● Bad People & Security

How do we set up two-factor authentication for visitor pre-registration?

An unverified visitor list is a liability that turns a real-time evacuation report into a guessing game. In Australia, the WHS Act 2011 requires PCBUs to maintain site safety, while OSHA in the United States mandates that employers ensure a safe environment for all site occupants. Verification is achieved by pre-registering visitors to receive a unique QR code via email, which serves as their secure entry token.


Knowing who is on site is a legal mandate, not a preference

Australian law requires PCBUs to ensure the health and safety of all visitors, and US employers must meet OSHA standards to prevent workplace injuries and fatalities. In our work with Australian and US organisations, we have found that identity verification at the point of entry is the only way to guarantee a reliable live site occupancy report.

The danger of the trust-based entry system

Many organisations rely on visitors manually typing their names into a kiosk or, worse, a paper sign-in book. These methods create data gaps that lead to critical failures during muster point verification.

  • Manual entry allows for typos and aliases that make individuals invisible during an emergency roll call.
  • Paper logs fail to track real-time check-outs, leaving emergency teams searching for people who have already left the site.
  • Lack of pre-registration allows visitors to bypass mandatory contractor induction and check-in processes.
  • Disconnected entry records prevent security from verifying if an arriving visitor was actually expected or authorised.

Secure verification through digital pre-registration

A cloud-based visitor management system eliminates manual entry by linking the appointment to a digital token. This ensures that only pre-approved individuals can quickly access the site while maintaining a digital audit trail.

  1. Integrate Google or Outlook calendars so that meeting invites automatically trigger the pre-registration process.
  2. Enable the system feature that sends a unique QR code or barcode to the visitor’s email address.
  3. Include essential site safety data in the pre-registration email, such as evacuation instructions and parking details.
  4. Require visitors to scan their unique code at the kiosk to initiate sign-in and trigger any forced contractor induction.
  5. Utilise photo capture on arrival to build a backend data set that allows security to verify the identity of the person on site.

Time and People: Visitor Management That Works When It Has To

We convert complex compliance obligations into working infrastructure through cloud-connected visitor management and real-time evacuation reporting. With over 12 years of experience across Australia and the United States, we’ve found that while photo badges have limited visibility, capturing that image in the backend data set is critical for true identity verification. We focus on the technology that ensures every person is accounted for when it matters most.


Content prepared by Time and People — visitor and contractor management across Australia and the United States.

×