Visitor Records for ISO 27001 and Factory Audits

Published on 10/21/2026 • Updated on 10/22/2026

A precision machining company in Rajkot is two weeks from its ISO 9001 surveillance audit when the quality manager runs a self-check on the physical security records. The visitor register exists and is current; the problem is everything around it. There is no documented procedure for who may enter production areas, no record linking specific visitors to the areas they entered, no evidence that the register is reviewed, and no defined retention period, so the oldest registers are in a storeroom and the newest are on the guard's desk. The self-check closes with four gaps against clause 7.5 (documented information) and the physical-security expectations that customer audits layer on top. Two weeks is enough time to fix the documents; it is not enough time to create a year of records that never existed.

ISO audits and factory audits treat visitor records as documented information with the same rules as any controlled record: defined, current, retrievable, protected and retained on a schedule. This guide walks through making your visitor records audit-ready: what auditors actually ask for, how to structure the records, the retention and review discipline, and how digital records change the audit conversation. It pairs with our regulation-by-regulation guide to visitor software compliance (OSHA, GDPR, ITAR, ISO) and our guide to visitor log retention periods.

What the auditor actually asks for

The visitor-records portion of a factory audit is rarely the headline, but it is where auditors calibrate how seriously to take the rest of your documentation. The questions follow a stable pattern across ISO 9001, 14001, 45001, 27001 and the customer-specific audits (IATF, BRCGS, brand codes) that layer on top:

• Show me your procedure for visitor access: who approves, who may enter which areas, and how visitors are identified and escorted.
• Show me the records: a sample of visits from specific dates, with identity, purpose, host, areas accessed and times.
• Show me the review: evidence that someone checks the records (a signed review, a log, an exception report).
• Show me the control: how records are protected from loss, alteration and unauthorised reading, and how long you keep them.

Each question has a failure shape that auditors recognise instantly. The procedure that exists but does not match practice (the register has no "areas accessed" column the procedure promises). The sample that cannot be retrieved for a chosen date. The review that is claimed but unsigned. The retention answer that is a shrug. None of these are hard to fix prospectively; all of them are impossible to fix retrospectively.

The record structure that answers

A visitor record that answers the audit questions carries a fixed set of fields per visit, every visit, no blanks:

• Visitor identity: name, organisation, and a verification anchor (OTP-confirmed phone, ID capture, or both for sensitive zones).
• Purpose and category: why they are here and which category (visitor, contractor, vendor, inspector), because the procedure treats categories differently.
• Host and approver: the employee accountable for the visit, and for controlled areas, the approver who authorised zone access.
• Areas or zones accessed: not "the factory" but the zones the badge authorised.
• Entry and exit timestamps: accurate to the minute, system-generated rather than written from a wall clock.
• Declarations: NDA, safety briefing, health declaration where applicable, signed and stored against the visit.
• Badge or pass number: so the physical artifact reconciles with the record, and unreturned badges show themselves.

Two structural rules make the fields trustworthy. First, mandatory capture: the record does not exist until the fields do, so a visit without a host or a zone cannot be created. Second, system-generated timestamps: the moment times are written by hand, the auditor must decide whether to believe the wall clock, and the answer is usually a finding. Our security guard visitor entry checklist maps these fields onto what the gate physically does at entry.

A field-complete log is still not "controlled documented information" until three disciplines wrap around it. Clause 7.5 cares less about what you capture than about whether the record is protected, reviewed and disposed of deliberately; most factories capture plenty and control nothing. These three disciplines are where the audit is actually won or lost.

Retention, review and protection

The three disciplines that turn a log into controlled documented information:

Paper vs spreadsheet vs digital records

The honest comparison against the audit questions:

Reader Q&A

Bottom line

This week, run the auditor's sample on yourself: pick three random dates from the last six months and retrieve the full visitor records for each, timed. If any date takes more than five minutes or produces gaps, that is your finding, found privately and early.

This quarter, write the procedure to match a record structure you can actually capture, make the fields mandatory at the gate, start the weekly signed review, and put retention on a schedule. The metric to watch is sample retrieval time; when every date answers in seconds, the visitor section of the audit becomes the easiest part of the day.