A card reader can flash green while the entrance still fails to secure. In Toronto commercial buildings, access problems often come from old credentials, worn door hardware, incorrect schedules or seasonal changes—not the access control software alone.

A proper audit follows the entire entry process, from the credential and reader to the lock, door closer, alarm record and final latch.

Quick answer: A commercial access control audit checks who can enter the building, which doors they can use, when access is permitted, whether each door secures properly and what happens during a power failure or emergency. A full annual audit is a practical baseline, with more frequent permission reviews for multi-tenant or high-turnover properties.

1. Compare Active Credentials With Current Occupants

The first step is confirming that every active card, fob, code or mobile credential still belongs to someone who needs access.

Compare the access control database against current employee, tenant and contractor records. Look for:

Former employees with active credentials
Contractors whose projects have ended
Unreturned cards or fobs
Shared credentials that cannot be traced to one person
Temporary access without an expiry date
Duplicate profiles
Users with access to more areas than their current role requires
Administrator accounts that are no longer needed

Pay particular attention to cleaners, delivery personnel, maintenance contractors and temporary staff. These credentials are often created quickly and then forgotten.

The audit should also review the process used when an employee leaves, a tenant moves out or a contractor finishes work. If access removal depends on someone remembering to send an email, credentials will eventually remain active longer than intended.

2. Test the Complete Door Assembly

A successful card read does not prove that an entrance is secure. The reader may authorize access while the electric strike binds, the magnetic lock releases slowly or the door fails to latch afterward.

Each controlled opening should be tested as one operating system:

Credential reader
Door controller
Electric strike or electromagnetic lock
Request-to-exit device
Door position contact
Hinges, pivots and frame alignment
Door closer
Automatic door operator, where installed
Forced-door and held-open alarms
Intercom or visitor entry controls

Open the door from both sides where permitted, allow it to close naturally and confirm that the latch fully engages without someone pulling the door shut.

Symptom vs. Likely Cause

Symptom	Likely cause	What to check
Reader accepts the card, but the door does not open	Strike binding, voltage drop or incorrect release timing	Lock alignment, power at the opening and controller timing
Door opens but does not latch afterward	Weak closer, frame movement, worn latch or pressure difference	Closer settings, hinges, seals and latch alignment
Frequent door-held-open alarms	Slow closing door, obstruction or alarm delay set too short	Closing speed, threshold condition and alarm settings
Valid users are denied access at the same time each day	Incorrect schedules, holiday rules or controller clock drift	Time zones, calendars and system time
Outdoor reader works intermittently in winter	Moisture, freeze-thaw damage or a failing connection	Reader gasket, conduit, wiring and weather protection
Automatic operator activates while the door remains secured	Incorrect sequencing between the operator and lock	Relay timing and operator integration
Door alarms appear without a corresponding event	Loose door contact, door movement or wiring fault	Contact alignment, cable connections and event logs
Controller goes offline during an outage	Failed battery, unprotected network equipment or power supply fault	Battery load, UPS condition and network switch backup

3. Review Access Levels, Schedules and Exceptions

Permissions often become more complicated as a building adds tenants, departments and contractors. An audit should determine whether access levels still reflect how the property operates today.

Review:

Main entrance and after-hours schedules
Restricted mechanical, electrical and server rooms
Loading dock and delivery access
Elevator floor permissions
Parking garage and storage access
Holiday and weekend schedules
Temporary event access
Tenant separation in multi-tenant properties
After-hours access for cleaners and service contractors

Watch for “permission creep.” This happens when a person changes roles but keeps access from their former position. Over time, one credential can accumulate access to areas the person no longer needs.

Any manual override or extended schedule should also have an owner and an expiry date.

4. Confirm Alarms, Logs and Connected Systems

Access control records are useful only when events are accurate, easy to identify and reviewed when something unusual happens.

Test whether the system properly records:

Access granted and denied
Door forced open
Door held open
Controller communication loss
Reader or lock faults
Changes to user permissions
Administrator activity
Emergency releases

Check that controller, camera and intercom timestamps match. If the access log says a door opened at 9:42 p.m. but the corresponding video shows 9:35 p.m., an investigation becomes harder than it needs to be.

Where systems are connected, confirm that an access event brings up the correct camera, entrance or intercom station. Excessive false alarms should also be corrected. Staff will eventually ignore a door alarm that activates several times every day.

5. Test Backup Power and Emergency Operation

A commercial access control system must behave predictably when power, network communication or a controller fails.

The audit should include authorized testing of:

Control-panel batteries
Lock power supplies
Network switches supporting the system
Uninterruptible power supplies
Local controller operation during a network outage
Fire alarm release connections, where required
Manual release procedures
System restart and event recovery

A door may be configured as fail-safe or fail-secure depending on its purpose and the applicable life-safety requirements. This setting should not be changed simply to correct a security complaint.

The Ontario Fire Code addresses locking and opening requirements for exit and access-to-exit doors. Required exits generally need to be readily opened from inside without keys, special devices or specialized knowledge, subject to specific approved arrangements. Security controls must not prevent safe egress.

Emergency testing should be coordinated with the appropriate fire alarm, security and building personnel so that occupants and monitoring stations are not caught off guard.

6. Check Accessibility at Controlled Entrances

Access control can unintentionally create an accessibility barrier when the reader, lock and automatic door operator do not work together.

For barrier-free entrances, check:

Reader or activation-control mounting position
Clear floor space in front of the control
Reach range for people using mobility devices
Operating force required to use the control
Time allowed between presenting a credential and opening the door
Door opening and hold-open time
Audible and visual confirmation, where required
Automatic operator and lock-release sequencing
Clear travel through the doorway
Whether winter mats or salt buildup obstruct the threshold

Ontario’s 2024 Building Code has been in effect since January 1, 2025, and contains the province’s current accessibility requirements for most new construction and extensive renovations. Its barrier-free provisions include requirements for building controls and, where a building security signal is intended for the public, audible and visual indication.

CSA/ASC B651:23 also provides technical requirements for accessible buildings and controls. Whether a particular provision applies will depend on the property, project specifications and the authority reviewing the work.

The AODA, Ontario Building Code and existing-building obligations should be considered together. Federally regulated organizations must also consider the Accessible Canada Act, which addresses barriers within federal jurisdiction.

7. Record the Findings and Set Priorities

An audit should end with a written list of findings, not just a verbal summary.

Each issue should identify:

Building and door location
Device or credential affected
Test result
Security, operational or accessibility impact
Recommended correction
Person responsible
Target completion date
Date the repair was verified

Issues involving required egress, emergency release, active credentials belonging to former users or doors that cannot secure should receive immediate attention.

Intermittent readers, weak backup batteries and repeated nuisance alarms should be scheduled next. Database naming, reporting and other administrative improvements can then be handled as planned system work.

The Canadian Edge: Cold Weather Changes Door Performance

Toronto access-controlled entrances operate through substantial changes in temperature, moisture and air pressure.

Autumn Grit Becomes Winter Salt

Grit tracked into an entrance collects around thresholds, strikes and lower pivots. Once winter begins, road salt adds moisture and chloride corrosion. The door may still open, but debris around the threshold can prevent the final few millimetres of movement needed for the latch to engage.

Metal and Seals Move in the Cold

At temperatures approaching -30°C, metal components contract and door seals become less flexible. Lubricants may also thicken. A strike that worked properly in September can begin binding in January because the door, frame and locking hardware are no longer sitting in exactly the same position.

Stack Effect Changes Door Pressure

In taller buildings, warm air rises and creates pressure differences between the interior and exterior. This stack effect can pull or push on lobby doors, making them harder to open or preventing the closer from completing the final latching movement.

Increasing closer force may appear to solve the problem, but it can also make the entrance harder for someone with limited strength to use. The door, closer, seals and access-control sequence need to be assessed together.

Freeze-Thaw Cycles Affect Exterior Devices

Moisture can enter reader housings, conduit and exterior connections. When that moisture freezes, the reader may work intermittently or stop responding. Outdoor equipment should be checked for failed seals, corrosion and water entry before winter.

Commercial Access Control Audit Checklist

Frequently Asked Questions

How often should a commercial access control system be audited?

A full audit should generally be completed at least once a year. Buildings with frequent tenant, employee or contractor changes should review user permissions quarterly. An additional review should follow a security incident, renovation, tenant move or major system change.

Does a green reader light mean the door is secure?

No. It only shows that the credential was accepted. The strike, latch, closer and door contact must also operate correctly, and the door must secure after the person enters.

Will every controlled door release during a power failure?

Not necessarily. Different doors may be configured differently based on security and life-safety requirements. The approved operation of each opening should be tested and documented.

Is an access control audit required by the AODA?

The AODA does not create one blanket annual access control audit requirement for every property. However, an access-controlled entrance should not create an accessibility barrier, and Ontario Building Code requirements may apply depending on the building and scope of work.

Can an audit be completed while the building is occupied?

Most routine testing can be staged during normal operations. Power-failure, fire alarm and emergency-release tests may require advance planning with property management, occupants and monitoring providers.

Schedule an Access Control Audit in Toronto

If your building has changed tenants, added new credentials or developed doors that need a second pull to secure, it is time to check the complete system.

ACS Systems installs and services commercial access control systems across Toronto and the GTA. Schedule an audit to review credentials, controlled doors, system records, emergency operation and accessibility concerns before they lead to a security failure.

Contact ACS Systems to arrange an access control assessment.

Secure Your Space Today! Contact ACS Systems for Custom Security Solutions Tailored to Your Needs. +1-888-833-6597

Commercial Access Control Audit Checklist for Toronto Buildings