Every fire drill has the same moment. The alarm goes, everyone files out to the parking lot, and somebody realizes the list of who's in the building is a printout from this morning, a visitor notebook still sitting on the reception desk you just evacuated, and a memory of who said they were working from home. An evacuation roll call is one of the few pieces of office administration where being approximately right is the same as being wrong.

Why the printed list is always out of date

It isn't carelessness — it's structural. The list is printed at a moment, and the building changes after that moment.

• It was accurate at 9 a.m. Since then people have left for client meetings, arrived late, gone to the other site, and gone home sick.
• Contractors and visitors aren't on it at all. The HR export knows about employees. The electrician on the roof and the two candidates in the meeting room are in a different book, or in nobody's.
• The visitor book is inside the building. The one record of who walked in this morning is on the desk nearest the door you are now standing outside of.
• Nobody wants to be the one holding it. A clipboard that's known to be incomplete gets used defensively rather than decisively, which is the opposite of what a roll call is for.

What a roll call actually needs to do

Strip it back and the requirements are short, specific, and mostly ignored by general-purpose tools.

• One list, staff and visitors together. Two lists means two people reconciling under pressure. The fire warden needs one screen with everybody on it.
• Readable at arm's length, outdoors. Large type, high contrast, tap-to-mark. Not a spreadsheet you pinch-zoom in the rain.
• A running count of who is unaccounted for. The number that gets handed to the fire department is "we are missing two," not "here is a list, good luck."
• It has to work with the network down. The fire alarm case is exactly the case where the Wi-Fi may have gone down with the building — a roll call that needs a live connection is a roll call that fails on the day it matters. It should run from whatever the device last knew.
• It should err toward "still inside." If a record is ambiguous, the safe assumption is that the person is in the building. Checking on somebody who already left costs thirty seconds; the other mistake doesn't.

Getting staff onto the list without building a timeclock

This is where most attempts stall. To have employees on the roll call, employees have to record that they're on site — and the moment you say that out loud, someone hears "we're installing a punch clock."

That reaction is worth taking seriously rather than arguing with, because the two systems genuinely are different and the difference should be visible in the product. Presence answers one question: is this person on site right now. A timekeeping system answers a different one: how many hours did this person work. The second question brings employment-standards obligations, payroll consequences, and a lot of understandable anxiety.

The practical way to keep them separate is to make the boundary structural rather than a promise. If there is no hours column anywhere, no duration in the export, and no total at the bottom, then "we can't use this for payroll" is a fact about the system rather than an assurance from management. Say that plainly when you roll it out, and adoption stops being a fight.

The sign-in itself should take about a second: a badge card scanned at the tablet, or a short PIN typed on it. Anything slower gets skipped on the days people are in a hurry, which is most days.

The other half of duty of care: how many people are in here

Occupancy limits are the quieter version of the same problem. A site has a number — from your fire code, your insurer, or your own operating rules — and most offices have no way of knowing when they've passed it, because nobody is counting.

A soft limit is usually the right design. Blocking a visitor at the door because the building is one person over is a bad experience and, in a real emergency, an actively harmful one. A banner on the who's-in board and an alert to whoever owns the number is enough: it tells the people who can do something, without turning the reception tablet into a bouncer.

Doing it with WeDisplay

Employee presence and evacuation mode are part of the visitor kiosk, on plans that include them.

• One board, everybody on it. The who's-in board merges checked-in employees and visitors who haven't checked out. Evacuation mode turns it into a full-screen roll call: large type, tap each person as they're accounted for, live count of who's still missing.
• It survives the outage. The roll call is rebuilt from the last data the browser already holds, so it keeps working when the network went down with the building. That's the whole point of the design.
• Ties resolve toward "in." When a timestamp is ambiguous, the person is shown as on site. An evacuation list should err toward checking on somebody who already left, never toward forgetting somebody inside.
• Staff sign in with a badge or a PIN. Every host gets a badge code you can print as a QR card, and optionally a short presence PIN. Issuing a new badge invalidates the old card immediately.
• It is deliberately not payroll. Presence records who is on site. There is no hours math anywhere, and the presence export has no duration column — by design, not by omission.
• A maximum headcount you set. Go over it and you get a banner on the board and an alert to your security contacts. The alert fires on the crossing, not on every check-in after it, so an over-capacity afternoon doesn't send thirty identical emails. Nobody is refused at the door.

Two honest limits worth knowing before you plan around them. Scanning a badge QR with the tablet's camera works on Chrome on Android; iPad Safari doesn't currently support it, so those tablets have people type their code instead. And USB badge readers aren't supported yet — a card scanned by a hardware reader is on the roadmap, not in the product.

If you're starting further back, visitor management for small business covers the check-in flow that feeds this board, and NDAs at reception covers the paperwork side.

FAQ

Does the evacuation list include contractors and visitors? Yes — that's the main reason to have one. The board merges employees who signed in with visitors who checked in and haven't checked out, so the fire warden gets one list rather than a staff export plus a notebook.

What if the Wi-Fi is down during the evacuation? The roll call runs from the data the device already has, which is why it's designed the way it is. You lose live updates — someone checking out during the drill won't appear — but the list itself opens and works.

Is this a timeclock for employees? No, and the boundary is built into the product rather than promised: presence shows who is on site right now, with no hours math anywhere and no duration column in the export. It cannot be used as a payroll record because the numbers a payroll record needs are not there.

How do people mark themselves as leaving? Employees sign out the same way they signed in — badge or PIN. Visitors check out with their visit code or by picking themselves from a list that shows only a first name and an initial. And anyone still signed in when reception closes is checked out automatically on your office hours, so the count resets instead of drifting.