Why does physical access create continued risk after a transfer or termination?

Why physical access can stay risky after a transfer or termination

Physical access creates a separate trust path from digital access. If a badge, door controller, or guard process is not updated at the same time as HR and IAM records, the person can still enter spaces, reach shared equipment, or exploit after-hours movement even after the business considers them transferred or offboarded.

Where the exposure window comes from

The core issue is state divergence: HR may record the move or exit, but the physical access system can lag because it depends on manual updates, batch sync, contractor sponsors, or facility-specific workflows. That lag matters because physical access is often what protects offices, labs, plants, badge-controlled storage, and meeting rooms where sensitive information or assets can still be reached.

The risk is larger when access is role-based but not tightly time-bounded. A mover may retain access that no longer matches current duties, while a leaver may still be able to enter long enough to observe, remove, or damage something before the badge is finally revoked.

Why physical and logical offboarding must be treated as one control problem

Termination is not complete when network access is removed if the person can still walk into a controlled site. Physical entry can support tailgating, device access, badge reuse, or social engineering at reception and help desks. That is why joiner-mover-leaver controls need to cover both digital entitlements and facility access, not just one or the other. Joiner-Mover-Leaver (JML) Guide

Practitioners should also treat badge credentials as part of the identity lifecycle. A physical credential is still an access control object, even if it is not a login, so it needs the same discipline around issuance, review, expiry, revocation, and exception handling that you would expect for other access paths. IAM and IGA Basics

Risk and Threat Considerations

Physical access after transfer or termination can turn an administrative delay into a real security exposure. The main problem is not just that someone still has a badge, it is that the badge may preserve proximity to assets, people, and processes that were supposed to be out of reach once the employment or role change took effect.

Failure mechanism: The organisation updates HR records, but facility systems, turnstiles, guards, or local site administrators do not revoke or re-scope access immediately. The former employee or moved worker then keeps entry rights during the gap, which creates a window for unauthorized entry, asset removal, observation, or misuse of common areas and restricted zones.

Impact: That gap can enable insider misuse, opportunistic theft, privacy exposure, equipment tampering, or social engineering from inside the perimeter. In higher-risk sites, the consequence is not just entry, but the ability to bypass other controls because physical presence often lowers scrutiny.

Practitioner Guidance

What to verify: Confirm that badge disablement follows the same authoritative event as digital deprovisioning, with the same or better service-level timing. Where that is not true, treat the physical path as a separate exception register, not as a benign delay.

Decision rule: If a mover or leaver can still access a restricted area after the business change is effective, prioritise physical revocation and access reconciliation before relying on any downstream review. If the site hosts sensitive assets, consider same-day revocation as the default and require explicit exception approval for any delay.

What good looks like: The facility team, HR, and identity owners can all show the same current access state, with a clear record of who approved any temporary retention, when it expires, and how it is removed. Workforce Identity Security Guide

Common mistake: Assuming physical access is low risk because it is “just a badge.” In practice, it is often the last remaining path into systems, records, and equipment after logical access has already been cut off.

Practitioner takeaway: The control objective is not merely badge removal, it is eliminating any period where a person’s physical access outlives their legitimate business need. That requires synchronized offboarding, not parallel processes that may drift apart.

Related resources from NHI Mgmt Group

• When does JIT access create more risk than it reduces?
• Why do non-human identities create more audit risk than human accounts?
• Why do non-human identities create audit risk in modern environments?
• Why do non-human identities create compliance risk even when policies exist?