How do you commission—and what do we get at handover?
Commissioning is where projects succeed or fail. Ask for a description of factory acceptance tests (if used), on-site testing, fire-interface tests, fail-safe/fail-secure behaviour under power loss, and how access policies are validated by role. At handover, you should receive O&M manuals, as-built drawings, configuration exports, admin training and a defects list closed out. Reputable installers align these deliverables to a code of practice such as NSI NCP 109, which standardises expectations.
What’s the plan for accessibility and inclusive access?
Access control must work for everyone who has a legitimate reason to be there. Ask how reader placement, door hardware, and automatic operators will support users with mobility or dexterity needs, and how contactless or hands-free journeys will be provided where appropriate. This is about compliance and dignity—and it’s much cheaper to design in than to retrofit. (For touchless options and upgrade paths, see our overview of Hands-Free Access Control.) The BSIA’s specifier guidance is a useful independent reference here.
What evidence of competence and assurance can you show?
Beyond testimonials, ask for industry certifications and accreditations (for example, NSI approvals), manufacturer training status, and experience on similar estates. For cloud-managed platforms, ask the vendor about ISO/IEC 27001 or comparable information-security assurance, and how customers can verify controls (audit logs, change histories, vulnerability management). Using recognised NCSC cloud principles as a checklist for due diligence makes this conversation concrete rather than hand-wavy.
How will you support us after go-live?
Good systems are cheaper to live with when maintenance is planned. Ask for a preventive maintenance schedule (reader cleaning, door alignment, PSU/battery health, firmware updates) and clear SLA terms that reflect your operating hours and risks. If wireless components are in scope, ensure batteries are a tracked line item. Also ask how user governance will be supported—access reviews, leaver processes, and reporting—so the system stays tidy and defensible under audit.
What are the limits—and how do we scale?
Finally, probe the edges: maximum doors per controller, reader types supported, options for mobile credentials, rules engines for complex schedules, and API availability for future integration (visitor systems, HR identity feeds). Sensible answers will acknowledge limits and propose migration paths. Remember, the system you buy should grow with you and not strand you on a dead-end hardware island.
Why this questioning works
This isn’t about catching a provider out; it’s about ensuring alignment to UK best practice and your real-world operations. Framing your procurement around outcomes (the NPSA AACS model), life-safety behaviour (BS 7273-4), recognised system standards (BS EN 60839-11-1) and a delivery code (NSI NCP 109) keeps the conversation disciplined and the paperwork defensible. If your provider can speak fluently to those pillars—and show you how they’ll integrate intercoms, CCTV and vehicle control while meeting GDPR—they’re likely to deliver a system you can trust for years.
