What Is an Access Control System and How Does It Work?

A building with no control over who enters which areas is not a managed facility — it is a security liability. Access control systems are the mechanism by which organisations define, enforce, and document the rules governing movement through their buildings. From a single door to a campus of fifty buildings, the underlying logic is the same: the right people get in, the wrong people do not, and every event is recorded. This article explains what an access control system is, how it works technically, the main types available, and why it is a core facility management responsibility.

An access control system (in German: Zutrittskontrollsystem, or ZKS) is an electronic security system that manages and monitors physical entry to buildings, rooms, or zones. It replaces or supplements mechanical keys with electronic credentials — cards, PINs, biometric data, or smartphones — and links those credentials to a database of permissions that specifies who may enter where, and at what times.

The key distinction between an access control system and a conventional lock is programmability. A mechanical key either opens a lock or it does not. A ZKS can grant a contractor access to a single service corridor between 08:00 and 17:00 on a Tuesday, deny that same credential access to all other areas, log the attempt with a timestamp, and automatically revoke the permission at midnight — all without issuing or collecting a physical key.

This programmability makes ZKS not just a security tool but an operational one. Facility managers use access control data to understand building usage patterns, manage contractor access, support compliance audits, and respond to incidents. The system produces a continuous, timestamped record of movement through a facility that no mechanical lock system can replicate.

Every access control system, regardless of scale or technology, consists of the same core components working together. The table below shows each component, its function, and a practical example.


Note: in networked and cloud-based systems, the controller communicates with a central server in real time. In standalone systems, the access rules are stored locally on the controller itself and updated manually.

Access control systems vary significantly in architecture, scale, and cost. Understanding the main types helps facility managers select the right solution for their portfolio.

• Standalone systems: a single controller manages one door independently, with no network connection. Access rights are programmed directly on the device. Suitable for small facilities with few doors, but cannot be managed remotely and produce no centralised audit log.
• Networked (on-premise) systems: controllers are connected via a local network to a central server running the management software. Changes to access rights propagate instantly across all doors. Standard for medium and large facilities; requires on-site server infrastructure and IT maintenance.
• Cloud-based systems: the management software and access rights database are hosted in the cloud. Administrators manage the system from any browser, without on-site servers. Updates, backups, and software maintenance are handled by the provider. Increasingly common for multi-site portfolios.
• Mobile access systems: credentials are stored on smartphones via a dedicated app, replacing physical cards entirely. The reader communicates with the phone via Bluetooth or NFC. Eliminates lost-card risk and simplifies remote credential management; requires employees to have compatible devices and the app installed.
• Biometric systems: credentials are physical characteristics — fingerprint, iris scan, or facial recognition. No card to lose or share, but require more careful data protection compliance under DSGVO and higher hardware investment. Typically used for high-security zones rather than general building access.

Most large facilities combine types: cloud management with networked controllers for the main building, standalone units for lower-risk secondary doors, and biometric readers at server rooms or sensitive areas.

Access control is often classified as a security or IT responsibility. In practice, it sits firmly within facility management — because the decisions it involves are operational, not purely technical.
The FM team manages the physical infrastructure: readers, locks, cabling, and controllers all require installation, maintenance, and periodic replacement. When a card reader fails, it is a maintenance job, not an IT ticket. When a door’s locking hardware needs adjustment, it involves the same trades as any other building hardware.

Beyond physical maintenance, FM is responsible for the operational logic of the system. Which areas require access control? Which staff roles need access to which zones? How are contractor credentials issued, tracked, and revoked? How is access provisioning coordinated with HR when employees join or leave? These are workflow questions that require FM and HR to operate in close coordination.

Access control also intersects directly with other FM responsibilities. Fire safety regulations require that certain doors remain unlocked during occupancy hours — the ZKS must be integrated with fire alarm systems to release locked doors automatically on alarm activation. Energy management systems can use access data to trigger HVAC and lighting adjustments by zone. Building management systems increasingly treat the ZKS as one data source among several, feeding into a unified operational picture.

When specifying or upgrading an access control system, facility managers should evaluate the following capabilities:

• Centralised management with role-based administration: the ability to define access rights by role (not just by individual) and to delegate credential management to department heads or site managers without giving them full system access.
• Real-time monitoring and alerts: instant notification when a door is held open, an access attempt is denied repeatedly, or a forced entry is detected. Critical for large or multi-site facilities where staff cannot physically monitor every entrance.
• Integration with HR and visitor management: automated provisioning and deprovisioning of access rights when employees onboard or offboard, and a visitor management workflow that issues temporary credentials without FM team intervention for every visit.
• Comprehensive audit logging: a searchable, exportable record of all access events, retained for a defined period. Essential for compliance audits, incident investigation, and insurance claims.
• Scalability across sites: the ability to manage multiple buildings from a single platform, with consistent access rights policies applied across the portfolio. Particularly important for retail chains, logistics operators, and corporate real estate portfolios.
• Offline resilience: if the network or cloud connection is lost, doors should continue to operate according to their last-known rules rather than defaulting to locked or unlocked. Controllers with local cache ensure continuity during outages.

Operating an access control system in Germany involves obligations under several regulatory frameworks that facility managers must address directly.

The DSGVO (General Data Protection Regulation) applies as soon as the ZKS collects personal data — which it does the moment access events are logged against named individuals. Organisations must establish a legal basis for processing this data, define retention periods, document the processing activity in their records of processing activities (Verzeichnis von Verarbeitungstatigkeiten), and ensure that employees are informed about what data is collected and why.

Works council co-determination rights (Mitbestimmung) under the Betriebsverfassungsgesetz apply when a ZKS has the technical capability to monitor employee behaviour or performance — which most networked systems do. Introducing or significantly modifying an access control system typically requires works council agreement before implementation.

The Arbeitsstättenverordnung and associated technical rules set requirements for emergency egress: access-controlled doors on escape routes must be openable from the inside without a credential at all times. Integration with the fire alarm system must be tested and documented. These requirements sit squarely in FM’s compliance remit.

Access control projects fail or underperform for predictable reasons. The following mistakes are avoidable with adequate planning:

• Overcomplicating the permission structure: creating hundreds of individual access profiles instead of a small set of role-based profiles makes the system unmanageable. When the FM team cannot easily answer 'who has access to this area?', the system has failed operationally.
• Neglecting offboarding processes: credentials belonging to former employees or expired contractors are among the most common access control vulnerabilities. Without an automated link to HR systems or a regular audit process, orphaned credentials accumulate over time.
• Ignoring fire safety integration: installing access-controlled doors on escape routes without proper integration with the fire alarm system creates a life-safety risk and a compliance failure. This must be designed in from the start, not retrofitted.
• Choosing on-premise systems for multi-site portfolios: managing separate on-premise servers at each location multiplies IT overhead and makes consistent policy enforcement across sites nearly impossible. Cloud or hybrid architectures are almost always the right choice at portfolio scale.
• Underinvesting in user training: a system that staff do not understand leads to tailgating, propped doors, and shared credentials — behaviours that defeat the purpose of the investment. Training and clear policies are part of the implementation, not an optional extra.

Access control system maintenance is a hard FM responsibility: readers need servicing, locking hardware requires adjustment, cabling deteriorates, and controllers eventually need replacement. Sourcing and managing the qualified technicians to handle this work — particularly across multi-site portfolios — is exactly the coordination challenge that the Wowworks platform is designed to solve.

Through Wowworks, facility managers can access vetted security and building technology contractors who hold the necessary certifications for ZKS installation, maintenance, and compliance testing. Tasks are assigned digitally, completed work is documented automatically, and audit records are available in a single interface — supporting the compliance documentation requirements that come with operating an access control system under German regulatory
frameworks.

As access control systems become more integrated with other building systems — HVAC, fire protection, energy management — the FM team that manages them needs reliable, qualified support across a widening range of trades. Wowworks provides that support at portfolio scale, without the overhead of maintaining bilateral relationships with dozens of individual contractors.