A security risk assessment is a structured look at what could go wrong on your site, how likely it is and how bad it would be, followed by a plan to reduce those risks. It looks at people, property, information and operations, and it should come before anyone sells you guarding hours. Done well, it stops you paying for security you do not need and missing the security you do.
Why carry out a security risk assessment?
Most businesses buy security in response to an incident. A break in leads to a night guard, a fight leads to more door staff. That is understandable, but it often leaves the real weak points untouched. A risk assessment gives you a clear picture first, so every pound spent on security has a reason behind it.
It also gives you a record. If something goes wrong, you can show insurers, licensing authorities, regulators or a court that you thought about the risk and acted proportionately. Some insurers, licensing conditions and contracts expect one, and enhanced tier premises under Martyn’s Law will need documented security planning.
A health and safety risk assessment looks at hazards to people from your work activities, such as slips, machinery or manual handling. A security risk assessment looks at deliberate harm by other people: theft, violence, trespass, vandalism and terrorism. The two overlap, for example on lone working and violence to staff, and it helps if they refer to each other. A health and safety assessment alone will rarely tell you whether your perimeter, keys or cash handling are adequate.
What does a security risk assessment cover?
A proper assessment looks at:
- Assets: what you need to protect, including people, stock, equipment, data and reputation.
- Threats: who or what could cause harm, from opportunist theft to organised crime, violence, protest or terrorism.
- Vulnerabilities: weak points such as poor lighting, gaps in fencing, unsecured doors or predictable routines.
- Likelihood: how probable each threat is, based on history, location and local crime patterns.
- Impact: what it would cost if it happened, in money, safety, disruption and reputation.
- Existing controls: what already works, and what is not being used properly.
- Recommendations: practical measures, ranked by priority and cost.
How a security risk assessment is carried out
It starts with a conversation. The assessor needs to understand how the site works, who uses it and when, and what has happened before. Then comes a walk round, at least partly at the times when the site is most vulnerable. Many weak points only show up at night or at shift change.
The assessor will look at the perimeter, entrances, lighting, locks, alarms, cameras, reception and visitor processes, deliveries, cash handling and lone working. They should talk to the people who do the work, because staff usually know where the problems are. Local crime data on police.uk can add useful context.
What you should get at the end
You should receive a written report in plain English. It should set out the main risks, explain why each one matters, and recommend measures in priority order. Good recommendations are specific: "add lighting to the rear service yard" is useful, "improve security" is not.
The report should include low and no cost measures as well as paid services. Changing a routine, fixing a door closer or moving cash handling away from a window can matter as much as hiring a guard.
Common findings from security risk assessments
Across many sites, the same issues come up again and again:
- Fire exits propped open or used as a short cut.
- Fencing gaps hidden behind vegetation or stored materials.
- Cameras pointing at the wrong place or recording poor images at night.
- Lone workers opening and closing the site without check calls.
- Keys and access cards never reviewed after staff leave.
- Deliveries accepted without checks on driver identity.
- Alarm activations attended by staff rather than trained responders.
Who should carry out a security risk assessment?
Someone with practical security experience, who understands your sector and has nothing to gain by inflating the risk. An assessor who works for a guarding company should be open about that and prepared to recommend measures that do not involve guarding.
For counter terrorism, ProtectUK has free guidance and tools, and police counter terrorism security advisers can support some premises. For licensed venues, your licensing authority and local police licensing team will have expectations worth discussing.
How often should a risk assessment be reviewed?
Review it at least once a year, and whenever something significant changes: a new building, new opening hours, a change of use, a serious incident or a change in local crime. A risk assessment that sits in a drawer for five years is a record of what used to be true.
Turning the assessment into a security plan
The value is in what happens next. Take the recommendations and decide, for each one, whether you will act on it, when, who owns it and what it will cost. Some will be quick fixes for the facilities team. Others will need budget or a change to a contract.
Where guards, patrols or CCTV are recommended, the assessment should feed straight into the assignment instructions: what officers check, when, and what they do when they find something. That link between the risk and the officer’s daily routine is what makes the assessment worth doing.
Security risk assessments from KBG
KBG Security Solutions carries out security risk assessments for offices, industrial sites, warehouses, venues, schools and construction projects from our West Bromwich head office. We have worked in security since 2007, we are an SIA Approved Contractor, and we hold ISO 9001:2015. We will walk your site, talk to your team and give you a written plan before we suggest any hours.
Start with a free site survey. Call 0845 388 0348.
