In a regulated environment, the visitor book stops being a courtesy and becomes evidence. The questions are predictable, which means you can prepare for them. This kit sets out what gets asked, what a good answer looks like, and where most visitor logs fall down.
What is in the kit
1The questions auditors ask
- Who was in this building on this date, and how do you know
- Who authorised their access, and to which areas
- How do you know the person who signed in is the person who arrived
- What happens to the record afterwards, and who can read it
- How would you produce this for a single named individual across all sites
2What a defensible record contains
- A timestamped arrival and departure, not just an arrival
- The host, so there is an accountable employee behind every visit
- The areas or floors the visitor was cleared for
- Any agreement they accepted, and the version of it they saw
- A stable reference you can search on later
3Where visitor logs usually fail
- Paper books that cannot be searched, and expose the previous visitor to the next one
- No sign-out, so the record cannot show when the building was cleared
- Records held only on a device at reception, with no backup and no retention rule
- No way to answer a question about one person across multiple sites
- Agreements accepted with no record of which version was shown
4Access, retention and data protection
- Decide who can read visitor records, and be able to show that list
- Set a retention period per record type, and enforce it automatically
- Know where the data is stored, which matters for cross-border requirements
- Be able to delete an individual on request without breaking the audit trail
Frequently asked questions
What should a visitor record contain for audit purposes?
A defensible visitor record contains the visitor name and company, a timestamped arrival and departure, the host who authorised the visit, the areas the visitor was cleared for, and any agreement they accepted along with the version shown. Without a departure time you cannot evidence when the building was cleared, which is usually the first gap an auditor finds.
How long should visitor records be retained?
Retention depends on your jurisdiction, sector and internal policy, so there is no universal number. What matters to an auditor is that you have set an explicit period, can justify it, and apply it consistently rather than keeping records indefinitely by default.
Are paper visitor books still acceptable?
They are rarely adequate in a regulated environment. A paper book cannot be searched, cannot be restricted to authorised readers, exposes the previous entries to the next person signing, and cannot enforce a retention period. It also cannot answer a question about one individual across several sites.
Who should be able to see visitor records?
Access should be limited to the roles that need it, typically reception, facilities, security and compliance, and you should be able to produce that list on request. Broad access to a visitor log is itself an audit finding in most regulated settings.
What is the difference between a visitor log and an audit trail?
A visitor log records who came in. An audit trail records what happened to that record afterwards: who viewed it, what changed, and when it was deleted. Auditors in regulated sectors increasingly ask for the second, not just the first.
Visitor management
The records in this pack, captured automatically
Everything above is easier to evidence when sign-in, induction and departure land in one system rather than a book at reception.
- Contractors signed in against their company, not just a name
- Inductions recorded against the version the person saw
- A live on-site list that works on a phone at the muster point
- Searchable records with a retention period you set
See visitor managementSee it working on your own sites
HybridHero runs desks, meeting rooms, visitors, contractors and parking on one platform, with 24/7 real human support.
Book a demo