Good mailroom security procedures come down to five things: one controlled place where mail is received, a short list of people allowed in it, a written screening routine, a rehearsed response for suspicious items, and a habit of checking any payment request that arrives on paper or by email. This guide sets out each one for Australian sites, from hospitals to construction offices, and shows where guards, CCTV and access control fit.

TL;DR

• Receive all mail and parcels in one designated room, away from public areas and main work floors, with keycard or guard-controlled entry.
• Write down your screening routine, train every person who touches mail, and post the warning signs of a suspicious item where staff can see them.
• If an item looks suspicious: do not touch, shake, tilt or open it, isolate it, move people away and call triple zero (000).
• Treat mailed invoices and bank-detail changes as fraud risks. Verify them by calling a number you already trust.
• Match the controls to your assessed risk. A small office and a hospital do not need the same setup.

Table of Contents

• Why the mailroom deserves its own procedures
• Start with a risk assessment, not a checklist
• The core mailroom security procedures
• What to do with a suspicious package
• Paper fraud: the threat that actually arrives most often
• Layering controls: people, process and technology
• Sector notes
• Our perspective
• Where ABCO Security can help
• Putting the procedure on one page
• FAQ
• Sources

Why the mailroom deserves its own procedures

The mailroom is one of the few places where an unknown object, handed over by a third party, enters your building without passing through reception. It is also where paper-based fraud arrives. Standards Australia published a dedicated guide, HB 328-2009 Mailroom Security, which sets out best-practice guidance on mailroom safety and security, and it remains a useful reference when you write your own policy.

The Commonwealth regulator Comcare notes that workplaces which accept deliveries through reception may face security risks and need mail handling systems in place to protect other people. That applies to a front desk at a construction site office just as much as to a corporate tower.

Most incidents are not dramatic. They are lost parcels, stolen deliveries, a forged invoice or a powder spill that turns out to be harmless but still closes a floor for hours. A good procedure covers all of these, not just the worst case.

Start with a risk assessment, not a checklist

Security guidance for government and health agencies consistently ties controls to assessed risk. NSW Health’s Protecting People and Property policy describes security risk management as assessing the clinical and non-clinical environment, including external factors such as the local crime profile.

For your mailroom, ask:

• Who sends you mail? A public hospital, a government agency or a high-profile developer attracts different attention from a small accounting firm.
• How much arrives, and in what form? Couriers, Australia Post, internal runs, hand deliveries and contractors all need a defined path.
• What is at stake if something goes wrong? Patient safety, payroll data, tender documents or simply a day of lost work.
• Where is the mailroom? Next to a loading dock, a public lobby or an air-handling intake changes how you plan the response.

If you want a structured way to do this, our security risk assessment checklist for Australian facilities and risk assessment process guide walk through it step by step.

The core mailroom security procedures

1. Centralise receipt in a designated area

South Australian government security guidance for high-risk environments such as healthcare and corporate offices recommends centralised mail receipt in a designated, isolated area away from public zones. In practice:

• Nothing is signed for at random desks. Couriers are directed to one point.
• The mailroom is separate from open-plan work areas and, where possible, has its own ventilation considerations discussed with your building manager.
• Parcels are logged on arrival: date, time, carrier, addressee, and who accepted it.
• Deliveries to reception are handed straight on to the mailroom, not left on the counter.

Sites with a gate or boom barrier should link the mailroom procedure to the gatehouse. Our gatehouse security procedures guide covers how couriers are checked in before they get near the building.

2. Limit who can enter

The same guidance points to physical access controls, such as keycards, so that only authorised people can enter the mail processing room. Make this concrete:

• Issue access to named staff only and review the list every quarter.
• Keep an audit trail of door events, so you can see who was in the room when an item arrived.
• Escort any visitor or contractor, and record it.
• Keep the door closed and locked between deliveries.

If your sites are industrial, the same thinking applies at larger scale. See our piece on standards-based fixes for factory access control.

3. Write down the screening routine

A screening procedure does not have to involve a scanner. For many Australian workplaces it is a documented visual check done the same way every time. A sensible baseline:

1. Open and sort mail in the designated area only.
2. Check each item against the list of warning signs below.
3. Compare unexpected parcels with what you know: Did anyone order this? Is the sender known?
4. Confirm doubtful deliveries with the named recipient before they leave the mailroom.
5. Set aside anything that does not add up and escalate to the mailroom supervisor or security.
6. Record the outcome.

The UK’s national protective security authority publishes a guide for organisations on postal screening, noting that a basic level of protection starts with telling mailroom staff what to look for. It is a UK document, so use it for ideas on screening tiers, not as Australian regulation. Larger organisations with high threat profiles may add X-ray or other screening equipment; that decision should come out of your risk assessment.

4. Know the warning signs

Queensland Police list common indicators of a suspicious package. Based on that Queensland Police guidance, look for:

• Unusual weight or size for the item.
• An unexpected or unsolicited delivery.
• Stains or odours.
• Missing, misspelled or incorrect return addresses.
• Excessive tape or stamps, or markings such as “Private” or “Confidential”.
• Visible wires or protruding parts.

The practical test is whether the item fits the normal pattern of your mail. A heavy box addressed to a job title that does not exist on a site that never receives such parcels deserves a second look, even if it ticks none of the boxes above.

Print this list on a single page and put it on the mailroom wall and at reception.

What to do with a suspicious package

This is the part staff must be able to recite. The steps below follow Queensland Police advice on suspicious packages and the guidance summarised above:

1. Do not touch, shake, tilt or open it. Curiosity is the biggest risk. Disturbing the contents can trigger a device or spread a substance.
2. Stay calm and keep others calm.
3. Isolate the item and clear the immediate area. Do not move it.
4. Call triple zero (000) and give the location, a description and what you have done.
5. Follow your facility’s written emergency procedure, including who meets emergency services at the door.

If the item is leaking or releasing a substance, treat it as a hazardous materials incident and wait for professional assessment. Do not try to clean it up.

Two details that sites often miss:

• Evacuation routes. Your standard fire evacuation route may pass the mailroom. Your emergency plan should explicitly cover mailroom scenarios so nobody walks through a contaminated zone.
• Who decides. Name the person who calls 000 and the person who accounts for staff, so two people are not both waiting for the other.

Run a drill once a year. It takes twenty minutes and exposes gaps in a way a policy document never will.

Paper fraud: the threat that actually arrives most often

Physical danger is rare. Fraud is not. The Australian Cyber Security Centre warns that the best defence against email-based attacks is training and awareness for your employees, and flags requests for payment, especially urgent or overdue ones, as a red flag. Fraudsters often pair a convincing paper invoice with a follow-up email, which is why mailroom and accounts teams need to talk.

Build these rules into the procedure:

• Any invoice or change of bank details that arrives by post or email is verified before payment.
• Verify by calling the supplier on a number you already hold, not the one printed on the suspicious document.
• Two people approve new payees.
• The mailroom flags unexpected invoices to accounts rather than passing them through silently.

This matters on construction projects, where many subcontractors invoice at once and a new payee barely raises an eyebrow. If you want an example of the habit, UK guidance on how to verify a phone number shows the logic of checking a contact through an independent channel, even though the regulators it cites are British.

Layering controls: people, process and technology

Workplace regulators describe effective security as a layered model: physical infrastructure, electronic monitoring and strong operating procedures, scaled to risk and developed with the workers who do the job. Comcare’s guidance on deliveries to reception sits within that approach.

For a mailroom that looks like this:

South Australian guidance is blunt that CCTV is no substitute for physical barriers. It deters and supports investigation afterwards. For healthcare and other high-security sites, linking mailroom alarms to the building management system gives automated alerts and faster response than phone trees.

Regular audits matter too. Check your CCTV, alarms and procedures against your own policy and against standards such as ISO 9001 on a schedule, and fix what you find.

Sector notes

Healthcare. Patient safety and infection control raise the stakes. Keep mail processing away from clinical areas and align with your state health department’s security policy, such as NSW Health’s policy above.

Corporate offices. Reception is the weak point. Make sure the front desk never accepts unexpected parcels for “someone upstairs”. Our corporate office security plan covers the first four moves to make.

Construction. Site offices receive deliveries of materials and mail through the same gate, often with rotating staff. Separate paperwork and parcels from material deliveries, and keep a log. See our construction site security plan.

Events and crowded places. Temporary venues need a plan for deliveries before doors open. The Victorian Government’s crowded places guidance says protective measures against terrorist threats should be a priority for owners and operators, and our event risk assessment template is a practical starting point.

Our perspective

Most clients who ask us about mailroom security already have a policy. What they lack is someone who owns it on a Tuesday afternoon when a courier turns up with an unexpected box. A policy that sits in a shared drive does not protect anybody.

Our view is that mailroom security works when it is treated as a small part of a site-wide risk picture, not a standalone project. We start with an assessment, then pick the controls that fit: a licensed guard on the receiving point where volume or risk is high, access control on the mailroom door, CCTV and alarms that are actually monitored, and training so staff recognise what is out of place. We aim to anticipate threats, not just respond to them, and we hold our work to ISO 9001 and ISO 30000 quality and risk management standards.

The cheapest improvement is almost always the first one: one door, one log, one list of warning signs, and a drill. Technology comes second.

— Abco

Where ABCO Security can help

If you want the mailroom covered by people and systems, not just paper, these are the services most sites combine:

• Security guarding for licensed static guards on receiving points and reception.
• CCTV and alarm monitoring for 24/7 monitoring of the mailroom and its approaches.
• Electronic security solutions for access control on the mailroom door and audit trails.
• Mobile patrols for after-hours checks of loading areas and delivery points.

Our Night Owl Service is listed from $5.45 per day. For anything larger we scope the work after a security risk assessment, so you pay for controls your site needs. Start at abcosecurity.com.au to request a conversation.

Putting the procedure on one page

Before you finish, check that your written procedure answers each of these:

1. Where is mail received, and who may enter?
2. How are items logged?
3. What does staff screening look for?
4. Who is told when something looks wrong, and in what order?
5. What happens in the first five minutes of a suspicious package?
6. How are invoices and payment changes verified?
7. When was the last drill and the last access-list review?

If any answer is “we assume”, that is your next task.

FAQ

What should a mailroom security policy include?

It should state where mail is received, who can enter, how items are logged and screened, and how staff respond to suspicious items. Add a payment verification rule and a training and drill schedule. Tie it to your site’s emergency plan so evacuation routes account for the mailroom.

What is the first thing to do with a suspicious package?

Do not touch, shake, tilt or open it. Isolate it, move people away from the immediate area and call triple zero (000). Then follow your facility’s written emergency procedure and tell emergency services what you saw and did.

Do all workplaces need mail screening equipment?

No. Many sites rely on a documented visual check by trained staff. Equipment such as scanners suits higher-risk organisations and should come out of a risk assessment, not a default assumption. Start with controlled access, training and a clear escalation path.

How do I protect my business from fake invoices sent by post?

Never pay an unexpected invoice or change bank details on the document alone. Call the supplier using a number you already hold, and require a second approver for new payees. The ACSC small business guide recommends staff training as the best defence.

Sources

• Queensland Police: suspicious packages guidance
• South Australian Government security guidance
• Comcare: Deliveries to reception
• ACSC Small Business Cyber Security Guide
• HB 328-2009 Mailroom Security
• NSW Health: Protecting People and Property
• NPSA mail screening guide for organisations
• Victorian Government: Protecting crowded places

Recommended

• Gatehouse security procedures: the Australian site manager’s guide
• Supply Chain Security: Australian Guide & Compliance 2026
• Four Standards Based Fixes for Factory Access Control in Australia
• Security risk assessment checklist for Australian facilities