Cost leak 1: payroll fraud you can't see on a P&L
The American Payroll Association puts time-theft loss at 2 to 5 percent of gross payroll. For a $1M payroll, that's $20K to $50K a year, spread across hundreds of small overstatements: a few minutes here, a buddy-swipe there. It doesn't show up as a line item; it shows up as labor cost running higher than the schedule says it should.
Biometric or biometric-paired badge entry kills the easiest variant: a coworker swiping a friend's card. The remaining variants (manager edits, retroactive corrections in the time system) get caught when the badge log is tied to a camera clip on the same timeline. When the timeline is unified, the loss number bends inside one quarter.
Cost leak 2: shrink that can't be tied to a person
The 2023 NRF National Retail Security Survey put total shrink at $112 billion, with internal theft at roughly 29 percent of that and vendor and contractor theft on top. The number that closes shrink cases isn't shrink; it's accountability. Without an audit trail, the loss is generic. With one, the suspect pool narrows to the two or three people who badged into the stockroom on the shift in question.
We've watched this across retail, hospitality, manufacturing, and 3PL. The badge log narrows the case, the camera clip closes it, and the deterrent of "we know who was in the room" bends the shrink number on the quarters that follow. None of this requires biometrics or facial recognition. Badge logs tied to camera clips on a unified timeline do most of the work.
Cost leak 3: compliance fines and contract loss
Different regimes, different numbers, same pattern. PCI-DSS Requirement 9 asks for camera coverage and badge logs at every cardholder data environment ingress. Non-compliance fines run $5K to $100K per month from card brands, with merchant-bank surcharges on top. HIPAA Office for Civil Rights penalties scale with culpability tier; the lowest starts around $137 per violation and willful neglect reaches $2.13M per category per year. FTC Safeguards Rule violations have produced multi-million-dollar settlements with auto dealers and tax preparers.
CMMC 2.0 doesn't fine; it costs contracts. Defense subcontractors who can't pass the third-party C3PAO assessment lose access to DoD work. Most failures we see aren't hardware failures; they're documentation failures. The system records what auditors want, but the records can't be retrieved in the expected format with the required retention (90 days for PCI, two years for CMMC visitor records, 24 months for DEA Schedule II).
What modern access control actually does
Three deliverables that close all three leaks at once. First, sub-minute credential revocation: a termination event in the HRIS kills the badge before the employee leaves the building. No re-keying, no waiting for IT. Second, badge-and-camera timeline integration: every door event ties to a person, a timestamp, and a video clip. One source of truth, not three. Third, audit-ready evidence: HIPAA, PCI, FTC Safeguards, and CMMC reports produced from the same system in the format each regime expects.
Cloud-native systems handle multi-site rollouts cleanly. Cloud-or-hybrid platforms cover environments that need data residency; federal-grade platforms cover CMMC environments. The choice depends on the regime, the IT staffing model, and data residency rules; the audit produces the recommendation.
How to sequence the fix
- Highest-risk site first. Usually the one that holds CUI, PHI, cardholder data, or controlled inventory.
- HR integration before site number two. Badge-kill becomes automatic on termination.
- Badge-and-camera timeline integration on the next sites. Auditors stop asking when the timeline is unified.
- Standardize role definitions, offboarding flow, and audit report across the rest of the footprint.
- Quarterly review baked into the contract. Most rollouts drift inside 18 months without it.
Per-door installed cost lands at $3K to $8K. Cloud subscription runs $15 to $30 per door per month after the install year. Most multi-site operators recover the install cost inside 18 months on offboarding labor, audit time, and the first prevented PCI or HIPAA finding alone.