidence. The questions an auditor asks are predictable, which means you can prepare for them, and most visitor logs fail on the same three points.
What changes in a regulated environment
Everywhere else, a visitor record answers “who is in the building”. In financial services it also has to answer who authorised the access, to which areas, and who has since been able to read that record. The audit trail matters as much as the log.
The questions that get asked
| The question | What a weak answer looks like | What a defensible answer looks like |
|---|
| Who was in the building on this date | A paper book, unsearchable | A searchable record with arrival and departure |
| Who authorised the visit | Nobody recorded | A named host on every record |
| Which areas could they reach | Not captured | Cleared areas on the record |
| What did they agree to | A signature on a form | The agreement and the version shown |
| Who can read these records | Anyone at reception | A named, producible access list |
| How long are they kept | Indefinitely, by default | An explicit retention period, applied automatically |
The three failures worth fixing first
No sign-out, so you cannot evidence when the floor was cleared. Records on a single device at reception, with no backup and no retention rule. And no way to answer a question about one named individual across several sites, which is exactly how the question tends to arrive.
Data protection sits alongside
Visitor records are personal data. Collect what the purpose requires, know where it is stored, restrict who can read it, and be able to delete an individual on request without breaking the trail. Broad access to a visitor log is itself a finding in most regulated settings.
What the research adds
Gensler’s Global Workplace Survey 2025 found employees in well-designed workplaces nearly three times more likely to stay with their employer, a retention argument that lands well in a sector competing hard for compliance and risk talent. Leesman’s benchmark shows the average office still trailing the average home by ten points on experience, which for a regulated firm is worth reading alongside its return-to-office policy: mandating attendance into a workplace that scores below home is how quiet attrition starts.
The reception experience is part of that score, and in financial services it does double duty: the same visitor process that impresses a client also produces the audit trail the regulator expects. Treating front-of-house as compliance infrastructure, not hospitality, is the reframe that unlocks budget for it.
Contractors are the harder half
Financial services sites run a constant flow of engineers, cleaners and fit-out crews. Those are contractor management records, not visitor records, and they carry insurance, induction and permit evidence with them.
Our visitor record audit kit sets out the full question list.
References
General information, not legal advice. Confirm what applies to your jurisdiction, sector and site.