Every August, the same thing happens at businesses across Chicago. Summer interns wrap up their last week. Seasonal staff finishes out. Contractors complete their projects and pack up their tools. Everyone shakes hands, exchanges pleasantries, and goes their separate ways.
And in almost every case, their access credentials stay active.
Key fobs that open the back door. Alarm codes that disarm the panel. Proximity cards that badge into the server room. User accounts on internal systems. In a well-run organization, these get deactivated the moment someone walks out the door. In most businesses, they linger for weeks — sometimes months, sometimes indefinitely.
This is one of the most overlooked physical security exposures that commercial businesses carry, and late summer is exactly when it peaks. Here is how to fix it.
It is not that businesses do not care about who has access — it is that deactivating credentials requires someone to own the task and have the tools to do it quickly. In many organizations, those two things are missing.
Traditional access control systems — keypads, key fob panels, basic proximity card readers — require a technician or admin to manually remove credentials from each door controller. If your system is older or was never set up with a centralized management interface, the process can be slow and inconvenient enough that it gets deferred. And deferred tasks in security become permanent vulnerabilities.
The result is credential sprawl: a growing list of active credentials attached to people who no longer work for you, contractors who finished their engagement months ago, and former employees whose departures may not have been entirely amicable. Any one of those credentials represents an unlocked door — literally.
A common scenario: A Chicago business completes a facility renovation in June. The general contractor had five workers on site with building access. The project wraps up. Invoices get paid. Nobody thinks to pull the credentials — and all five fobs are still active in October.
A credential audit is a systematic review of every active access credential in your system and the person — or former person — it is attached to. Done properly, it answers three questions:
The output of the audit is a clean, current credential roster: every active credential is attached to a current, authorized person with a legitimate reason for having it. Everything else gets deactivated.
Late summer is the natural inflection point for credential hygiene for a few reasons. Summer hiring winds down, so you have a defined class of people to remove. Project-based contractors are often wrapping up before fall budgets kick in. And businesses that are thinking ahead are already planning for the busy Q4 season — tightening access before the holiday retail rush, increased foot traffic, and year-end vendor activity is exactly the right instinct.
Running the audit in August also gives you time to address what you find. If your system makes it hard to pull credentials quickly, you will discover that now rather than when you actually need to act fast. If you find credentials attached to people you cannot even identify anymore, that is a signal your access control management needs a structural fix before the problem compounds further.
If you are running a legacy access control system — one that requires on-site programming, a dedicated software installation, or a call to your security contractor to make credential changes — the audit process is genuinely painful. Pulling 20 credentials requires scheduling time, logging into an older interface, and manually working through each door controller. Most businesses put it off precisely because it takes too long.
Cloud-based access control systems change this entirely. Every credential in the system is managed from a single web dashboard or mobile app. Deactivating a credential takes seconds — you pull up the user, toggle them inactive, and the change propagates across every door in the system immediately. You can see the last time each credential was used, pull reports by department or access group, and set credentials to automatically expire on a specific date so contractors and temporary staff are removed without anyone having to remember to do it.
The audit becomes a 20-minute administrative task instead of a half-day project. And automatic expiration dates mean you can prevent credential sprawl before it starts.
A credential audit is also the right time to review access levels, not just whether credentials are active. Over time, access tends to accumulate — people get added to access groups for temporary projects and never get removed, or a "just in case" permissions grant becomes permanent by default.
The principle of least privilege applies to physical access the same way it applies to network security: every person should have access to exactly the spaces they need to do their job, and nothing more. Reviewing access levels alongside the credential list often surfaces situations like:
None of these are necessarily intentional security failures — they are the natural result of a system that makes it easier to grant access than to revoke it. The audit corrects the drift.
If your credential audit surfaces a large number of orphaned or unrecognized credentials, that is a sign of two things: a backlog to clean up now, and a process problem to fix for the future.
The backlog gets addressed by deactivating everything that is not clearly associated with a current, authorized person. If you cannot identify who a credential belongs to, deactivate it. If a former employee's credential is still active, deactivate it. Default to removal when in doubt — it is far easier to reissue a credential to someone who legitimately needs it than to deal with the consequences of an unauthorized entry.
The process fix usually requires one of two things: either building a tighter offboarding checklist that includes credential deactivation as a required step, or moving to a system where credentials automatically expire and the default state is no access rather than continued access. Modern cloud access control platforms support both approaches.
Best practice: Tie credential deactivation directly to your HR offboarding workflow. The moment a departure is confirmed, access should be revoked — not when someone gets around to it.
PowerTech Group of Chicago has been managing commercial access control across the Chicago metro area since 1993. We work with businesses on both sides of the credential management problem: helping clients run audits on existing systems to identify and close exposure, and upgrading legacy systems to cloud-based platforms that make ongoing credential hygiene simple enough to actually happen.
If you are running an older system and the audit process sounds painful, that is worth a conversation. The cost of upgrading to a cloud-managed platform is typically far less than businesses assume, and the operational difference — being able to manage access from your phone, set automatic expiration dates, and see a real-time audit trail of who entered where and when — changes how your team thinks about access control entirely.
If you are already on a modern platform and just need help structuring the audit process, we can walk through that with you as well.
PowerTech Group of Chicago can help you run a credential audit or upgrade your system to one that makes access management simple. Talk to our team today.
Schedule a Security Review