Hi Cedric. This is a fascinating episode.

It seems amazing that a company which is sufficiently concerned about security to hire a pen testing team did not have procedures in place to ensure the access control system server was protected with something better than admin/admin.

My guess is that they did have such procedures but that they were insufficiently monitored. You can have the tightest standards and procedures in the world, but if there is no checking for compliance they are worthless.