So far in this series we have focused on keeping bad things out and making buildings run better.
This time we are asking a different question. If something goes wrong, do you really know who is on site, whether they are allowed to be there, and how to reach them quickly?
If you are a CIO or IT leader, this is where access control data becomes part of your health and safety, compliance and incident response world. It is the moment you need accurate, reliable answers about who was where and when, and a calm way to prove you followed your own rules.
The good news is that you already have most of the building blocks. Your access control system quietly tracks:
- Who has badged in and out
- Which areas they used
- What permissions and competencies they hold
This part introduces three pillars that turn access data into a practical safety and compliance tool, not just a way to open doors:
- Competencies and rules
- Tag boards and muster lists
- Broadcast notifications and emergency communication
Along the way we will keep your job clear. Your role as CIO is not to write the rules. Safety teams lead that. Your job is to ensure systems reflect those rules, stay in sync and produce a clean safety audit trail when someone asks difficult questions later.
Key Takeaways
- Access control data is the backbone of who-was-where safety and compliance answers
- Competencies turn safety rules into access rules the system enforces automatically
- Digital tag boards and muster lists give a live, trustworthy view during an incident
- Broadcast notifications reach the right people fast using live access data, not stale lists
Competencies: turning safety rules into access rules
Most organizations already have safety rules that depend on who a person is and what they are allowed to do. For example:
- Only trained staff can enter a high-risk production area
- Only inducted contractors can work on a specific site
- Only people with current medical clearance can enter a confined space
- Only licensed operators can use specific plant or equipment
These are all competency-based rules. Someone needs to decide what counts as being allowed in, and someone needs to check that the rule is being followed.
With Gallagher Command Centre, competencies can be stored against each person record and used as part of the access decision. This means the access control system starts asking extra questions such as:
- Does this person have the required training
- Has their site induction expired
- Does their license or medical clearance run past today
If the answer is no, the door simply does not open. The system becomes the enforcement point instead of the person at the gate who has already had a long shift.
From a safety point of view, this moves you from posters and good intentions to rules that are enforced whenever someone badges at the door.
From a CIO point of view, your role is to connect the data plumbing to those rules.
Safety and operations teams decide which competencies are needed. Your job is to make sure those decisions live in systems that stay in step: access control, learning management, contractor portals, and HR.
Good questions to ask are:
- Which competencies matter for health and safety, and where they are recorded today
- Which system is the system of record for each competency
- How that data links to the person record in the access control system
- How expired training, licenses or inductions are handled so that access rules stay current
Once you get this right, your doors quietly become part of your safety and compliance machinery.
Tag boards and muster lists: knowing who is where
Traditional tag boards used plastic tags to show who was in or out. The idea is simple. People move their tag when they arrive or leave, and in an emergency, you scan the board to see who should be at the muster point.
Digital tag boards replace this with real-time access data and they can:
- Show a live list of people currently on site
- Display who is in specific zones such as production areas, labs, or remote yards
- Apply simple capacity limits to areas
- Generate reports that show who was where at a given time
During muster lists and evacuation drills, those digital tag boards effectively become your live muster lists. They answer questions such as:
- Who badged into this site today and has not yet badged out
- Who is likely to be in this zone, based on the doors they used
- Which work areas need priority checks
In a routine day they are simply helping operations. During an emergency, they become your safety and compliance reporting tool.
From an IT and data perspective, the same questions appear as in the rest of this series:
- Are all entry and exit points reliably captured
- Does the tag board reflect how people actually move, or are there ways around it
- How long do we keep detailed movement data
- Who can view named movements compared to aggregated counts
This is where access control data for safety meets privacy and trust. You want safety teams to see a clear, current picture of who is on site and in key areas, without turning the system into a tool for micromanaging people’s days.
Digital tag boards and muster lists work best when they are:
- Accurate enough to matter in an incident
- Simple enough that people actually use them
- Governed enough that privacy questions have real answers
Broadcast notifications: reaching the right people fast
When an incident occurs, an all-staff email is rarely effective. Not everyone on site is checking email and not everyone who receives the alert is affected.
This is where broadcast notifications driven by live access control data is powerful.
Gallagher’s broadcast tools let you use Command Centre to determine:
- Who is on a given site right now
- Who was in a specific area during a defined time window
- The best contact method such as SMS, mobile app, email, or local screens
On top of that you can build targeted broadcast notifications for events such as:
- Fire alarms and evacuations
- Chemical spills or localised hazards
- Severe weather that affects certain sites
- Security incidents or lockdowns
- Planned drills and route changes
Messages can be sent to:
- Everyone currently on a site
- Everyone currently in a zone or area
- Everyone who was in a specific area during a defined time
Because the broadcasts use live access control data, you avoid the classic problem of out-of-date contact lists and guessing who might be present.
From a CIO perspective, the design questions look familiar:
- What is the source of truth for who is on site and how to contact them
- How broadcast tools fit into your wider incident management and emergency notification processes
- How messages are triggered, for example manually, via specific alarms, or from external systems
- How you avoid alert fatigue by keeping targeting as tight as possible
- How you capture acknowledgements and message history for your safety audit trail
The technology is the easy bit. The value appears when safety, operations and IT agree on simple, predictable rules for when to send what, to whom, and how everyone checks that the system is working before they need it for real.
Your role: The glue between safety rules and systems
Safety teams write the rules. IT teams know how systems talk to each other. Health and safety leaders care about audits and evidence. Your role sits across all three.
By this point in the series, you have already seen access control as a data source, as an integrated hub and as a governed IT system. Safety and compliance are where all three of those views come together.
Your responsibilities include:
- Helping choose systems that can store competencies and link to your person records
- Ensuring access control systems, learning tools and contractor portals can talk to each other
- Making it easy for safety teams to see who is on site and in key areas
- Supporting broadcast tools that use current access data, not last week’s spreadsheet
- Providing clear safety reporting alongside normal IT dashboards so it does not live in a separate world
When something happens, the questions are predictable:
- Who was on this site
- Who was in this area
- Were they allowed to be there
- How did you contact them
- How can you prove it
If your access control, competencies, tag boards and broadcast tools are set up well, those answers come from simple queries and clear reports, not three days of manual reconstruction.
A quick safety and compliance checklist
You do not need a large project to begin. Pick one site and walk through these three steps with your safety and facilities teams.
1. Rules and data
- List the key safety rules that depend on location, such as high-risk areas, induction requirements, or limited access zones
- For each rule, note what data it depends on, for example training records, contractor status, license expiry, medical clearance
- Mark where that data lives now and which system is the system of record
2. Live view of who is where
- Sit down with your access control or Command Centre operator and look at your current tag board or equivalent views
- Can you see who is on site, and who is in the most critical zones, with enough confidence to trust it in an incident?
- Check how this view is shared with safety teams, and whether it is easy to use during muster lists and evacuation drills
3. Reach and response
- Review how you would send a message to everyone on a site right now, and everyone in a specific zone
- Check whether that depends on static contact lists or whether it can use live access control data
- Confirm how you would prove what was sent, to whom and when, as part of safety and compliance reporting
Then choose one small improvement and make it real.
For example:
- Start enforcing one critical competency for a single high-risk area
- Improve the accuracy of one digital tag board or muster view
- Add one targeted broadcast template and test it in a drill
Small, concrete changes like these are more valuable than a dozen theoretical projects. They also give you quick wins to talk about in health and safety committees and risk reviews.
What comes next
You now have a picture of how access control data supports health and safety, muster lists and evacuation, compliance reporting across competencies, tag boards and broadcast notifications.
In the final part of this series, we will look ahead at the future of physical security.
We will explore how cloud access control, mobile credentials and more cloud-connected services influence your design choices, and how to stay flexible as new technologies such as frictionless access, asset tracking, and smarter maintenance emerge.