quote research, figures or anyone else’s findings.
A security check is not a walk round the building with a clipboard. It is an argument,
written down: here is what we need to protect, here is what could go wrong, here is what it would cost
us, so here is what we should do first.
That structure is what lets you explain the decision six months later when
somebody asks why you spent the money.
1. List what you are protecting
Start with what matters, not with what could go wrong. People first. Then equipment and stock. Then
information and computer systems. Then the ability to keep trading.
For each one, write down where it is, who needs to reach it, and what would happen if it were
damaged, stolen or made public. If you cannot describe the consequence, it probably does not belong on
the list.
Most checks go wrong here. If you start with scary scenarios instead, you end up with a long list and
no way to rank it.
2. Work out what could realistically happen
Realistically is the important word. The question is not what is imaginable. It is what has actually
happened to businesses like yours, in places like yours.
Use your own incident records, local crime patterns, and what your staff tell you. The people who
work in the building usually know exactly where the weak points are. They are rarely asked.
3. Find the weak points that connect the two
A weakness only matters when you link it to something worth protecting. An unwatched fire door
matters because it lets someone reach a floor holding something valuable.
Describe it that way and the fix becomes obvious.
Test things rather than just looking at them. Does the door system really block a cancelled pass?
Does anyone actually respond to the alarm? Is the camera over the loading bay recording, in focus, and
kept long enough to be useful?
4. Score everything the same way
How likely it is, against how bad it would be. That is enough for most businesses, as long as you
write down what each score means before you start and use it the same way everywhere.
The exact method matters far less than being consistent. Two people scoring the same site should
reach roughly the same answer.
Always write down why you gave a score. A number with no reasoning cannot be challenged, which sounds
convenient until someone senior challenges it anyway.
5. Decide what to do, including what to ignore
For anything scored too high, you have four choices: reduce it, insure against it, stop doing the
activity, or accept it.
Accepting a risk is a perfectly good decision when it is made deliberately, written down, and signed
by someone senior enough to make it. The risks that cause trouble later are the ones accepted quietly by
nobody in particular.
Give each recommendation a rough cost and put them in order. If everything is urgent, nothing is.
6. Set the next review date now
A check describes your building on one particular day. Tenants move, layouts change, risks shift.
Put the review date in the report itself. Also list the events that would mean checking sooner: a new
site, a serious incident, or a change in how the building is used.
Five mistakes to avoid
- Checking the plan instead of reality. If the door is propped open every
afternoon, that is what you assess. - Only talking to managers. Reception, cleaners and night staff see how
the building really runs. - Leaving out computers. Door systems and cameras are computers, and
belong in the check. - Writing recommendations with no owner. A job nobody owns is a wish.
- Never looking at it again. A check nobody repeats stops being true
quite quickly.