What a Walk-Through Security Audit Actually Looks At
A plain-English tour of what a professional security auditor sees in your building. Entry points, sight lines, access, lighting, and the things you stopped noticing.
You stopped seeing it a long time ago.
Every space has things the people inside it have stopped noticing. The propped-open side door that has been propped open since 2019. The camera aimed at the ceiling because someone bumped it during a ladder move. The storage room with the master key that seven people have but only two remember having.
The purpose of a walk-through audit is not to catch you doing something wrong. It is to put fresh eyes on a space that is working hard for you every day and surface the things that stopped being visible.
This is what we actually look at when we walk your building.
We start outside.
The audit does not begin at the front door. It begins at the street. Before we step onto your property we note sight lines from the road, the state of your signage, the condition of your landscaping, and whether a passerby can tell what kind of organization operates here.
For churches, daycares, senior living facilities, and nonprofits in Fort Myers, Cape Coral, and Naples, the exterior signals a lot. A cared-for property signals a cared-for operation. Overgrown shrubs blocking a side window, a faded sign, or a parking lot with long-dead lights signal the opposite, and they matter to someone looking for an easy mark.
What we note on the exterior
- Line of sight from the road to every exterior door
- Lighting uniformity around the perimeter at night
- Landscaping that creates concealment near entries or windows
- Fence condition, gate function, and any gaps that have quietly appeared
- Parking lot flow, including emergency vehicle access
- The approach from every direction a visitor might come from
Every entry point gets counted.
A facility is the sum of its entries, not just its front door. On a walkthrough we count every way into the building: doors, windows low enough to matter, roof access, loading bays, utility access, and the occasional oddity like a chapel side entrance that was last locked in 1998.
Each entry gets three questions:
- Can it be reliably locked?
- Is it monitored (camera, alarm, or staff sight line)?
- Does it have a clear protocol for use?
A door that locks but has no protocol is a door that will be propped open. A door that is monitored by a camera with no one watching is a door that is not really monitored. A door with a protocol no one has read is a door running on hope.
Sight lines matter more than walls.
A well-designed facility allows trained staff to see what is happening in high-value spaces without having to actively patrol. The bad version of sight lines is called “dead space,” and every facility has some.
For a church, we want to see the lobby from the sanctuary entrance. For a daycare, we want to see every hallway from every classroom. For a senior living facility, we want to see every resident wing entry from a staffed position. For a nonprofit office, we want the reception desk to see every visitor before the visitor sees the reception desk.
Common sight-line gaps
- A lobby check-in that can’t see the front door because of a signage wall
- A classroom that can’t see the hallway because the window has been covered with art projects
- A reception desk positioned so visitors can walk past without being greeted
- A staff station angled at the wrong part of a resident corridor
None of these are catastrophes on their own. They are compound interest. Over a year, they generate dozens of moments when an incident could have been caught earlier but wasn’t.
Access control lives in the details.
“Access control” is a phrase that gets used loosely. In an audit, we mean something specific: who can go where, when, and with whose permission.
We look at:
- Keys and fobs. Who has them. When they were last used. What the termination process is when someone leaves.
- Codes. The keypad code that has been 1-2-3-4 since installation. The alarm code shared by eleven volunteers, three of whom no longer volunteer.
- Digital access. Logins to camera systems, monitoring accounts, and building management portals.
- Badge and visitor controls. Whether badges are actually worn. Whether visitors are actually escorted. Whether the visitor log is actually reviewed.
The pattern we find most often, across organizations in Lee and Collier counties, is not that access control is bad. It is that access control has never been reviewed. The system that was set up five years ago is still running, and the list of who is on it has grown, and no one has subtracted anyone.
Cameras get tested, not admired.
It is easy to look at a camera and feel secure. It is harder to determine whether that camera is actually doing work.
During a walkthrough we verify:
- Real coverage, not assumed coverage (walk where the camera is supposed to see, confirm it sees you)
- Image quality adequate for identification, not just presence
- Recording retention consistent with your incident investigation needs
- Storage health, because DVR hard drives in humid Southwest Florida conditions fail on a schedule nobody tracks
- Camera positions still aimed where they were installed (bumps, weather, and time move cameras)
- Whether someone actually looks at footage, and on what cadence
A well-placed camera with a dead hard drive is a prop. A well-placed camera with healthy storage that no one has checked in six months is a prop with better branding.
We talk to people.
A walkthrough that only involves walking is half an audit. The other half is conversation with the people who work in and around the space.
We ask staff and volunteers the questions leadership rarely does:
- What is the thing you've been meaning to tell someone about, but haven't?
- What would a new volunteer need to know on their first day that nobody tells them?
- If something went wrong on a Sunday morning, who would you actually call?
- Is there a part of the building or a time of day that gives you pause?
The answers are often the most valuable part of the audit. People who work in a space every day notice patterns. They just rarely have a forum to describe them.
The Southwest Florida layer.
Our region adds specific variables to every walkthrough:
- Humidity and salt air accelerate the failure of door hardware, locks, camera housings, and electronic access systems. An audit in SWFL always checks the physical condition of hardware, not just its design.
- Hurricane hardening overlaps with security hardening in useful ways. Impact-rated glass, storm shutters, and reinforced doors built for Ian-scale storms also happen to be better security than most standard construction.
- Seasonal attendance swings stress staff rosters, visitor volume, and volunteer availability in ways that affect how an audit should be read. A walkthrough in June for a Naples facility tells a different story than one in February.
- Tourism patterns affect unaffiliated-visitor volume at churches, event venues, and public-facing nonprofits. Facilities near Fort Myers Beach and Marco Island see flows that year-round facilities do not.
The verse is not a rebuke. It is a description. Seeing clearly is the prerequisite for acting wisely. The work of the walkthrough is exactly that: seeing, so that the next decision can be made with a clear picture.
What the walkthrough produces.
The walkthrough itself is observational. The value comes when those observations are organized, prioritized, and written into a plain-English report with a 30/60/90-day action plan. Every finding gets a risk rating. Every recommendation ties directly to a specific observation. No filler.
We have written a related piece on what those reports actually look like, and on the 30/60/90-day action plan that turns observations into progress. If you want to see the pattern, those are the next places to look.
When we walk a building, what we are doing is simple. We are seeing it the way someone would see it who does not have the habit of being inside it. Then we write it down. Then we hand it back to you.
If your facility in Fort Myers, Cape Coral, Naples, or Port Charlotte has not been walked with fresh eyes in the last year or two, we would be glad to do that work. You will not like every finding. You will be glad we found them.
Ready when you are
An honest audit, written the way a human writes.
Flat-rate. Plain-English report. 30/60/90-day action plan. We audit. You decide.
Request a flat-rate auditRelated Insights
Keep reading.
The 30/60/90-Day Security Action Plan Explained
A good audit ends with a 30/60/90-day plan. Here's how P23 decides what goes where, why pacing matters, and how to use the plan with leadership.
Alarms, Access Control, and the Technology Posture Review
Your alarm and access control only work if they are configured, tested, and actively managed. Here's what a technology posture review actually checks.
How an Annual Audit Fits Inside an fDoS Engagement
The annual audit inside a fractional Director of Security engagement is more efficient, more focused, and more comparative than a one-time audit. Here's why.