Visitor Log Template
A visitor log template built backwards from the moment it actually matters. Signing in is the easy half and almost every register does it. This one is shaped around section 5, because on the day the alarm goes the only question the book has to answer is who is still inside.
- A sign in and sign out register, because only one of those is usually enforced
- The person who collects the log at the alarm named, with a backup
- Vehicles recorded, because a car left behind contradicts a sign-out
- A contractor table carrying the permit number alongside the work
Visitor Log
One site, one page per day
| # | Roll call requirement | In place | Gap | N/A |
|---|---|---|---|---|
| 1 | Log is taken to the assembly point by a named person | |||
| 2 | A second person knows to collect it if the first is absent | |||
| 3 | Roll call carried out against the log, not from memory |
The document you will get. Download for the full, editable file.
Who this visitor log template is for
Four people depend on this book, and the one it is designed for has not arrived yet.
Whoever is on the desk
Sections 4 and 6 are the parts you run. The one that is easy to let slide is reconciling badges at the end of the day, and it is the one that keeps the register honest enough to be worth carrying outside.
The fire warden or whoever calls the roll
Section 5 is written for you, including the uncomfortable line about practicing it. Reading a register aloud under pressure, outdoors, takes far longer than anybody expects the first time they do it.
Facilities or estates
The contractor table is yours. Somebody doing hot work or entering a confined space should appear both on a permit and at reception, and this is the one place where a person at the desk can see that the permit exists.
Whoever answers for the personal data
Section 6 is the part most reception books fail. An open page showing every previous visitor tells the next person who came, from which company and to see whom, which is more than they are entitled to know.
Which section matters the most in your sector
Every building signs people in. What changes is how many of them are contractors, how hard the building is to leave, and how much of the register is personal data sitting in public.
- FM service providers
The contractor table. Across a managed site the people most likely to be somewhere unexpected during an evacuation are contractors in plant rooms and on roofs, and the area column is what makes them findable.
FM service provider software - Healthcare
Accessibility needs at sign-in. A hospital has visitors who cannot use stairs as a matter of course, and the register is the only place that information exists before an alarm rather than during one.
Healthcare maintenance software - Commercial real estate
The reconciliation. Multi-tenant buildings run high visitor volumes through one desk, tenants sign their own guests in inconsistently, and the gap between signed in and signed out grows faster here than anywhere.
Portfolio maintenance software - Corporate facilities
Data protection in section 6. A head office reception is a public space with a book on it, and the open page is the commonest place a company quietly discloses who has been visiting whom.
Corporate facilities software - Education
The out of hours arrangements. Campus buildings run evening and weekend access long after reception closes, and a sign-in process that only exists while somebody is on the desk covers the quietest and riskiest hours least.
Campus maintenance software - Retail and malls
Deliveries and couriers. They are in and out constantly, they are rarely signed in anywhere, and they are the people most likely to be in a back of house area that nobody sweeps during an evacuation.
Retail maintenance software
What a visitor log should contain
A visitor log is the register of who is inside a building who does not normally work there. It records arrival and departure, the host, the badge issued and the vehicle, carries contractors with their permit numbers, and exists so that a roll call at the assembly point can be read against it rather than from memory.
A. Fields specific to a visitor log
| Field | What goes in it | Why it earns its place |
|---|---|---|
| Who collects this log when the alarm sounds | A named person, with somebody who knows to cover them | The most important field in the document and the one almost no register has. A book that stays on the desk during an evacuation is a book that was never going to work, and naming one person without a backup is the same failure with an extra step. |
| Who is responsible for the roll call | Named, and separate from who carries the book | Two different jobs that collapse into one assumption. The person who grabs the register on the way out is frequently not the person who should be reading it aloud, and sorting that out in the parking area wastes the minutes that matter. |
| Time in and time out | Both, with the second one reconciled | Signing in is enforced by the desk and signing out is enforced by nothing. The sheet carries both because the difference between them is the number the roll call actually depends on. |
| Badge issued and badge returned | Numbered, and reconciled at the end of the day | A proxy for the sign-out that is harder to skip, because the badge is a physical object somebody wants back. Unreturned badges accumulating is usually the first visible sign that the register has become a formality. |
| Vehicle | Make and plate, recorded at sign-in | The cross-check that catches a false sign-out. A vehicle still on site after an evacuation when its driver is shown as having left means one of the two records is wrong, and that has to be resolved before anybody re-enters. |
| Host, named and notified | Before the visitor goes beyond reception | The host is the person who will be asked whether their visitor got out. Naming them at sign-in is what makes that question answerable by somebody specific rather than by the room. |
| Accessibility needs | Asked about at sign-in, and recorded | Here because reception is the only point in the day where the question gets asked at all. Discovering during an evacuation that somebody cannot use the stairs is discovering it at the worst available moment. |
| Permit number, for contractors | Against the work being done | The link between two documents that normally never meet. A contractor doing hot work or entering a confined space should exist on a permit and at the desk, and this column is where somebody at reception can see that both are true. |
| Area, for contractors | Where on site they actually are | Because an evacuation sweep is organized by area. A contractor logged as on site but not as on the roof is a person nobody will think to look for. |
| Previous entries not visible | A check on the book itself, not on the visitor | The commonest data protection failure in any reception. An open register tells the next person signing in who came, from where and to see whom, none of which is theirs to know. |
| Still on site at close | Signed in minus signed out, calculated | The number that makes the register self-correcting. Left unreconciled it grows every day, and a register that routinely overstates by several people produces a roll call nobody can act on. |
| Anyone unaccounted for at roll call | Recorded, including during drills | The outcome field. Drills are where this gets tested cheaply, and recording how long the roll call took and who could not be accounted for is what turns a drill into information rather than an interruption. |
If you cut this down, keep the sign-out column and the name of whoever carries the book outside. Everything else here improves the register; those two decide whether it functions at all. A log with no enforced sign-out drifts in one direction only, because arriving is witnessed by a person at a desk and leaving is witnessed by nobody, so the register accumulates people who are not there. That matters less for the day-to-day than people assume and enormously for the one occasion it is used, because a roll call that begins with nine names belonging to people who went home at four is a roll call that will report nine missing to the fire service while everybody stands there knowing the book is unreliable. The named collector is the other half. A register that is accurate and still sitting on the desk behind a door that has just been closed has achieved nothing, and the arrangement fails exactly as often through the named person being on leave as through nobody having been named, which is why the backup is written down rather than assumed.
B. What it looks like filled in
One week at a reception desk, taken from the Daily Log tab. Nothing unusual happened.
| Day | Signed in | Signed out | Still shown on site | Badges unreturned |
|---|---|---|---|---|
| Monday | 24 | 22 | 2 | 2 |
| Tuesday | 31 | 27 | 4 | 5 |
| Wednesday | 28 | 22 | 6 | 7 |
| Thursday | 26 | 19 | 7 | 9 |
| Friday | 33 | 24 | 9 | 11 |
By Friday the book said nine people were in the building at close, and none of them were. Nothing dramatic went wrong in this week. Visitors left through a door that was not reception, a host walked somebody out to their car, a few people simply forgot, and nobody reconciled the page at the end of any of those days. The effect is cumulative rather than daily: each unreconciled evening teaches the desk that the numbers are not really read, and the badges column shows the same drift slightly worse because an unreturned badge is also an uncollected object. The reason this matters is entirely about the day it is used. A roll call starting from Friday’s page begins with nine names of people who left hours earlier, and the warden either reports nine unaccounted for to the fire service or starts guessing which of the nine are real, which is the moment the register stops being a control.
Word to adapt the columns and the site rules to your own reception, Excel for the reconciliation, the badge counts and the Daily Log tab that shows whether the register is drifting, PDF for the printed book that sits on the desk. Free, and yours to rebrand.
How do you run a visitor log?
One site, one page per day. Set up section 1 once and it decides whether everything after it works. Six steps.
Decide who carries the book out, before anything else
Site and address, reception hours and the out of hours arrangements, where the log is kept, the retention period and who may see it. Then the two fields the rest of the document depends on: the assembly point with the name of whoever collects this log when the alarm sounds, and the name of whoever is responsible for calling the roll. Make sure a second person knows to collect it.
Run the visitor table so that leaving is recorded as carefully as arriving
Date, name, company, who they are visiting, the reason, time in, badge number, vehicle, time out, badge returned and the initials of whoever took them. The vehicle column is the cross-check: a car still on site when the log says its driver left means one of those two records is wrong.
Keep contractors in their own table, with the permit number
Date, name, company, the work being done, whether they have had the site induction, the permit number, the area they are working in, times in and out, and whether they are escorted. The permit column connects the desk to the permit system, and the area column is what makes somebody findable during an evacuation sweep.
Check the sign-in process itself, including the question nobody asks
Twelve requirements. Everybody signs in before going beyond reception, identity checked where required, the host named and notified, badges issued, worn and reconciled at the end of the day, escorting where required, site rules and the emergency procedure explained, accessibility needs asked about and recorded, and the process covering out of hours, deliveries, couriers and staff visiting from other sites.
Work the evacuation arrangements, then test them during a drill
Ten requirements. The log taken to the assembly point by a named person with a second who knows to cover, the roll call read against the log rather than from memory, hosts accounting for their own visitors, contractors accounted for by area including roofs and plant rooms, anyone unaccounted for reported to the fire service immediately, lone and out of hours workers included, a paper fallback if the system is electronic, and the log legible to somebody who did not write it.
Reconcile before locking up
Nine data protection requirements first: previous entries out of sight, the book not left open and unattended, completed pages stored securely, retention applied, only necessary information collected. Then the day summary. Signed in against signed out, badges issued against badges returned, contractors against those with a permit, and what was done about anybody still shown as being on site.
A record of who arrived versus a register you can read out
Almost every reception has the first of these. The second is a different document that happens to be written on the same page, and the difference only becomes visible once a year.
| Aspect | A record of who arrived | A register you can read out |
|---|---|---|
| What it is for | Knowing who came, and proving it afterwards | Knowing who is inside, right now |
| Which half is enforced | Signing in, by the person at the desk | Both, because only the difference matters |
| How it fails | It does not. Arrivals get captured | Quietly, as unreconciled days accumulate |
| When the failure appears | Never, really | At the assembly point, once |
| What a wrong entry costs | A tidy-up at the end of the month | Minutes spent looking for somebody who left |
| How you test it | By reading it | By calling a roll call during a drill |
The two documents are indistinguishable on any ordinary day, which is precisely the problem. A register that captures every arrival and loses a third of its departures looks completely healthy from behind the desk: the page is full, the handwriting is legible, every visitor who walked in is on it. Nothing about using it day to day reveals that it has stopped describing the building, because nobody ever asks it the question it is failing to answer. The failure only surfaces at an assembly point, and it surfaces in the worst possible form, as a list of names that cannot be distinguished between people who are standing outside, people who went home at four, and people who are genuinely still inside. A warden holding that list has three bad options and no good one. That is why the arrangements in section 5 are written as checks rather than as advice, why the summary reconciles in against out every single evening rather than monthly, and why the drill line asks for the time it took to be recorded. The roll call is the one function of this book that cannot be improvised, and it is the only one that is never exercised unless somebody deliberately exercises it.
When the template starts to feel limiting
One desk, one book, one site is exactly what paper is for. It stops working in four familiar places.
Nobody can see who is inside without the book
The register is a physical object in one place. A duty manager, a security office or a second building has no way to know how many people are on site, which is the question everybody asks first and the one paper answers slowest.
The drift is only visible if somebody reconciles
Signed in against signed out is a calculation at the end of a page. Skip it for a week, which is easy and costs nothing visible, and the register quietly stops describing the building while continuing to look exactly the same.
The permit number is a number, not a link
A contractor logged with a permit reference proves somebody wrote a reference down. Whether that permit exists, is current, or covers the work being done is a separate document in a separate place that nobody at the desk can check.
Drills never accumulate into evidence
How long the roll call took, who was unaccounted for and whether it improved are recorded one drill at a time on pages that get filed. The trend across a year, which is the only thing that shows whether the arrangements work, never assembles itself.
What running this in Facilio looks like
The template is the paper version of this register. The columns are the same; what changes is that who is on site becomes something more than one person can see, a contractor at the desk is connected to the permit rather than to a number copied onto a line, the reconciliation happens whether or not somebody does it, and drill results accumulate instead of being filed.
Ops Performance Intelligence
Who is on site is a live number
Arrivals and departures update a count that a duty manager, a security office or a second building can see, so the question an evacuation starts with has an answer before anybody reaches the assembly point with a book.
Contractor Work Tracker
The permit and the person are the same record
A contractor signing in is connected to the permit covering their work rather than to a reference copied onto a line, so a permit that has expired or does not cover what they are about to do is visible at the desk instead of in a folder.
Work Completion Validator
The day cannot close over people still shown inside
Reconciling signed in against signed out stops depending on somebody choosing to do it at the end of a long day, so a register that is drifting raises itself rather than quietly becoming decorative.
Audit Report Intelligence
Drills become a trend rather than a page
Because every drill records who was unaccounted for and how long the roll call took, the question of whether the arrangements are actually improving is answerable across a year instead of being re-argued after each one.
Hallucination-free by design. Atom AI answers from the records in your tenant rather than generating plausible text, so an empty field reads as empty rather than filled in for you.
Frequently asked questions
What should a visitor log include?
Date, name, company, who they are visiting, the reason, time in and time out, the badge number and whether it came back, and the vehicle. Contractors get a second table with the work being done, the induction, the permit number and the area they are in.
The columns most often missing are the ones that matter during an evacuation: the sign-out, the vehicle and, for contractors, the area. A register without those records who arrived rather than who is inside.
Why does signing out matter as much as signing in?
Because the register is only useful as the difference between the two. Signing in is enforced by the person at the desk and signing out is enforced by nobody, so a log left unreconciled drifts in one direction and gradually fills up with people who are not there.
The cost appears all at once. A roll call that starts with nine names of people who went home hours ago forces the warden either to report nine missing or to start guessing, and both of those happen at the moment the register was supposed to be doing its job.
Who should collect the visitor log during an evacuation?
A named person, written down in advance, with a second person who knows to do it if the first is away. The template puts both in the first section because this is the single arrangement that most registers do not have.
It is worth separating from the roll call itself. The person who grabs the book on the way out is often not the person who should be reading it aloud, and working that out at the assembly point costs exactly the minutes the exercise exists to save.
Why record vehicles?
Because a vehicle is the one piece of evidence that can contradict a sign-out. If a car is still on site after an evacuation and the log shows its driver as having left, one of those two records is wrong and somebody needs to establish which before anybody goes back in.
It is also the only field on the sheet that keeps working when the visitor is no longer available to ask, which is precisely the situation where you need it.
When should accessibility needs be asked about?
At sign-in, as a standard question, recorded on the page. Reception is the only point in a visitor’s day when somebody will ask it, and the answer needs to exist before an alarm rather than be discovered during one.
Asking it routinely also avoids singling anybody out. A question that is on the form for everybody is easier to answer than one that gets asked only when somebody appears to need it.
How do contractors fit into this?
In their own table, with the work being done, the induction, the permit number and the area they are working in. A contractor doing hot work or entering a confined space should exist both on a permit and at the desk, and the permit column is where somebody at reception can see that.
The area column is the one that matters during an evacuation. Contractors are the people most likely to be on a roof or in a plant room that nobody sweeps, and a name without a location is a name nobody can go and look for.
Is an open visitor book a data protection problem?
Usually, yes. An open page shows the next person signing in who came, from which company and to see whom, which is more than they are entitled to know and is the commonest data protection failure in a reception area.
The fix is in section 6 and it is mostly physical: previous entries not visible, the book not left open and unattended, completed pages stored securely, a retention period that is actually applied, and old pages destroyed securely at the end of it.
Should I use paper or an electronic system?
Either, and the arrangements in sections 4 to 6 apply to both. An electronic system removes most of the drift because sign-out and reconciliation stop depending on somebody remembering, and it makes who is on site visible to more than one person.
The requirement the template adds for electronic systems is a paper fallback for a power failure, because the one circumstance in which a building is evacuated is also a circumstance in which the register may not be available.
In one paragraph
A visitor log is a roll call document that spends most of its life as a sign-in sheet. Build it backwards from that. Name the person who carries the book to the assembly point and the person who covers them, because a register sitting on a desk inside a building being evacuated has failed at the only moment it was needed. Record both arrival and departure, and reconcile the two before locking up, since signing in is enforced by the desk and signing out is enforced by nothing. Record vehicles, because a car left behind contradicts a sign-out and somebody has to resolve that before re-entry. Ask about accessibility needs at the desk rather than in the stairwell. Keep contractors in their own table with the permit number and the area. Then test the whole thing during a drill and write down how long it took.
The template is the floor, not the ceiling
Take the log; a reception desk and a page a day will run it properly. When one book in one place stops being enough, a connected platform runs the arrangement: who is on site as a live number more than one person can see, contractors connected to the permit covering their work rather than to a reference copied onto a line, a reconciliation that happens whether or not somebody does it at the end of a long day, and drill results that accumulate into evidence instead of being filed.
