Site security checklist: what to check, how often, and how to show it was done

01

Why a site needs a security checklist in Ireland

No Irish statute says, in so many words, that a site must keep a security checklist. The duties behind one come from several Acts and regulations, and a checklist completed at the time is the ordinary way of showing, day to day, that those duties are being met.

• Health and safety. Section 12 of the Safety, Health and Welfare at Work Act 2005 requires every employer to manage and conduct the undertaking so as to ensure, so far as is reasonably practicable, that individuals at the place of work who are not its employees are not exposed to risks to their safety, health or welfare. Visitors, customers, other contractors and members of the public all fall inside that duty. Section 19 requires a written risk assessment, and section 20 a safety statement based on it; the risks of working alone at night, of confronting an intruder and of patrolling an unlit yard belong there.
• Building sites. The Safety, Health and Welfare at Work (Construction) Regulations 2013 (S.I. No. 291 of 2013) require the contractor responsible for a construction site to ensure that its surroundings and perimeter are clearly visible and identifiable with appropriate signboards, and that appropriate precautions are taken to protect people at or near the site, "for example, by the provision of appropriate barriers, where necessary, to prevent unauthorised entry" (Regulation 30). Where more than one contractor is engaged, Regulation 17 requires the project supervisor for the construction stage (PSCS) to "coordinate measures to permit authorised persons only on to the construction site and monitor such coordination".
• Occupiers' liability. The Occupiers' Liability Act 1995 sets the duty an occupier owes to people who come onto premises. A visitor is owed "the common duty of care"; a trespasser or recreational user is owed a lower duty, not to injure them intentionally and not to act with reckless disregard for them, judged partly on whether the occupier knew of, or was reckless as to, the danger and the likelihood that people would be near it. The Act was amended by Part 6 of the Courts and Civil Law (Miscellaneous Provisions) Act 2023: the question is now whether the occupier knew of, or was reckless as to whether, a danger existed and people were likely to be near it, and a new section 5A deals with risks a visitor willingly accepts. The Law Reform Commission's revised Occupiers' Liability Act 1995 shows the text as amended.
• Fire safety. Section 18 of the Fire Services Act 1981, as amended by section 29 of the Licensing of Indoor Events Act 2003, requires every person having control over premises to which it applies, which now include any workplace, to take all reasonable measures to guard against the outbreak of fire, to provide fire safety measures and procedures, and to ensure they are applied at all times. For a workplace, Regulation 12 of the General Application Regulations 2007 (S.I. No. 299 of 2007) requires that emergency doors and gates are "not so locked or fastened that they cannot be easily and immediately opened by any person who may need to use them in an emergency". A security measure that chains a fire exit is a breach, not a precaution.
• Private security. The Private Security Services Act 2004 set up the Private Security Authority (PSA); Part 4 of the Civil Law (Miscellaneous Provisions) Act 2011 later amended it. Section 38 makes it an offence to employ a person, or engage a contractor, to provide a security service that requires a licence the provider does not hold. A client that buys in static guarding, alarm or CCTV monitoring, or the installation of alarms, CCTV or access control should check the licence first; the PSA's Who Needs A Licence (Contractors) page lists the sectors.
• CCTV and data protection. Footage of identifiable people is personal data. The Data Protection Commission's Guidance on the Use of CCTV for Data Controllers (last updated November 2023) sets out what an owner or occupier using CCTV must consider, from its purpose and legal basis to signs and retention.

In practice the insurer, whose cover may depend on an alarm, keyholders or patrols, and the client, landlord or owners' management company, whose contract sets what the security provider or caretaker checks, often matter as much as any statute.

02

What a site security checklist should cover

The checklist should come out of a security risk assessment: what could be stolen, damaged or misused, who might try, and what would follow if they did. A city-centre office, a retail park unit, a school out of term and a housing development on the edge of a town face different threats, and the list should show it. A good checklist then covers the physical measures that answer those risks:

• Perimeter: hoarding, palisade fencing, gates, barriers and every other access point intact, with no gaps, loose panels or anything stacked against them that could be climbed; signage in place.
• Access control: gates and doors locked or staffed; card readers, fob readers and door entry working; the visitor and contractor sign-in in use; nobody on site who should not be.
• Locks and keys: padlocks, roller shutters and doors secure; keys and fobs accounted for against the key register; codes changed when someone leaves.
• Lighting: external, car park and yard lighting working, with no dark corners at entrances, bin stores or storage areas.
• CCTV: cameras on, clean and pointing where they should; recording working; the date and time correct; CCTV signs displayed at the entrances.
• Intruder alarm: set when the building is empty; detectors not blocked by stacked stock; faults and activations noted; keyholder and monitoring centre details current.
• Secure storage: tools and equipment locked away; high-value materials, copper and fuel in secure storage; plant immobilised and keys removed.
• Hazardous substances: fuel, gas cylinders and chemicals stored securely, away from the boundary and from anyone who might misuse them.
• Fire safety: escape routes clear, fire exits unobstructed and never locked while anyone is inside, extinguishers in place, no pallets, skips or rubbish piled against the building or the hoarding.
• Sensitive areas: comms rooms, plant rooms, roof access, riser cupboards and stores locked and entered only by authorised people.
• Signs of trouble: forced doors, broken glass, graffiti, damage to fencing, or anything that suggests someone has been in.
• Emergency contacts: keyholders, monitoring centre, Garda station and facilities manager current.

Keep it to what one person can check properly on the round, and word each line as something they can see or test at that spot: "rear gate padlocked", not "site secure". A list of forty items walked in ten minutes gets ticked, not checked.

03

Security on a building site

Construction sites change every week: temporary hoarding moves, scaffolding goes up, new plant arrives, and valuable materials are often delivered just before they are fitted. A building site's checklist is reviewed more often, and usually adds:

• Scaffolding and ladders: ladders removed or boarded at the end of the day so nobody can climb.
• Excavations and openings: covered or fenced, particularly where children could reach them.
• Plant and vehicles: parked inside the compound, immobilised, with keys held securely.
• Deliveries: checked in, stored securely and never left unattended at the gate overnight.
• Site cabins and welfare units: locked, with no tools, keys or drawings left in view.
• Security cover: static guard hours, mobile patrol visits and the out-of-hours contact, where the site has them.

Who owns the list follows the 2013 Regulations. The contractor responsible for the site carries the Regulation 30 duties on the perimeter, signs and barriers; on a project with more than one contractor, the PSCS coordinates the measures that keep unauthorised people off site and monitors them. In practice the PSCS's site manager holds the checklist and the security contractor, where there is one, works to it.

04

How often each check is due

There is no statutory frequency for most security checks. The right interval follows the risk assessment, the insurer's conditions and how the site is used. A common pattern for a building that is occupied during the day and empty at night is:

• At opening: alarm unset and any overnight activations noted, perimeter walked, doors and gates checked for damage, anything unusual recorded before people arrive.
• Through the day: entrances watched, visitors and contractors signed in, deliveries received, fire exits checked for obstruction.
• At locking up: every floor and room checked for people, windows and doors locked, equipment secured, lights set, alarm set, gates locked.
• Out of hours: patrols by a static guard on site or a mobile patrol, at the times the client's instructions set.
• Weekly: CCTV recording and the time stamp checked, key register reconciled, external lighting walked after dark.
• Monthly or quarterly: a fuller inspection of the security measures against the checklist, walked with the client or facilities manager.
• At least yearly, and after any incident or change of use: the security risk assessment reviewed; section 19(3) of the 2005 Act separately requires the health and safety risk assessment to be reviewed after a significant change.

Alarm, access control and CCTV systems also need maintenance by a competent installer, at the intervals the installer and the insurer set; installers of each are among the sectors the PSA licenses, as its page Who Needs A Licence (Contractors) lists. A nightly check that the alarm set is not a substitute for that service.

On CCTV retention, the DPC's guidance says the law sets no fixed period and that for a normal security system "it would be difficult to justify retention beyond one month", unless the images identify an issue such as a break-in and are kept for its investigation. The weekly check is a good moment to confirm the recorder's default retention matches your policy.

05

Who does it, and what good evidence looks like

Every check on the list should have an owner: a named role, not "security" or "the team". On a guarded site that is usually the security officer on shift, with the security supervisor checking the list is being followed. In an office, school or apartment block without guards it may be the site manager, the caretaker, the last keyholder out or the facilities team. A security officer employed by a contractor to guard property must hold a PSA licence and, as the PSA's Identity Badge Requirements page puts it, wear an identity badge "at all times while providing a security service"; the PSA's Security Guard (Guarding) page explains who needs one.

Out-of-hours security is often lone work. The HSA's page on Lone Workers lists security among the jobs done outside normal hours and says the section 19 risk assessment decides whether a person may work alone. The checklist should never ask a lone guard or caretaker to do what that assessment rules out.

A record that shows the checks were done well has the same features on any site:

1. It is completed at the time, at the place, not filled in afterwards from memory.
2. It names the person who did the check.
3. It records exceptions: the gate found open, the light out, the camera pointing at the sky, and who was told.
4. Faults are followed up: a broken lock noted on Monday should not still be noted on Friday.
5. Gaps are explained: a missed locking-up check with a reason is more credible than a sheet with no gaps.
6. Someone reviews it: a manager who reads the completed checklist each week spots the repeated problem before it becomes an incident.

That matters when something goes wrong. After a break-in, the insurer and the Gardaí will ask when the site was last checked, by whom, and what was found. Incidents themselves belong in the occurrence book or incident report the contract requires, with the checklist showing the routine around them.

06

Where security checklists fail, and where SiteClara fits

The paper checklist in the security hut is usually filled in at the end of the shift. Nobody can tell whether the rear gate was checked at 18:00 or ticked at 18:00 from the cabin. Faults written on the sheet stay on the sheet. And the client, the managing agent or the manager responsible for several sites sees it only if they call out.

SiteClara records the checks where they happen. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint: the main gate, the compound, the plant room, the fire exits, the roof door. Whoever does the round scans the code or taps the tag on their own phone, with no app to install, and marks the scheduled check done or explains what stopped them. The time and the named person are recorded as it happens, with a photo where one is asked for. A fault found on the round goes onto the team's list of jobs until someone closes it, and the supervisor can escalate it to the building manager.

The supervisor sees what was due, done and missed, and records the reason a check was missed. Each day's report is reviewed and approved by the supervisor and goes to nominated management or client contacts the next morning, with what was reported, what is still open and how the scheduled checks went.

07

Questions people ask

What are the security requirements for a construction site?

In Ireland they come mainly from the Safety, Health and Welfare at Work (Construction) Regulations 2013. Regulation 30 requires the contractor responsible for a site to ensure that "the surroundings and the perimeter are laid out so as to be clearly visible and identifiable and have appropriate signboards", that safe means of access and egress are provided and maintained, and that appropriate precautions are taken to protect people at or near the site from its risks, "for example, by the provision of appropriate barriers, where necessary, to prevent unauthorised entry". Where there is more than one contractor, Regulation 17 requires the PSCS to "coordinate measures to permit authorised persons only on to the construction site and monitor such coordination".

What are the key items to include in a construction site security checklist?

The perimeter, signboards and barriers that Regulation 30 of the Construction Regulations 2013 requires, the gates and access points, plant, fuel and materials, and the site's escape routes, because security must never block them. Regulation 31 requires emergency routes and exits to be "free from obstruction so that they can be used at any time without hindrance", with emergency lighting where they need it, and Regulation 32 says that, for indoor workstations on a site, emergency doors must not be "so locked or fastened that they cannot be easily and immediately opened" by any person at work who may need them in an emergency. The rest comes from the site's own risk assessment.

How do you create a site security checklist?

Start from the risk assessment. Section 19 of the Safety, Health and Welfare at Work Act 2005 requires every employer to "identify the hazards in the place of work under his or her control, assess the risks presented by those hazards" and hold a written risk assessment, and to review it where "there has been a significant change". Turn each security risk it finds into a line someone can check at a named spot, give it an owner and a frequency, and revise the list when the assessment changes. An Garda Síochána's Crime Prevention page says its Crime Prevention Officers carry out "risk assessments and security evaluations for residential properties, businesses, and public institutions", which can help with the first draft.

08

Further reading, and a list to take away

The Health and Safety Authority (hsa.ie) publishes guidance on risk assessment, safety statements, lone working and construction. The Private Security Authority lists the licensed sectors, the standards each must meet (see Standards Required For Licensing) and registers of licence holders. The DPC's CCTV guidance covers signs, retention and access requests. An Garda Síochána's Crime Prevention pages describe the local Crime Prevention Officers who carry out security assessments for businesses.

Before you print or revise the checklist, check that:

• it comes from a current security risk assessment, and the risks to your own staff are in the safety statement;
• every item has a named owner and a set frequency;
• opening, locking-up and out-of-hours checks are separate lists;
• fire exits and escape routes are checked, and never locked while people are inside;
• on a building site, the perimeter, signs and barriers match the current layout;
• any security contractor, alarm company or CCTV installer holds a current PSA licence;
• CCTV signs are up and the recorder's retention matches your policy;
• keys, codes and alarm contacts are reconciled at regular intervals;
• faults found are reported to someone who will fix them, and followed up;
• someone reviews the completed checklist every week, and the list itself after any incident.