Contractors at a civic garage routinely share one badge to speed entry. Some leaders call the habit 'security theater' and leave it off the risk list. How should the risk manager treat badge sharing?
Select an answer to reveal the explanation.
Short Explanation
Sharing a badge is like handing out master keys at a hotel—you lose who went where and when. That is personnel and access risk, not theater. It ties straight to physical entry and whatever systems sit behind those doors.
Full Explanation
Routine badge sharing at a civic garage is a personnel and access-control risk with physical and information implications because shared credentials destroy individual accountability and enable unauthorized entry to vehicles, tools, keys, and any systems reachable once inside. Leaving the habit off the risk list after someone dismisses it as security theater confuses cultural skepticism with evidence-based identification of weak access practices. Accounting-period timing issues have no conceptual link to physical access integrity or contractor entry control. Weather-related ice-melt inventory is an environmental housekeeping topic, not badge governance. Supplier bankruptcy belongs in procurement continuity analysis and does not explain credential pooling among on-site workers. Access control failures often bridge physical and information domains when badges also unlock network closets or wireless credentials travel with people. Exam caveat: informal workarounds that speed throughput still remain reportable risks; speed claims do not retire classification duties. Operational check: enforce one-badge-per-person issuance, revoke shared credentials, audit door logs for impossible simultaneous-use patterns, brief contractors on entry rules, and ensure garage access weaknesses appear on the operational risk register with a named owner and review date.