Visitor management: a practical process from invitation to sign-out

Visitor management is the process of coordinating a person’s visit, from invitation and arrival through approved access, on-site responsibility, departure and record disposal. Start by assigning an owner and a confirmation at every handoff, rather than treating sign-in as permission to enter.

The following is a recommended operating procedure for local approval, not a universal legal standard. Name duty staff and backups before using it.

For the technology boundaries behind this process, see the visitor management system decision guide.

Recommended exception rules:

• Walk-ins: record the arrival and purpose, then seek an authorised decision. Keep entry pending at the designated waiting point.
• No host response: escalate to the named backup, then the duty manager; never interpret silence as acceptance.
• Assistance: offer staffed registration and accessible communication. Ask what practical assistance is needed, rather than requesting a diagnosis.
• Declined entry: explain the decision privately, record the decision-maker and necessary reason, and confirm departure. Refer threatening behaviour through the site security procedure.
• Contractors: refer induction, qualifications and permission to work to the designated work supervisor; do not resolve these through ordinary guest approval.

Charles Sturt University’s procedure illustrates this distinction: its contractors require pre-qualification and written authority before work, while controlled-area access has separate supervision and authorisation rules. These are CSU requirements, not rules for every workplace. CSU procedure

Hypothetical escalation example: reception contacted an unavailable host, then the authorised backup after the locally agreed response window. The backup could not accept responsibility, so the duty manager rescheduled the visit. Reception recorded the outcome and departure. Set response windows locally, not as universal mandatory limits.

Use the contractor induction exception procedure for that separate handoff.

Recommended fallback: have the duty manager authorise a controlled paper log or tested offline process. Reception should use a working host-contact channel and preserve required checks. Hold or reschedule visits when no approved alternative exists. IT should verify recovery; reception should reconcile queued and manual records before closing the incident.

For missing sign-outs, contact the host, establish the departure evidence and record who corrected the entry. If departure time is unknown, say so; do not invent it or clear every entry at closing time.

Keep recorded occupancy separate from physical accountability. Mark stale lists, missing entrances and uncertain visitors explicitly, and hand those gaps to the emergency coordinator.

Safe Work Australia’s emergency-planning guidance calls for workplace-specific arrangements covering visitors, communication, testing, training and assistance needs. Follow that plan during emergencies rather than troubleshooting registration.

Recommended minimum record: visitor name, visit reference, host, site or destination, purpose category, arrival time, acceptance decision and time, responsible host or escort, departure confirmation and any unresolved exception. Add organisation, contact details or credential reference only where needed. Prefer check outcomes over unnecessary document copies.

OAIC’s APP 3 guidance, updated 13 May 2026, requires APP entities to limit collection according to necessity and recommends data minimisation. OAIC collection guidance

Have the privacy or records owner document why each record category is needed and when that need ends. Do not adopt a universal retention period. APP 11 guidance, updated 3 October 2025, requires reasonable protection and destruction or de-identification when information is no longer needed, subject to Commonwealth-record and legal-retention exceptions. OAIC security and disposal guidance

Restrict reception to operational records, hosts to relevant visits and administrators to approved configuration, export and disposal duties.

Recommended operating checks: facilities should train reception, hosts, security and administrators on their own decisions, backups and handoffs. Rehearse a walk-in, inaccessible registration, absent host, declined entry, outage and missing sign-out.

Measure consistently:

• Time to host acceptance: acceptance timestamp minus arrival timestamp; report the median for accepted visits and count unanswered arrivals separately.
• Unresolved sign-outs: count visits whose departure remains unconfirmed at the agreed review point. Rate = unresolved visits ÷ visits due for review × 100.
• Exception ownership: check whether every open exception has a responsible person and next action.

Establish a local baseline before setting targets; review causes, not just averages.

Recommended replacement trigger: consider moving beyond paper when staff cannot reliably retrieve current visits, protect records, obtain approvals or reconcile departures—not merely because a kiosk looks modern.

First identify the actual problem. Microsoft Bookings documents appointment scheduling and Outlook integration; that addresses a different task from this reception procedure. Microsoft overview, updated 17 August 2026

Use the comparison scorecard to turn failed handoffs into software acceptance tests, then consult the product shortlist. Request quotations covering sites, modules, devices, messaging, integrations, consumables, training, support and internal administration. Keep unconfirmed costs and capabilities marked unknown.