Vendor risk in security operations is rarely about bad intent; it’s usually about weak governance, unclear KPIs, and poor evidence of performance.
A good audit makes performance measurable and accountability explicit.
What to Audit First
Start with the controls that impact safety and loss the most. Don’t begin with paperwork if the floor reality is weak.
- Recruitment, screening, and training records
- Post orders and supervision schedule
- Incident reporting quality and closure discipline
- Access control and visitor workflows (if applicable)
- Uniform, equipment, and fatigue management
KPI Design That Prevents Gaming
If KPIs are only counts, teams will optimise for counts. Balance leading indicators (patrol compliance) with lagging outcomes (loss events).
Define what good evidence looks like: logs, photos, timestamps, supervisor checks—not just claims.
Practical KPI Examples (With Evidence)
A KPI is only useful if you can verify it quickly during an audit. Define the data source, evidence, and sampling method.
- Patrol compliance (%): completed checkpoints / scheduled checkpoints; evidence = time-stamped scan + supervisor spot-checks
- Post adherence (%): observed adherence to post orders; evidence = supervisor rounds + random interviews + CCTV spot review (where allowed)
- Incident closure discipline (%): incidents closed with root cause + corrective action; evidence = incident log with owner and closure notes
- Response time (median): from call to arrival for priority incidents; evidence = radio logs / timestamps / incident system records
Corrective Action That Sticks
Action plans fail when owners and timelines are vague. Assign owners, deadlines, and verification steps.
Audit Walk Script (30 Minutes)
If you only have half an hour on-site, you can still learn a lot. Use a consistent script so results are comparable across locations and vendors.
- Entry briefing: confirm post orders, roster, and supervisor contact for the shift
- Spot check 3 posts: ask guards to describe their post orders and escalation triggers in their own words
- Review the last 10 incidents: check categorisation, response notes, and closure quality
- Verify equipment readiness: radios, batteries, torches, PPE, and any mandated tools
Checklist
- Validate floor reality with spot checks and interviews.
- Review training, screening, and supervision evidence.
- Assess incident logging quality and closure rate.
- Rebuild KPIs with clear evidence requirements.
- Sample and verify KPI evidence (not just reports).
- Set corrective actions with owners and verification.
Audits should be conducted in line with labour, privacy, and contract requirements.