Construction site security: the WHS duty, the nightly lock-up and the patrol that proves it

01

The duty: securing a construction workplace under WHS law

Most of Australia has adopted the model work health and safety laws, state by state. Under the model WHS Regulations, a construction site has a specific security duty of its own. In Queensland's version, the Work Health and Safety Regulation 2011 (Qld), section 298 says: "A person with management or control of a workplace at which construction work is carried out must ensure, so far as is reasonably practicable, that the workplace is secured from unauthorised access." In deciding what that takes, the person must have regard to all relevant matters, including the risks to health and safety arising from unauthorised access, the likelihood of it happening (the regulation's example: "The proximity of the workplace to places frequented by children, including schools, parks and shopping precincts."), and, to the extent that unauthorised access cannot be prevented, how to isolate hazards within the workplace.

That duty sits on top of the general one. Section 20 of the Work Health and Safety Act 2011 (Qld), the model Act as Queensland adopted it, requires the person with management or control of a workplace to ensure, so far as is reasonably practicable, that the workplace, the means of entering and exiting it and anything arising from it are without risks to the health and safety of any person. Any person includes the teenager who climbs the fence on a Saturday night.

Two more provisions in the same regulation carry the idea down to particular hazards:

• Scaffolds. Section 225(5) requires the person with management or control of a scaffold to ensure that unauthorised access to it is prevented while the scaffold is incomplete or unattended, with danger tags and other warning signs given as an example.
• Trenches. Section 306 requires a person who proposes to excavate a trench at least 1.5 metres deep to ensure, so far as is reasonably practicable, that the work area is secured from unauthorised access, including inadvertent entry.

On a construction project, work costing $250,000 or more (section 292), the principal contractor has extra duties. Section 308 requires signs, clearly visible from outside the workplace, showing its name and telephone numbers, including an after-hours number. Section 309 requires a written WHS management plan before work starts, including site-specific rules and the arrangements for managing incidents.

02

What securing a construction site covers in practice

The law sets an outcome, not a specification. The approved code of practice fills in what reasonably practicable looks like. The Code of Practice: Construction work (SafeWork NSW, August 2019), based on Safe Work Australia's model code, deals with site security under the same clause 298 and suggests these as the working parts of a secure site:

• A perimeter fence where it is needed. For sites close to a route travelled by children, such as a school, park or recreational area, the code says to consider a perimeter fence if hazards cannot be removed or secured against unauthorised access.
• A fence that does the job. The code's guidelines: it should be difficult to get under and to scale; it should withstand the loads it may meet, such as wind, people trying to climb it and vehicle impact; where it is made of discrete panels, the joints should not weaken it; and gates should not be a weak point, with a closed gate as secure as the panels.
• Work areas left safe. Open excavations barricaded or isolated before the site is left, trenches filled as soon as practical, and unfilled trenches barricaded against access after hours.
• Scaffolds that cannot be climbed. The code's example is bricklaying subcontractors removing access ladders before leaving the site.
• Entries and exits locked. The code's sample safe work method statement lists the control as "Scaffolding and site fencing is secure and serviceable. Entries and exits must be locked at the end of each day."

Around those sit plant with keys removed, fuel and chemicals locked away, materials inside the boundary, sheds locked and lighting at the gates. During the day the fence may be open so people can come and go safely, as the code notes, which is why the end-of-day lock-up matters.

Theft and vandalism of tools, equipment and materials is the other half of construction site security, and it is not a WHS matter in itself. It is worth managing with the same routine, because the gap that lets a thief in lets a child in too. The site security checklist guide covers the physical checks in more detail.

03

Who secures what: principal contractor, subcontractors and guards

On a building site several businesses often share the duty. The code of practice is clear that, depending on the circumstances, both the builder and the subcontractors may have the security duty for the part of the workplace they manage or control, and that they must consult to agree who will actually secure what. Its worked example: both must ensure, so far as is reasonably practicable, that the risk of anyone falling into open excavations after hours is eliminated or minimised; the excavation subcontractor might barricade the excavation area in an agreed way, and the builder might fence the whole site. Section 46 of the model Act, the duty to consult, cooperate and coordinate with other duty holders, is what makes that agreement a legal expectation rather than a courtesy.

The practical result is a split that should be written down, usually in the WHS management plan or the site rules:

• The principal contractor: the perimeter, gates, hoardings and signage, lighting, the lock-up routine and any security contract.
• Each subcontractor: their own work area before they leave, such as their excavation, scaffold ladders, plant and chemicals.
• The last person out: a named role, not whoever happens to be leaving, who walks the lock-up and records it.
• A security provider, if engaged: guards, mobile patrols, alarm response or monitored cameras, working to written instructions.

Security work is licensed by each state and territory under its own law, so a guard or patrol company engaged for a site must hold the licences that state requires. In Victoria, for example, the Licensing and Regulation Division of Victoria Police regulates the industry under the Private Security Act 2004, and the Victoria Police private security page notes that from 19 June 2025 all private security activities are licensed activities. An unarmed guard there needs the qualification set out on the Victoria Police eligibility requirements and training page, and the Victoria Police public register of licence holders can be searched by name or number; the page says it is the responsibility of employers and business operators to check it regularly. Check the equivalent register in your own state before a guard starts on site.

Whoever does the work, give them the site in writing; the security site instructions guide covers what that should hold.

04

The nightly lock-up and the after-hours patrol

Sites are rarely as secure as everyone thinks: a gate left on the latch for a late delivery, a panel lifted for the concrete pump and never re-clamped. A lock-up walked and recorded every day, at the same points in the same order, catches those:

1. Walk the perimeter from the inside: every fence panel clamped and footed, no gaps under the mesh, shade cloth intact, nothing stacked against the fence that could be used to climb it.
2. Check each open excavation and trench is barricaded, covered or isolated as agreed, and that edge protection and covers on penetrations and voids are in place.
3. Check every scaffold access point: ladders removed or locked, access gates closed, danger tags on any incomplete bay.
4. Check plant: keys out and in the key safe, attachments lowered, elevating work platforms stowed.
5. Lock the sheds, containers, fuel and chemical storage.
6. Check the lighting works at the gates and hoarding line.
7. Close and lock each gate last, and record that it was done, by whom and at what time, with anything found and what was done about it.

After hours, the usual options are static security guards, a mobile patrol, alarms with remote monitoring, CCTV surveillance, or a combination. The duty prescribes none of them; it asks what is reasonably practicable given the risk and the likelihood of entry. A small site behind a solid fence in an industrial street may need only a proper lock-up. A high-rise frame next to a school, or a site already broken into twice, may justify patrols at set times, especially over long weekends and the Christmas shutdown.

A patrol is only as useful as its instructions and its record. Tell the patrol which gates to check, which areas never to enter, and what to do on finding a breach. Ask for a record of each visit that shows the time, the points checked and anything found, rather than a line that says "site secure". The lock-up patrols guide covers patrol routines in more depth.

Review the arrangements as the job changes. The code lists changes in access and site security among the topics for a toolbox talk, and section 311 requires the principal contractor to keep the WHS management plan up to date. A slab in March and a six-storey frame in August have different hazards and different ways in.

05

Break-ins, trespassers and the evidence worth keeping

After a break-in, people come first, then making the area safe, then the record. If someone has been hurt on site, even someone who had no right to be there, check whether it is a notifiable incident. Under the model Act, as in sections 35 to 37 of the Queensland Act, a notifiable incident is a death, a serious injury or illness, or a dangerous incident, and the regulator must be notified. Section 39 requires the person with management or control of the workplace to ensure, so far as is reasonably practicable, that the incident site is not disturbed until an inspector arrives or any earlier time an inspector directs. The exceptions are narrow: helping an injured person, removing a deceased person, action that is essential to make the site safe or to minimise the risk of a further notifiable incident, a police investigation, and anything an inspector or the regulator permits.

For theft and damage, report to the police, and tell the next crew what was found before work starts: a moved barricade or a missing cover on a void is a hazard to workers too. Then fix the weakness and record the fix.

The evidence that shows a site was secured so far as reasonably practicable is mostly ordinary and dated:

• The security arrangements in the WHS management plan or site rules, including who secures what, and each revision.
• The daily lock-up record: the points checked, by whom, at what time, what was found and what was done.
• Patrol or guard records: each visit, the points checked, anything found and who was told.
• Faults found in the fence, gates, lighting or barricades, with when they were reported and when they were put right.
• Incident and break-in reports, police event numbers where there are any, and what changed as a result.
• Toolbox talk records where site security was covered, which the code suggests keeping with the topic, attendees and feedback.

None of this needs to be elaborate. What matters is that each entry was made at the time, at the place, by the person who did the check, and that a problem found on Tuesday can be followed to the day it was fixed. The security occurrence book guide covers the running log a guard keeps.

06

Where construction site security records fail, and what SiteClara does about it

The lock-up record usually fails in familiar ways. The sheet in the site office is ticked for the whole week on Monday, or at the office door rather than at the gates. The last trade out assumes the site manager will check, and the site manager assumes the last trade did. The patrol report says "site secure, no issues" for every visit. And a panel down on the north boundary is mentioned at the smoko hut and never reaches anyone who can fix it.

SiteClara records work and reports at the location. A printed QR poster, with an optional NFC tag behind it, sits at each place where a check is scheduled, such as each gate, the scaffold access points, the plant compound, the chemical store or the site office. Staff scan or tap on their own phone, with no app to install, to mark a scheduled check done, or to say it could not be done and why. They can also report a problem there, with a photo when one helps, and the report goes onto the team's list of open jobs until someone closes it. Each record carries the location, the time and the named person, so a lock-up walked gate by gate shows as exactly that, and a patrol that checked four points out of six shows as four.

The supervisor sees the open jobs and the day's checks, adds a note and approves a daily report that goes to nominated management or client contacts the next morning, showing what was checked, reported, fixed and still open. That turns "the site was locked up" into a list of gates with times and names, and "I told someone about the fence" into a dated job with a close.

07

Questions people ask

What security is needed on a construction site?

Enough to keep people out so far as is reasonably practicable, judged against the risk and the likelihood of entry. Section 298 of the Work Health and Safety Regulation 2011 (Qld), the model provision, says the person with management or control of a workplace at which construction work is carried out "must ensure, so far as is reasonably practicable, that the workplace is secured from unauthorised access", having regard to the risks from unauthorised access and "the likelihood of unauthorised access occurring". No particular fence, guard or camera is prescribed.

Who is responsible for site security?

The person with management or control of the workplace, which on most jobs means the builder or principal contractor and each subcontractor for its own work area. The Code of Practice: Construction work (SafeWork NSW) says "both the builder and subcontractors may have these duties in relation to the part of the workplace over which they have management or control", and that they "must, so far as is reasonably practicable, consult to reach an agreement about who should actually secure the site".

How do you secure a construction site?

Fence the perimeter where hazards cannot be removed or secured, especially near a route children use, make each work area safe before leaving, and lock the entries and exits at the end of each day. The Code of Practice: Construction work (SafeWork NSW) says a fence "should be difficult to gain access under the fence and to scale the fence", that "gates should not represent a weak point", and gives examples such as barricading unfilled trenches after hours and bricklayers removing scaffold access ladders before they leave.

08

Where to read more, and a list to take away

The duties are in your state's WHS regulation; the Work Health and Safety Regulation 2011 (Qld) shows the model provisions in Chapter 6. In Victoria, start from the Occupational Health and Safety Act 2004 (Vic). The practical detail is in the Code of Practice: Construction work; your own state regulator publishes its approved version. For security licensing, go to your state's licensing regulator.

A short list to take away:

• Assess who lives, plays and walks nearby, and what an intruder could fall into or climb.
• Write down who secures what, including each subcontractor's work area.
• Fence so it is hard to climb or get under, with gates as strong as the panels.
• Name the person who walks the lock-up, and record it gate by gate, with times.
• Check guards' licences on your state's register, and ask for patrol records that show points and times.
• Report fence, gate and lighting faults to someone who will fix them, and record the fix.
• Review the arrangements whenever the job changes shape.