Building security checklist: what to check, how often, and how to show it was done

01

Why a building needs a security checklist

No Canadian law requires a document called a building security checklist. The duties behind one come from several places, most of them provincial, and a checklist with a record behind it is the ordinary way of showing that those duties are met day to day. The examples below are Ontario's, because Ontario is the most populous province; every province and territory has its own equivalents, and for health and safety, federally regulated workplaces such as banks, airports and telecoms fall under Part II of the Canada Labour Code instead of the provincial act.

• Occupiers' liability. Ontario's Occupiers' Liability Act says that an occupier "owes a duty to take such care as in all the circumstances of the case is reasonable to see that persons entering on the premises, and the property brought on the premises by those persons are reasonably safe while on the premises". An occupier includes a person "who has responsibility for and control over the condition of premises or the activities there carried on", so a property manager or a tenant can be one as well as an owner. A lesser duty applies to people who willingly assume the risks of entering. Most other common-law provinces, British Columbia and Alberta among them, have similar statutes; Saskatchewan and Newfoundland and Labrador have none and rely on case law, and Quebec's Civil Code sets its own rules.
• Occupational health and safety. Ontario's Occupational Health and Safety Act requires an employer to "take every precaution reasonable in the circumstances for the protection of a worker" (clause 25 (2) (h)). Part III.0.1 adds duties on workplace violence: the employer must "assess the risks of workplace violence that may arise from the nature of the workplace, the type of work or the conditions of work" (subsection 32.0.3 (1)), and the program that follows must include measures and procedures to control those risks and to summon immediate assistance.
• The fire code. Security must never defeat the means of escape. The Ontario Fire Code, O. Reg. 213/07, Division B, requires that "means of egress shall be maintained in good repair and free of obstructions" (Article 2.7.1.7), and that locking, latching and other fastening devices on exit doors let a door be "readily opened from the inside with no more than one releasing operation and without requiring keys, special devices or specialized knowledge", unless otherwise approved (Article 2.7.2.2). Chaining an exit door at night because of break-ins is exactly what that forbids. Other provinces adopt the National Fire Code of Canada with their own amendments.
• Construction sites. Ontario's construction projects regulation, O. Reg. 213/91, section 65, says that if work on a project may endanger a person using a public way, "a sturdy fence at least 1.8 metres in height shall be constructed between the public way and the project".
• Security licensing. Where guards do the checks, provincial licensing applies. Ontario's Private Security and Investigative Services Act, 2005 defines a security guard as a person who performs work, for remuneration, "that consists primarily of guarding or patrolling for the purpose of protecting persons or property", and section 6 prohibits acting as one without the appropriate licence. British Columbia licenses security guards, alarm installers and locksmiths through its security services licensing program.
• Privacy. Cameras that record identifiable people bring privacy law with them. The Office of the Privacy Commissioner of Canada's Guidelines for Overt Video Surveillance in the Private Sector (2008) set out how businesses should use them; Alberta, British Columbia and Quebec have their own private-sector privacy laws and regulators.

In practice two more sources often matter as much: the insurer, whose policy may require a monitored intrusion alarm, named keyholders or checks on a vacant building, and the client, landlord or condominium board, whose contract or post orders set what the security provider must check.

02

What a building security checklist should cover

The checklist should come from a security risk assessment of the threats the building faces: what could be stolen, damaged or misused, who might try, and what would follow if they did. The list should be the building's own. Public Safety Canada's guide Enhancing Canada's Critical Infrastructure Resilience to Insider Risk (2019) is a reminder that the risk is not only from outside: it says "areas where there is a need for physical control of access should be clearly identified and demarcated". A good checklist then covers the physical measures that answer the risks:

• Exterior and perimeter: fences, gates and barriers intact, with no gaps or loose panels; no ladders, pallets, bins or snowbanks against a fence or a low roof that someone could climb; signs in place.
• Doors and entrances: main entrances, side doors, loading dock doors and overhead doors closed and latched; door closers working; nothing propping a door open; no damage to frames or locks.
• Access control: fob and card readers working; the lobby intercom answering; visitor and contractor sign-in in use; lost or unreturned fobs deactivated.
• Keys and fobs: keys, master keys and spare fobs accounted for against the key log; codes changed and access removed when someone leaves.
• Lighting: exterior, entrance, parking lot and parkade lighting working, with no dark corners at doors, stairwells or garbage enclosures, and good visibility of entrances from the street and from inside. In winter it is dark at lock-up for months.
• CCTV: cameras on, clean and aimed where they should be; recording working; date and time correct; notice signs posted at the entrances; remote viewing of the cameras and the access control software protected by strong passwords and multi-factor authentication.
• Intrusion alarm: armed when the building is empty; motion detectors not blocked by stock or furniture; faults and activations recorded; keyholder and monitoring contacts current.
• Exits and fire safety: exits and exit stairs clear and unlocked from the inside while the building is occupied, exit signs lit, fire doors closed and not wedged, no combustible waste stacked against the building.
• Sensitive rooms: electrical rooms, mechanical rooms, the server room and data closets, the elevator machine room, roof hatches and storage rooms locked and entered only by authorized people.
• Parkade and parking: overhead doors closing behind each vehicle, stairwell doors latched.
• Signs of trouble: forced doors or windows, graffiti, broken glass, needles, water leaks or anything that suggests someone has been inside after hours.

Keep it to what someone can check properly on the round. A list of forty items walked in ten minutes gets ticked, not checked.

03

Adjusting the checklist to the building

The core list stays the same; the emphasis changes with the building.

• Office buildings: after-hours access for tenants and cleaners, the loading dock and freight elevator, couriers left in the lobby, and floors where one tenant's staff leave doors unlocked.
• Condominiums and apartment buildings: the lobby doors and vestibule, parkade gates, bike and storage lockers, the garbage room and the move-in elevator. The condominium manager or superintendent often owns the checklist, with a concierge or guard doing the rounds.
• Schools: a single controlled entrance during the day, exterior doors checked after recess and at dismissal, portables, and the evening permit groups who use the gym.
• Warehouses and industrial buildings: yard fencing and gates, trailers and dock doors, forklift keys, fuel and propane cylinders stored securely away from the fence, and high-value stock.
• Vacant or partly vacant buildings: every entry point secured, utilities and heat checked so pipes do not freeze, and regular inspections at the frequency the insurer sets. See vacant building inspection.

A construction site changes every week, so its checklist needs reviewing more often than one for a finished building. It usually adds ladders removed or boarded at the end of the day, excavations covered or fenced, equipment parked inside the compound and immobilized, deliveries stored rather than left at the gate, and the site trailer locked.

04

How often each check is due

Most security checks have no frequency set in law. The right interval follows the risk assessment, the insurer's conditions, the post orders and how the building is used. A common pattern for a building that is occupied during the day and empty or lightly used at night is:

• At opening: alarm disarmed and any overnight activations noted, exterior walked, doors checked for damage, anything unusual recorded before people arrive.
• Through the day: entrances watched or controlled, visitors signed in, deliveries received, exits checked for obstruction.
• At lock-up: every floor and washroom checked for people, windows and doors locked, rooms secured, lights set, alarm armed, gates closed.
• After hours: patrols by a guard on site or a mobile patrol, at the times the post orders set, often through checkpoints on a guard tour system.
• Weekly: CCTV recordings spot-checked, the key log reconciled, exterior lighting walked after dark.
• Seasonally: before winter, check exterior lighting timers against the shorter days, clear snow and ice away from exit doors and gates, and make sure doors are not freezing open or shut.
• Monthly or quarterly: a fuller inspection of the building against the checklist and the security plan.
• At least yearly, and after any incident or change of use: the security risk assessment reviewed. In Ontario, the workplace violence and harassment policies must also be reviewed "as often as is necessary, but at least annually" (subsection 32.0.1 (1) of the Occupational Health and Safety Act).

Alarm, access control and CCTV systems also need maintenance by a competent contractor at the intervals the installer and the insurer set, including the software updates the manufacturer issues. A daily check that the alarm armed properly is not a substitute for that service, and a security round is not a fire code inspection.

05

Who does it, and what good evidence looks like

Every check on the list should have an owner: a named role. On a guarded building that is usually the guard on shift, with the security supervisor making sure the checklist is followed. In an office, school or warehouse without guards it may be the property manager, the building operator, the superintendent, the custodian who locks up, or the last keyholder out.

Someone doing the lock-up round alone at night is working alone. The Canadian Centre for Occupational Health and Safety's guidance on working alone advises employers to "establish a check-in procedure" and to "check the regulations in your area", because some jurisdictions have specific working-alone rules. The checklist and the check-in schedule should fit together.

A record that shows the checks were done well has the same features in any building:

1. It is completed at the time, at the place, not filled in afterwards from memory.
2. It names the person who did the check.
3. It records exceptions: the loading dock door found open, the parkade light out, the camera pointing at the ceiling, and who was told.
4. Faults are followed up: a broken lock recorded on Monday should not still be recorded on Friday.
5. Gaps are explained: a missed lock-up check with a reason is more credible than a sheet with no gaps.
6. Someone reviews it: a manager who reads the checklist each week spots the repeated problem before it becomes an incident, and checks that the response to past incidents has held.

That accountability matters when something goes wrong. After a break-in, the insurer and the police will ask when the building was last checked, by whom and what was found. A checklist that answers all three questions is worth more than any number of ticks. Keep the records for as long as the contract and the insurer require.

06

Where security checklists fail, and where SiteClara fits

The paper checklist on a clipboard at the security desk is filled in at the end of the shift. Nobody can tell whether the rear exit on P2 was checked at 11 p.m. or ticked at 11 p.m. from the desk. Faults written on the sheet stay on the sheet, and the burnt-out light at the side entrance is still out a week later. The property manager or client responsible for several buildings sees the sheet only if they visit.

SiteClara records the checks where they happen. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint: the main entrance, the loading dock, a parkade level, the electrical room, the roof hatch. Whoever does the round scans the code or taps the tag on their own phone, with no app to install, sees the checks due at that point and marks them done, or explains what stopped them, such as a locked room. The time and the named person are recorded as it happens, with a photo when the check asks for one. A fault found on the round is reported there and goes onto the team's list of jobs until someone closes it, and the supervisor can escalate it to the building's manager to answer.

The supervisor sees what was due, done and missed, and records the reason a check was missed. At the end of the day the supervisor reviews it, adds a note and approves the daily report, which goes to nominated management or client contacts at 8 a.m. the next morning, showing how the scheduled checks went, what was reported and what is still open.

07

Questions people ask

What is a security checklist?

A written list of the checks to make, so the same things are checked the same way each time and the results are recorded. The Canadian Centre for Occupational Health and Safety's guide Effective Workplace Inspections says that "a checklist helps to clarify inspection responsibilities, controls inspection activities and provides a report of inspection activities", and warns against becoming so intent on the list that other hazards are missed: "Use checklists only as a basic tool." A building security checklist applies that to doors, locks, lighting, cameras, alarms and exits.

How can you make a building more secure?

Start with the design of the workplace. The Canadian Centre for Occupational Health and Safety's guidance on violence and harassment in the workplace lists measures including "minimizing the number of entrances to your workplace", "using coded cards or keys to control access to the building or certain areas within the building", "using adequate exterior lighting around the workplace and near entrances", surveillance cameras at entrances and parking lots, and fences placed to control access. Those measures then need checking on a regular round, which is what the checklist is for.

08

Further reading, and a list to take away

Start with the province or territory where the building is: in Ontario, the Occupiers' Liability Act, the Occupational Health and Safety Act (Part III.0.1 on workplace violence), the Fire Code and, where guards are used, the Private Security and Investigative Services Act. Nationally, CCOHS publishes plain-language guidance on working alone and workplace violence, Public Safety Canada publishes its insider risk guide with a security action checklist, and the Privacy Commissioner of Canada publishes guidance on video surveillance. For the guard's side of the work, see security guard duties.

Before you print or revise the checklist, check that:

• it comes from a current security risk assessment for this building;
• every item has a named owner and a set frequency;
• opening, lock-up and after-hours checks are separate;
• exits are checked, kept clear and never locked against people inside;
• keys, fobs, codes and alarm contacts are reconciled regularly, and access is removed when people leave;
• exterior lighting is checked after dark, and again when the days shorten;
• anyone doing the round alone has a check-in schedule;
• cameras have notice signs and a policy for who may view the footage;
• faults found are reported to someone who will fix them, and followed up;
• someone reviews the completed checklist every week;
• the checklist is reviewed after any incident and whenever the building or its use changes.