Skip to content
Noon EliteNoon Elite

Forensic units, the Regulator’s Code of Practice

Escorted at all times, and a record of these entries shall be maintained

That is paragraph 23.1.4 of the Forensic Science Regulator’s statutory Code, about unauthorised persons who need to enter a controlled area. The engineer servicing an instrument is one. So is the auditor. The record starts where they do, at your front door.

Try it yourself, no sign-up

Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.

Book a 15 minute callWhat the Code says

From £150 a month plus VAT, iPad and stand included. We are not forensic quality advisers, and every quotation on this page is from the Code on GOV.UK.

What the Code says

Five lines from Version 2, and what each one wants at the door

One document: Forensic science activities: statutory code of practice, Version 2, in force from 2 October 2025 in England and Wales. The quotations are verbatim.

Code of Practice, 23.1.4

Escorted at all times, and the entry recorded

“Unauthorised persons needing to enter controlled areas shall be escorted at all times by authorised personnel and a record of these entries shall be maintained.”

Two duties in one sentence, both “shall”. The service engineer, the auditor, the cleaner on a first visit and the customer being shown round are all unauthorised persons until your own procedure says otherwise.

Code of Practice, 23.1.4

The points where outsiders come in are kept apart

“Delivery and loading areas, and other points where unauthorised persons may enter the facility, shall be isolated from casework and information processing areas and access shall be controlled.”

Reception is one of those points. The sentence asks for the door to be a controlled step, with casework somewhere a visitor cannot simply walk to.

Code of Practice, 23.1.3

Controlled areas are for authorised personnel

“Policies and procedures shall ensure that access to controlled areas, such as item/exhibit storage areas, server rooms, and controlled examination facilities where FSAs or related activities are undertaken, is restricted to authorised personnel.”

FSAs are the forensic science activities the Code covers. The list includes server rooms, so a digital forensics unit in an ordinary office is inside it as much as a wet laboratory.

Code of Practice, 23.1.2 c

Protection in proportion to the risk

“proportionate protection against likely risks, such as fire, theft, or interference with items/exhibits”

One of the things an examination facility shall include, as appropriate to the work. Interference with an exhibit is the risk a stranger in the wrong room represents.

Code of Practice, 8.1.7 i

Unauthorised access is an example of a non-conformance

“unauthorised access to restricted areas or information”

Listed among the Code’s examples of non-conformances, or circumstances that indicate one may have occurred. The question after such an event is who was in the building, and the answer has to exist already.

None of this tells you to buy anything, and the Code does not say the record must be electronic. What it says is that the escort happens every time and that the entry leaves a record behind it.

At the door

What an iPad at reception records towards it

The front door is not a controlled area, but it is where every unauthorised person begins. This is the part of the record that can be kept there.

Every outsider on the record, with a host

Anyone who is not your own staff signs in and out on the iPad, as a visitor, a contractor or an engineer. Each is tied to the member of staff they came to see, with the time on both ends. Where you switch on the escort record, your staff also name the authorised person who escorted each one, picked from your staff list.

Your escort rule, accepted by name

The wording you need a visitor to see, for example that they will be escorted at all times in controlled areas and must not touch items or equipment, is put on screen and accepted before they go further. Each acceptance is stored against the person with a timestamp.

The start of the record of entries

The sign in record shows who was on the premises, when, from which company and with whom. Which controlled area they then entered is recorded by your own procedure, in a room log or an access system; the kiosk does not stand at that door.

A record an assessor can be shown

Filter by date, by company or by host and export it to a file that opens without our software, for an accreditation visit or for the review after a non-conformance.

Watch it workThe visitor management kiosk in fullThe same door, for ISO 27001Confidentiality wording at sign inBadges and staff approvalHow long to keep a visitor record

On the day of the assessment

Five questions, and where the answers come from

Each of these is the Code turned into the question an assessor asks. Two of them the kiosk answers only in part, and the answers say which.

  • Who, other than your own staff, has been in this facility?The sign in and sign out record, filtered by date, with each visitor’s company and the member of staff they were tied to.
  • How is an unauthorised person told they must be escorted?The wording shown at sign in, and the stored acceptance against each named visitor with its time.
  • Where is the record of entries to controlled areas?Partly here and partly yours. The kiosk shows who came on to the premises and their host. The entry to each controlled area is in your room log or access system, which the visit record can be laid beside by date and name.
  • Who escorted them?With the escort record switched on, the member of staff your people named as the escort, against the visit, with when it was recorded and by whom. A visit nobody recorded stays blank; it is never filled in as the host.
  • After an unauthorised access event, who was on site that day?The record for the date, with times in and out, exported for the review.

Before you ask

The questions a quality manager asks first

Does the Forensic Science Regulator’s Code require a visitor record?

For controlled areas, yes, in these words: unauthorised persons needing to enter controlled areas shall be escorted at all times by authorised personnel and a record of these entries shall be maintained. That is paragraph 23.1.4 of Version 2. It does not say the record has to be electronic, and it is about entry to controlled areas, not arrival at reception.

What counts as a controlled area?

The Code gives examples in 23.1.3: item and exhibit storage areas, server rooms, and controlled examination facilities where forensic science activities or related activities are undertaken. Which rooms those are in your building is for your own policies and procedures to say.

We are a small digital forensics firm in an office. Does this apply to us?

The Code names server rooms among its examples of controlled areas and applies to the forensic science activities it lists, digital ones among them. Whether your work is one of those activities, and from what date, is a question for the Code itself and your accreditation body, not for us.

Who checks?

Forensic units are assessed by UKAS as part of accreditation, and the Regulator has powers under the Forensic Science Regulator Act 2021 to ask for information and to take compliance action. The Code lists unauthorised access to restricted areas or information among its examples of non-conformances.

Is a sign in record at reception enough for 23.1.4?

Not on its own. It shows who came on to the premises, from which company, with which host and when, that they accepted your escort wording and, with the escort record on, who your staff named as the escort. The paragraph asks for a record of entries to controlled areas, so the room log or access record is still needed. The two together answer who was there and where they went.

How long should the record be kept?

Paragraph 23.1.4 gives no period for it. Choose one that fits your quality system’s retention for records of this kind and your accreditation cycle, write it down and keep to it. UK GDPR still applies to the names in the record.

Being straight with you

What this does not do

  • We are not forensic quality advisers or assessors, and nothing here is advice on the Code or on accreditation. This is general information about a published statutory code.
  • The Code asks for a record of entries to controlled areas. The kiosk records arrival at the premises, not entry to a room, so it is the first part of that record and not the whole of it.
  • The escort is on the record only where you switch the escort record on and a member of your staff enters it, once for the visit. The kiosk does not see the escort happen, and it does not record which controlled areas the escort took them into.
  • It does not check anybody’s identity, hold clearances or control any door. It records the name a visitor types and the wording they accept.
  • It has nothing to do with elimination databases, which the Code deals with separately, and it takes no samples and no fingerprints.
  • It is not for forensic medical examination settings. Patients, relatives and interpreters are not visitors in the sense this page uses, and a sign in screen does not belong there.
  • The record is held in our cloud service. A unit inside a police force will have its own rules on that, and they come first.
  • The Code applies to forensic science activities in England and Wales. Read the current version before relying on a quotation here.

Sources

Check any of this yourself

General information about a published code, not advice on it. Contains public sector information licensed under the Open Government Licence v3.0. Codes are revised; read the current version before you rely on a quotation here.

Also asked of sites like yours

The other things somebody may ask you to evidence

Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.

Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.

Advise sites on this standard? Referral terms are on one page.

Next step

Tell us how visitors reach your controlled areas today

Fifteen minutes on the phone. How many people a week who are not your own staff, where they wait, and what your procedure says about escorts. We will tell you straight which part of 23.1.4 a kiosk helps with and which part it does not.

Book a 15 minute call

No site visit needed and nothing to install. If it is not a fit we will say so on the call.

Would rather email? [email protected]

Not the person who signs it off? Send them the one page business case