Security site instructions and post orders: what they should say, and how to keep them working

01

What site instructions and post orders are, and the duties behind them

Site instructions are the written, site-specific procedures a security company gives the officers it posts to a client's premises. They turn the security contract and the site's risk assessment into working detail: which posts are staffed and when, the patrol routes and checkpoints, access control, alarm response, the lock-up sequence, emergencies and reporting. Australian providers use several names for the same document. Post orders usually means the instructions for one post, such as the loading dock or the front desk; assignment instructions and standing orders usually mean the whole set for the site.

No Act requires a document called site instructions. The duty behind them comes from work health and safety law. In every state and territory except Victoria, the law follows the model Work Health and Safety Act 2011. The Queensland text of that model law, the Work Health and Safety Act 2011 (Qld), is typical. Section 19(3)(f) requires a person conducting a business or undertaking (PCBU) to ensure, so far as is reasonably practicable, "the provision of any information, training, instruction or supervision that is necessary to protect all persons from risks to their health and safety" arising from the work. Section 28(c) requires a worker to comply, so far as they are reasonably able, "with any reasonable instruction that is given" by the PCBU. For a security company, the site instructions are the main place that instruction is written down.

There are usually two PCBUs on a guarded site: the security company that employs the officer, and the building owner, manager or tenant that controls the premises. Section 46 of the same Act says that where more than one person has a duty in relation to the same matter, each "must, so far as is reasonably practicable, consult, cooperate and coordinate activities" with the others. Agreeing the site instructions with the client is one of the most practical ways to do that.

Victoria is the exception. Its main workplace safety law is the Occupational Health and Safety Act 2004, which, in the words of WorkSafe Victoria's page on the OHS Act and regulations, seeks "to protect the health, safety and welfare of employees and other people at work". The words differ, employer rather than PCBU, but the practical answer is the same.

The industry's own framework expects them too. The Security Services Industry Award 2020, which covers the security services industry throughout Australia, describes a Security Officer Level 2 as someone who "works from complex instructions and procedures under general supervision, which may not necessarily be at the site where the officer is posted". That last phrase is the everyday reality of guarding: the supervisor is often across town, so the instructions have to carry the detail.

Private security is licensed by each state and territory, and in each one the entry training is built on the national CPP20218 Certificate II in Security Operations. In Victoria, for example, the Licensing and Regulation Division of Victoria Police regulates the industry, keeps a public register that "allows businesses and individuals to ensure that their employees are appropriately licensed", and lists that certificate among the eligibility and training requirements for an unarmed guard. Other states have their own Acts and regulators.

Two of the units in that certificate describe exactly what site instructions are for. CPPSEC2107 Patrol premises to monitor property and maintain security (release 1) expects an officer to:

• "Read work instructions and standard operating procedures for patrol and clarify work tasks with relevant persons" (1.1);
• "Confirm patrol area, access and entry points and alarm locations, and clarify issues with relevant persons" (2.3);
• "Patrol premises following site patrol schedules, routes and work instructions" (3.2);
• "Record details of patrol and incidents using workplace documentation" (5.2).

CPPSEC2102 Apply legal and procedural requirements to work effectively within a security team (release 1) adds "Check work instructions and confirm own role, responsibilities, authority and reporting requirements and timeframes" (2.1).

So every licensed officer has been trained to look for the site's instructions, patrol schedule and reporting requirements. If the site has none, or a binder nobody has opened since the contract started, the gap is the provider's, not the officer's.

02

What security site instructions should include

The contents depend on the site, whether it is a CBD office tower, a shopping centre, a hospital, a university campus or a building site. Good site instructions and post orders usually cover:

• The site: address, a short description, and site plans marked with entrances, exits, the fire indicator panel, the emergency warning system, hydrants and hose reels, first aid kits, the AED, isolation points and the assembly areas.
• Contacts: the client's representatives, the building manager, the security company's control room and supervisor, keyholders, maintenance contractors and the out-of-hours escalation list, with 000 at the top for police, fire and ambulance.
• Posts and hours: each post, when it is staffed, and the post orders for it – what the officer does there, what they may leave the post for, and who covers breaks.
• Patrol routes: each route, the checkpoints on it, the times and frequency, and what to check at each point – doors, roller shutters, gates, fire exits, plant rooms, car park levels, lifts.
• Access control: passes and access cards, visitors and contractors, after-hours entry, deliveries at the loading dock, vehicles and the car park.
• Keys: which keys and cards the post holds, the key register, and who may sign them out.
• Systems: CCTV, intruder alarm, access control and the fire indicator panel, with what to do for each kind of alarm or fault, and what the officer must never isolate or reset.
• Emergencies: the officer's part in the building's emergency plan – working with the chief warden and the other wardens (see fire warden duties), meeting the fire brigade at the fire indicator panel, evacuation, medical emergencies, bomb threats, lift entrapments, floods and power failures, and, in the north, cyclones.
• Lock-up and unlock: the order the building is opened and secured, and how the officer confirms each area is empty and closed; see lock-up patrols.
• Incidents and faults: what must be reported, to whom and how quickly, and the forms to use, including the incident report.
• Health and safety: the risk assessment for the site, working alone at night, dealing with aggression, hazards on site and personal protective equipment.
• Conduct and limits: uniform, carrying and producing the licence, the use of force policy, searches only with consent, never locking a fire exit while people are inside, phone use and breaks.
• Records: the occurrence book, patrol records, handover notes, how the client receives reports, and who may see CCTV footage and visitor registers.
• Version and sign-off: the date, version number, who approved it for the client, and a sign-on sheet for officers.

A template saves time, but instructions copied from another site are a common fault. The site's own layout, risks, people and phone numbers must be in them.

03

Writing post orders that officers actually use

Site instructions often end up as a binder in the security office that nobody reads after induction. A few habits keep them working:

• Be specific. "Patrol the building regularly" tells an officer nothing. "Patrol route B, checkpoints 1 to 8, at 22:00, 01:00 and 04:00, checking every ground floor fire exit is closed and the loading dock roller shutter is down" does.
• Say what to do, not only what to watch for. For each alarm, incident or emergency, set out the steps in order and who to call.
• One post, one page. An officer responding to a fire alarm at 3am needs the procedure on one page, not in chapter nine. Put the post orders for each post on their own sheet.
• Keep contacts current. An out-of-date escalation list is worse than none, because it wastes the minutes that matter.
• Separate the permanent from the temporary. A contractor on site for a fortnight, a door out of action or a fire system impairment goes in a dated temporary instruction, not an edit to the whole document.
• Write in plain English. Many officers speak English as a second or third language, and short sentences, with the same word for the same thing, help everyone.

04

Agreeing, signing and reviewing them

Site instructions are the security provider's document, usually written by its operations or account manager, but they describe the client's building and the client's requirements, so the client should approve them. They must also fit the building's emergency plan. Under regulation 43 of the Work Health and Safety Regulation 2011 (Qld), which follows the model regulations, a PCBU at a workplace must ensure an emergency plan is prepared that provides for emergency procedures, the testing of those procedures and "information, training and instruction to relevant workers in relation to implementing the emergency procedures", and must maintain it "so that it remains effective". The officer's emergency duties should follow the building's plan, not a second one; see AS 3745 emergency planning.

The usual cycle is:

1. Draft at mobilisation, after a site survey, the security risk assessment and a read of the building's emergency plan.
2. Agree with the client, and record who approved which version and when.
3. Induct every officer on site, walking the patrol routes and showing them the fire indicator panel, the exits and the assembly area, and have them sign that they have read and understood the instructions. Casual, relief and mobile patrol officers need the same induction before their first shift.
4. Keep the current version at the post, on paper or on a device, where officers can reach it at any time, with superseded versions removed.
5. Review and re-sign when something changes.

No law sets an expiry date. Review the instructions whenever the site, its risks or the client's requirements change – after an incident, a fit-out or change of tenant, new systems, a change to the emergency plan or a new threat – and at a fixed interval as well, such as once a year. Each time they change, officers sign again for the new version. Keep superseded versions on file in the office rather than at the post, so that any future question about what the instructions said on a given night can be answered.

05

How to check the instructions are followed

Site instructions only work if somebody checks the work against them. The supervisor and the client's representative can use them as the yardstick:

• Supervisor visits, including unannounced night visits: ask the officer what they would do if a particular alarm went off, where the nearest exit is, or who the out-of-hours contact is. The answer should match the instructions.
• Record checks: compare the occurrence book and patrol records with the routes, checkpoints and times the instructions set.
• Sign-on sheet: check that every officer who has worked the site since the last version has signed it, including relief officers.
• Licence checks: each officer's licence is current, covers the work, and appears on the state's public register where there is one.
• Incident reviews: after any incident, check whether the procedure was followed and whether the procedure was right.

Where the record and the instructions disagree, one of them needs to change: either officers are not following the instructions, or the times cannot be done alongside everything else the post has to do. It is a conversation worth having before the client raises it.

06

Where site instructions fail in practice, and where SiteClara fits

The post orders say the night officer visits eight checkpoints three times a shift. The occurrence book says "patrols completed, all secure", written in one hand at 5:45am. Nobody can tell from that line which checkpoints were visited, when, or whether anyone checked the fire exit at the far end of the car park. The instructions are clear; the evidence that they were followed is not. The same happens with faults: the broken roller shutter is noted in the book, but the building manager never hears about it, and three weeks later it is still broken.

SiteClara turns the patrol in the site instructions into a record. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint the instructions name. The officer scans the code or taps the tag on their own phone, with no app to install, sees the checks due at that point and marks them done, or says what stopped them. The time and the named officer are recorded as it happens, with a photo when one is asked for. Anything found wrong is reported there and goes onto the team's list of open jobs until someone closes it, and a supervisor can escalate a job to the building manager, who can answer it.

The supervisor sees what was due, done and missed, and can record why a check was missed. At the end of the day the supervisor reviews it and approves the daily report, which goes to nominated management or client contacts at 8am the next morning, showing how the scheduled checks went – for example 24 of 24 completed – and what is still open.

07

Questions people ask

What does "post order" mean?

A post order is the written instruction for one security post, such as the front desk or the loading dock, setting out what the officer does there, when, and who to call. No Australian law defines the term. The national training unit CPPSEC2107 Patrol premises to monitor property and maintain security calls these documents work instructions and standard operating procedures, and expects every officer to "Read work instructions and standard operating procedures for patrol and clarify work tasks with relevant persons" (1.1) and to "Patrol premises following site patrol schedules, routes and work instructions" (3.2).

What is the main purpose of post orders?

To give officers the instruction they need for their site, which work health and safety law requires a security company to provide. Section 19(3)(f) of the Work Health and Safety Act 2011 (Qld), which follows the model WHS Act, requires a PCBU to ensure "the provision of any information, training, instruction or supervision that is necessary to protect all persons from risks to their health and safety arising from work carried out as part of the conduct of the business or undertaking", and section 28(c) requires a worker to comply, so far as they are reasonably able, "with any reasonable instruction that is given" by the PCBU. Post orders are where a security company writes that instruction down, so that any licensed officer can take over the post and do the job the same way.

08

Further reading, and a list to take away

For the safety duties, read the WHS Act and Regulation in force in your state or territory, or in Victoria the OHS Act 2004 and its regulations. For licensing, start with the regulator where the officers work; in Victoria that is the Victoria Police Licensing and Regulation Division. The units CPPSEC2107 and CPPSEC2102 on training.gov.au show what every newly licensed officer expects from a site's instructions.

Before an officer's next shift on the site, check that the site instructions:

• are written for this site, not copied from another;
• set out each post, patrol route, checkpoint and time;
• give the steps and who to call for each alarm, incident and emergency;
• match the building's emergency plan and name the chief warden;
• have a current contact and escalation list, with 000 first;
• are approved by the client, with the version and date recorded;
• have been read and signed by every officer who works there, relief officers included;
• are kept at the post where officers can reach them;
• have a date for their next review.