Security audit checklist for NZ businesses

Most security audits are pages of generic risk-management language that nobody acts on. This checklist is the opposite: concrete questions, with what a good answer looks like, organised so you can work through it with a notebook in 60–90 minutes. Use it before an insurance renewal, after a near-miss or break-in, or as part of an annual board pack.

1. Perimeter and external risk

• Are external doors, windows, and roller doors closed and locked at the end of every business day? Good answer: documented closing checklist with sign-off.
• Is fence-line condition still adequate (gates close, no breaches)?
• Is external lighting working at all entry points and yard areas? Test at night, not from a daytime walk-through.
• Are external CCTV cameras pointing where they should? Lenses clean? IR illuminators clear of cobwebs?
• If the site has yard storage, is high-value stock visible from the street? Can it be moved or screened?
• Is there an after-hours delivery process? Documented? Do drivers have a way to be verified before access?

2. Access control

• Are physical keys still in circulation? If so, do you know who has each one? Good answer: keyed locks have been retired in favour of revocable credentials.
• When did the access user list last get reviewed? Are leavers still on it?
• Are contractor and visitor credentials time-limited?
• Does the access platform integrate with HR for instant revocation on termination?
• Is the audit log being reviewed periodically — or only after an incident?
• Does each emergency-egress door comply with NZ Building Code D1 (free egress without key, REX + break-glass on mag-locks)?

3. CCTV

• Is CCTV signage visible at all entry points, in both English and a relevant second language if your visitor profile suggests it?
• Is footage retention what you actually need (not what was set on day one)? Documented under the Privacy Act 2020?
• Can you actually pull a clip from each camera if asked? When did you last test?
• Is the NVR clock accurate? Is the firmware current? Are admin passwords still default?
• Are privacy masks still applied on cameras facing public space or neighbouring property?
• Are user accounts on the NVR / VMS limited to people who currently need access?

4. Intruder alarm

• When was the alarm last tested end-to-end (each sensor triggered, signal received at panel and at monitoring station if monitored)?
• Are user codes individual to each user (not shared)? Are leaver codes still active?
• Is the panel battery less than 4 years old? (They die at 5–7 years; replace at 4 to be safe.)
• Does the comms path have a backup (IP + 4G dual-path)?
• Is the monitoring contact list up to date? Tested?
• Does the panel installation comply with AS/NZS 2201? Do you have a written commissioning record?

5. Insurance and compliance

• Does your insurer have current evidence of professional alarm install and ongoing maintenance?
• Have you reviewed your CCTV retention against Privacy Commissioner guidance recently?
• If you handle regulated goods (food, pharma, hazardous), does your CCTV/access set-up support audit requirements (HACCP, GMP)?
• If you run a school, ECE, or healthcare site, do you have documented child-safeguarding controls on CCTV access and footage handling?
• Do you have a written CCTV / access policy signed off by the board or owner?

6. Cyber and IT-adjacent

• Is the NVR / access controller / alarm panel reachable directly from the internet (via port-forward)? If yes: bad. Move behind VPN or cloud relay.
• Are firmware updates applied within 90 days of release for all security devices?
• Is there a documented response plan if a security device is compromised (NVR ransomware, access platform breach)?
• Are biometric templates (where used) stored and accessed with appropriate controls? Documented under Privacy Act 2020?

7. Operational and human

• Are staff trained on alarm arm/disarm, who to call after-hours, what to do during a duress event?
• Is there a documented opening / closing routine? Sign-off?
• Is there a panic / duress procedure for retail and hospitality sites?
• Is there a documented response for a lost or stolen credential?
• When was the last incident drill?

What to do with the results

For each red answer (something missing, broken, or out of date), assign an owner and a deadline. Most issues are 30-minute fixes (replace a battery, revoke a leaver, update firmware). The hard ones — replacing keyed locks with access control, upgrading from analog DVR to IP, implementing privacy-policy sign-off — are projects worth quoting separately.

Read next

CCTV cost guide · Access control buyer's guide · CCTV maintenance checklist