My plant used to use a vendor and not add him to the approved vendor list for that day, and see if the Guards let him through.
This past year, we did something different and a boss came through in a different vehicle, without the company tag, to see if he would be stopped. He then tested all the doors, and verified that everyone on site was on the approved log for the day.
We usually use the following format for the report:
Food Defense Annual Challenge Test Scenario XX/XX/XXXX
Description of Incident / Potential Threat: – Contractor, XXXX was scheduled to conduct (WORK). His name was intentionally not placed on the daily contractor schedule to verify that the on-site security guard would follow our food defense procedure.
Action Taken - On site security guard could not verify that the contractor had an appointment, he contacted on site management, (Work contact) who in turn verified that he did have an appointment. After verification, he was allowed on site
Conclusion – On site security staff followed our procedure by holding the contractor outside the gate until his appointment could be verified with plant management.