Vulnerability Assessment: The 10 Transaction Test | TouchPoint
06 MIN • COGENT

Give Us 10 Transactions From Your Facility. We Will Show You Where You Are Vulnerable.

Vulnerability assessment

Most facility heads are confident their operations are under control.

Not overconfident. Just quietly confident. The system is running. Nobody has raised a flag. The last audit went smoothly. So when someone suggests there may be gaps in their facility's access control, the natural response is - where exactly?

Fair question. Here is our answer.

Give us 10 transactions from your facility. Any 10. A visitor entry from last week. A material gate pass from yesterday. A contractor who has been coming in for the past month. We will look at each one against a simple compliance standard - and we will show you where the vulnerability is.

We have never done this exercise with a facility and found nothing.

What we mean by a transaction

A transaction is any event at your gate. A person entering. A material moving. A vehicle arriving. A contractor checking in. Your facility generates hundreds of these every day. Most of them are recorded somewhere - in a register, in a system, in a spreadsheet.

What we are asking is not whether they are recorded. We are asking whether they are compliant.

These are different questions. And most facilities have never asked the second one.

One visitor. What does compliance actually require?

Pick any visitor who came to your facility last week. Now answer these honestly.

  • Was this visit pre-approved before they arrived - or did they just show up and sign in?
  • Was their identity verified against a pre-approved list - or was their ID collected and filed?
  • Did they complete a safety induction before they entered - with a digital record of completion?
  • Were they restricted to specific zones - or did they have free movement once inside?
  • Did they exit at the time they were supposed to - or is there no exit record at all?

Five questions. One visitor. How many can you answer with documented evidence - not memory, not assumption, but a record you can pull up right now?

For most facilities, the honest answer is one or two. The visitor was logged. That is all.

One material movement. Same test.

Pick any outward gate pass from this week. Now answer these.

  • Was the movement authorised before the material left - with a named approver and a defined purpose?
  • Was the quantity verified against a document at the gate?
  • If it was a returnable item - is there a due date recorded, and has the item come back?
  • Is there a complete chain of custody - from the moment it left to wherever it went?

Again, five questions. One gate pass. Most facilities can answer the first one - sometimes. The rest are gaps.

Compliance diagram

One contractor. The most revealing test of all.

Pick any contractor who walked into your facility this morning. Now answer these.

  • Are their documents - insurance, safety certificate, medical clearance - valid today, not at onboarding six months ago?
  • Did the system check this automatically, or did a guard check it manually, or did nobody check it at all?
  • Has their safety induction been renewed since it was first completed?
  • If something happened to them on your premises in the next hour, could you produce a complete compliance trail within 30 minutes?

One contractor. Walking into your facility right now. And for most organisations, the honest answer to the last question is no.

This is the vulnerability

We are not describing extreme scenarios. We are describing ordinary Tuesday morning transactions at large, well-run facilities with real compliance intentions.

The vulnerability is not that facilities are careless. It is that the gap between recording a transaction and proving compliance is invisible in normal operations - and only becomes visible at the worst possible moment.

An audit. An incident. A regulatory inspection. A legal dispute.

By then, the question is no longer "where is the gap?" The question is "how much does the gap cost?"

The stress test

This is what we call the stress test. Not a product demo. Not a sales conversation. A diagnostic.

Take any 10 real transactions from your facility - visitors, materials, contractors, in any combination - and run them against the five compliance questions above. Count how many you can answer fully, with documented evidence, right now.

If the number is 10 out of 10 - you are genuinely in good shape.

If the number is anything less - you now know exactly where your vulnerability is. And more importantly, you know what closing it actually requires.

Most facility heads who run this test are surprised. Not because their operations are poorly run - but because they have never asked this specific question before. The difference between a managed facility and a compliant one turns out to be narrower than they expected. And far more consequential.