Site security checklist: what to check, how often, and how to show it was done

01

Why a site needs a security checklist

No Australian law requires a document called a site security checklist. The duties behind one come from several places, and a checklist completed on the day is the ordinary way of showing that the security arrangements you rely on are actually in place.

• Work health and safety law. Every state and territory except Victoria has adopted the model Work Health and Safety Act. In Queensland's version, the Work Health and Safety Act 2011 (Qld), section 20(2) requires the person with management or control of a workplace to ensure, so far as is reasonably practicable, "that the workplace, the means of entering and exiting the workplace and anything arising from the workplace are without risks to the health and safety of any person." Any person includes visitors, contractors, shoppers and the person who should not be there at all.
• The WHS Regulations. Under the Work Health and Safety Regulation 2011 (Qld), section 43 requires an emergency plan for every workplace, covering an effective response to an emergency, evacuation procedures and notifying emergency services at the earliest opportunity, with testing of those procedures. Section 40 requires lighting that enables safe evacuation in an emergency. Security arrangements have to work with both.
• Victoria. Victoria has its own Occupational Health and Safety Act 2004 (Vic). Section 26(1) requires a person who has, to any extent, the management or control of a workplace to ensure so far as is reasonably practicable "that the workplace and the means of entering and leaving it are safe and without risks to health", limited by section 26(2) to matters over which that person has management or control.

For a shopping centre, a stadium, a pub, a hotel, a place of worship or any other site open to large numbers of people, there is a second source. Australia's Strategy for Protecting Crowded Places from Terrorism (2023), published by the Australia-New Zealand Counter-Terrorism Committee (ANZCTC), defines crowded places as "locations which are easily accessible by large numbers of people on a predictable basis", and says that their owners and operators "have the primary responsibility for protecting their sites, including a duty of care to take steps to protect people that work, use or visit their site from a range of foreseeable threats, including the threat of terrorist attack." The Strategy expects owners and operators to undertake a risk assessment, then "implement the appropriate mitigations, monitor them for effectiveness (including through audits), and review them at appropriate junctures." A security checklist is how most sites do the monitoring.

Day to day, the insurer and the lease or contract often matter as much: the policy may require a monitored alarm or keyholders, and the contract sets what the landlord, tenant and security provider each check.

02

What a site security checklist should cover

The checklist should come from the site's security risk assessment: what could be stolen, damaged or misused, who might try, and what would follow. A city office tower and a suburban shopping centre face different threats. The Strategy describes layered security, where "the failure of any single layer" will not significantly compromise the site, and its layers (deter, detect, delay, respond) are a useful way to sort the items. A good checklist for an occupied building usually covers:

• Perimeter: fences, gates, bollards and roller shutters intact; no gaps, climbing aids, pallets or wheelie bins stacked against a fence; trespass and security signage in place and legible.
• Doors and access control: external doors locked or attended as the schedule says; card readers, intercoms and door closers working; loading dock doors shut when the dock is not in use; no doors propped open.
• Keys, cards and codes: keys and access cards accounted for against the key register; lost cards cancelled; codes changed when people leave.
• Lighting: external, car park and entry lighting working, with no dark spots at doors, docks or bin enclosures.
• CCTV: cameras on, clean and pointing where they should; recording working, with the right date and time; signs displayed.
• Intruder alarm: set when the building is empty; faults and activations noted; the monitoring centre's contact list and the keyholder list current.
• Restricted areas: plant rooms, comms rooms, cash offices, roof access and stores locked and entered only by authorised people.
• Information and data: business documents locked away and computers logged off and shut down at close, desks cleared out of hours, and monitors, screens and whiteboards facing away from windows, as the Audit's information security questions suggest.
• Housekeeping: entrances, exits, stairs, reception, toilets and car parks clear and tidy, with nothing left that could hide an item or be climbed.
• Emergency readiness: exit doors free to open from inside while people are in the building, exit paths clear, emergency lighting and exit signs working, first aid kit stocked.
• Signs of trouble: damage, graffiti, forced doors, unattended bags or vehicles, or evidence that someone has been sleeping rough or getting in after hours.

Keep the list to what someone can check properly in the time allowed. A forty-item list walked in ten minutes gets ticked, not checked. Where a building has a guard, the checklist belongs in the site instructions so every officer on the post works to the same list.

03

Crowded places: the Self-Assessment Tool and the Security Audit

The Strategy comes with a suite of supplementary materials, including the Crowded Places Self-Assessment Tool, the Crowded Places Security Audit and guidelines on hostile vehicles, active armed offenders, improvised explosive devices and disrupting hostile reconnaissance. The order matters. The Self-Assessment Tool helps an owner or operator understand how attractive their site might be to an attacker, and the Strategy says the Audit "should only be consulted after the Crowded Places Self-Assessment Tool has been completed."

The Crowded Places Security Audit is a set of yes, no or not applicable questions. It says plainly that it "does not attempt to provide a definitive list of all security matters that you must address for your location" and that protective measures "should be proportionate to the level and type of threat." Many of its questions turn straight into items for a routine checklist. Among them:

• "Are security patrols conducted prior to opening, during and after the site or event in order to detect suspicious items or activity?"
• "Are unused offices, rooms and function suites locked?"
• "Are all electronic security passes and keys accounted for and current?"
• "Do you have appropriate external lighting?"
• "Is each CCTV camera doing what it was installed to do?" and "Are your CCTV cameras regularly maintained?"
• "Are there any climbing point vulnerabilities that offer access over the security fence?"
• Whether a systematic search of the site is part of routine housekeeping, including toilets, lifts, restricted areas, car parks and service areas.

The Audit also warns that once completed it "must be treated as sensitive", because the answers could reveal significant vulnerabilities. A site checklist that lists every weak door and camera blind spot deserves the same care: keep it off public noticeboards.

The Strategy also says who to call. In a life-threatening situation, phone 000. Suspicious behaviour that is not time critical goes to the National Security Hotline on 1800 123 400 or to Crime Stoppers on 1800 333 000. Put those numbers on the checklist itself so whoever finds something at 6am does not have to look them up.

04

How often each check is due

There is no statutory frequency for most security checks. The interval follows the risk assessment, the insurer's conditions, the contract and how the building is used. The Audit's own question points to the usual shape: before opening, during, and after. A common pattern for a building occupied during business hours and empty overnight is:

• Before opening: alarm disarmed and any overnight activations noted; perimeter, doors and docks checked for damage or forced entry; toilets, car park and stairwells checked; anything unusual reported before the public arrives.
• During trading or business hours: entrances and loading dock watched; visitors and contractors signed in; exit paths checked for stock, pallets or trolleys; unattended items dealt with under the site's procedure.
• At close: every floor, toilet and fitting room checked for people; doors, windows and shutters locked; restricted areas secured; lights set; alarm armed. A lock-up patrol follows the same order every night.
• After hours: patrols by a guard on site or a mobile patrol, at the times the site instructions set.
• Weekly: CCTV playback checked, the key and card register reconciled, external lighting walked after dark.
• Monthly or quarterly: a fuller inspection against the risk assessment, and for a crowded place, a look back through the Audit's questions.
• At least yearly, after any incident and whenever the site changes: the risk assessment and the checklist reviewed.

Alarm, access control and CCTV systems also need regular maintenance by a competent technician at the intervals the installer and the insurer set. A daily check that the alarm armed is not a substitute for that service.

05

Who does it, and what good evidence looks like

Every item on the checklist should have an owner: a named role, not "security" or "whoever is on". In a shopping centre that is usually the security officer on shift, with the security supervisor or centre manager checking the list is followed. In an office building without guards it may be the building manager, the facilities coordinator, a caretaker or the last keyholder out.

If you engage someone to patrol or watch the property for reward, they must be licensed in the state where the work is done. In Queensland, section 7 of the Security Providers Act 1993 (Qld) defines a security officer as a person who, for reward, "guards, patrols or watches another person's property", and section 9(2) says a person must not engage another person to carry out a security provider's functions for reward unless the other person holds the appropriate licence. Other states have their own Acts and licensing bodies; check yours before the contract starts.

CCTV brings its own obligations. The Office of the Australian Information Commissioner's guidance on security cameras says an organisation covered by the Privacy Act 1988 must tell people their image may be captured before they are recorded, and must keep recorded personal information secure and destroy or de-identify it when it is no longer needed. State and territory surveillance laws apply as well, and some cover workplaces specifically. Checking the signs are up belongs on the list.

A record that shows the checks were done well has the same features on any site:

1. It is completed at the time, at the place, not filled in at the end of the shift from memory.
2. It names the person who did the check.
3. It records exceptions: the dock door found open, the light out, the camera pointing at the sky, and who was told.
4. Faults are followed up: a broken lock recorded on Monday should not still be recorded on Friday.
5. Gaps are explained: a missed closing check with a reason is more credible than a sheet with no gaps at all.
6. Someone reviews it: a manager who reads the checklist every week spots the repeated problem before it becomes an incident.

Incidents belong in the occurrence book or an incident report, not on the checklist. After a break-in, the insurer and police will ask when the building was last checked, by whom and what was found. A checklist that answers all three is worth more than a folder of ticks.

06

Where security checklists fail, and where SiteClara fits

The clipboard in the security office has the same weakness everywhere. It is filled in at the end of the shift, in one hand, with every box ticked. Nobody can tell whether the loading dock was checked at 10pm or ticked at 10pm from the control room. The broken roller shutter is written on the sheet and stays there, because the building manager never sees it.

SiteClara records the checks where they happen. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint: the main entry, the loading dock, the car park stairs, the plant room, the roof door. Whoever does the round scans the code or taps the tag on their own phone, with no app to install, sees the checks due at that point and marks them done, or says what stopped them. The time and the named person are recorded as it happens, with a photo when one is asked for. A fault found on the round is reported there and goes onto the team's list of open jobs until someone closes it, and a supervisor can escalate a job to the building manager, who can answer it.

The supervisor sees what was due, done and missed, and can record the reason a check was missed. Each day's report is reviewed and approved by the supervisor and goes to nominated management or client contacts at 8am the next morning, with what was reported, what is still open and how the scheduled checks went.

07

Questions people ask

What is a security checklist?

A security checklist is a list of security measures answered item by item, so that gaps are found and dealt with. The national example for Australian crowded places is the Crowded Places Security Audit, a set of yes, no or not applicable questions that describes itself as "a menu of security issues, some of which may be relevant to the type, size and risk profile of your crowded place". Its questions cover security governance, physical security (access control, the perimeter, hostile vehicles, CCTV and blast mitigation), detecting suspicious behaviour, information security and personnel security, and it says it is "not intended to provide comprehensive advice". A site's own checklists are shorter and repeated: the checks someone makes at set times to confirm those measures are still in place.

What should be included in a security guard checklist?

The patrols, and what officers need to carry them out. The Crowded Places Security Audit asks "Are security patrols conducted prior to opening, during and after the site or event in order to detect suspicious items or activity?", whether police or other emergency responders on site have "direct communications with your security guards", whether staff who search are "trained and properly briefed on their powers and what they are searching for", and whether security personnel are "trained in detecting suspicious behaviour". A guard's checklist therefore sets the patrol times and route, the checkpoints and what to look for at each, including doors, lighting, CCTV, unattended items and people in restricted areas, and who to tell when something is found.

08

Further reading, and a list to take away

For crowded places, start with Australia's Strategy for Protecting Crowded Places from Terrorism and its supplementary materials, including the Self-Assessment Tool and the Security Audit; state and territory police also run Crowded Places Forums for owners and operators. For the WHS duties, read your state's Act and Regulation, or the Victorian OHS Act, with your state regulator's guidance. If the site is under construction, the duties differ: see construction site security.

Before you print or revise the checklist, check that:

• it comes from a current security risk assessment, and for a crowded place, from the Self-Assessment Tool and the Audit;
• every item has a named owner and a set frequency;
• before-opening, closing and after-hours checks are separate;
• exit paths are checked, and security never stops people leaving in an emergency;
• keys, cards, codes and alarm contacts are reconciled regularly;
• anyone engaged to guard or patrol holds the right state licence;
• CCTV signs are up and recordings are kept secure;
• faults found are reported to someone who will fix them, and followed up;
• the completed checklist is treated as sensitive and reviewed every week;
• the checklist is reviewed after any incident and whenever the site changes.