These are all great methods, I think. What comes to mind further is demonstrating an email phishing attack, a social engineering scenario with caller ID spoofing, and access card cloning. Unless none of these is relevant in the given environment.