The PSIRA Code of Conduct: what it requires, and how a client can hold a provider to it

01

What the PSIRA Code of Conduct is, and who it binds

Section 28 of the Private Security Industry Regulation Act 56 of 2001 tells the Minister to prescribe a code of conduct for security service providers and makes it "legally binding on all security service providers, irrespective of whether they are registered with the Authority or not" and, to the extent the Act provides, on anyone who uses their own employees to protect their own property or premises.

The Minister for Safety and Security prescribed the Code of Conduct for Security Service Providers, 2003 in February 2003, and regulation 33 brought it into operation on 1 March 2003, replacing the old code for security officers under the Security Officers Act 92 of 1987. The Private Security Industry Regulatory Authority (PSIRA) publishes it on its website. The Act's definitions say "this Act" includes the code of conduct, so a breach of the Code is a breach of the Act.

The Act defines a security service provider as "a person who renders a security service to another for a remuneration, reward, fee or benefit", registered or not, so the officer on a gate is bound as well as the company that posted them. Regulation 2 of the Code applies it to:

• every security service provider, registered with PSIRA or not;
• every employer of in-house security officers: a shopping centre, hospital, factory or estate that uses its own employees to guard its own property or premises;
• a provider's relevant conduct "at any place, irrespective of whether the conduct was committed within or outside the Republic".

Regulation 1 gives the purpose: to promote "a trustworthy and professional private security industry", minimum standards of conduct, compliance with obligations towards the State, PSIRA, clients and the public, and the payment of minimum wages with standards against the exploitation or abuse of employees in the industry.

02

What the Code covers, chapter by chapter

The Code has 33 regulations in five chapters:

• Chapter 1, purpose and application (regulations 1 to 4), including the definition of a "client", which covers a person a provider is negotiating with, not only one under contract.
• Chapter 2, general obligations (regulations 5 to 9): to obey the law, and duties towards PSIRA, towards the Security Services (the police, the defence force, the intelligence services, correctional services and other law enforcement agencies) and organs of State, towards the public and the industry (regulation 8) and towards clients (regulation 9).
• Chapter 3, particular providers (regulations 10 to 20): employers (regulation 11), directors and managers (regulation 12), management and supervision (regulation 13), providers who make officers available to others (regulation 14), and rules for private investigators, locksmiths, consultants, event security, trainers and security equipment installers.
• Chapter 4, employers of in-house security officers (regulations 21 to 23).
• Chapter 5, improper conduct and enforcement (regulations 24 to 33): what counts as improper conduct, the penalties, the criminal offence and the rules of evidence.

It works alongside the Private Security Industry Regulations, 2002, which cover registration, uniforms and the records a security business must keep, and the Improper Conduct Enquiries Regulations, 2003, which set out how a charge is heard. PSIRA publishes them, with the Act and the Code, in one combined document.

03

What the Code asks of an officer on site

Regulation 8 governs an officer's behaviour on a post. Among other things, a security service provider:

• "must endeavour to prevent crime, effectively protect persons and property" (regulation 8(3));
• may not enter premises, search, seize property, arrest, detain, restrain, interrogate or threaten anyone, or demand information or documents, "unless such conduct is reasonably necessary in the circumstances and is permitted in terms of law" (regulation 8(2)(b));
• may use force only when it, and its nature and extent, are reasonably necessary and permitted by law (regulation 8(4)), and may carry or use a firearm or weapon only lawfully (regulations 8(6) and 8(7));
• may not claim any authority, training, registration or qualification they do not have (regulation 8(5));
• must "always act in an honest and trustworthy manner" (regulation 8(11));
• must treat the public with "respect and courtesy" and may not use abusive or hateful language (regulation 8(12));
• may not use or be under the influence of alcohol or a narcotic drug while on duty (regulation 8(13)).

Two duties in regulation 9 also land on the post: an officer may not disclose confidential information about a client, including about its security, without consent unless the law requires it (regulation 9(12)), and may not use, hand over or keep a client's property without a legal ground (regulation 9(15)).

The officer is not expected to know these limits by instinct. Regulation 11(5)(a) makes the employer take reasonable steps to ensure every officer "has been properly informed about the nature and scope of his or her functions and duties as well as his or her legal powers". On most contracts that lives in the site instructions, and an instruction to search every bag or stop a visitor leaving should be one the officer can lawfully carry out under regulation 8(2)(b).

04

What the Code gives a client

Regulation 9 is the client's part of the Code, and it applies from the first approach. Regulation 9(2) says a provider must give a client "sufficient and correct information" whenever the client reasonably needs it to make an informed decision, including on:

• the risks the client faces, and the service the provider, and any other provider it will use, is "entitled, able and qualified to render";
• the full fee payable;
• "the registration status as security service provider, training level and relevant conditions of service of the security officers used or to be used" (regulation 9(2)(e));
• how the service will be managed, controlled and supervised, with "reasonable contact particulars" of the supervisors (regulation 9(2)(f));
• any subcontractor and how it will be supervised, and any matter the client "lawfully and reasonably requests".

Regulation 9(3) limits what a provider may offer and sign. It may not contract for a service needing training, registration, officers, equipment or capacity it does not have; may not submit a tender with materially false or misleading information; and may not put in a contract a term excluding its liability for "any malicious, intentional, fraudulent, reckless or grossly negligent act" of its officers, or waiving any right under the Act or the Code. Once the contract is agreed, the provider must:

• put the full agreement in writing, signed, and give the client a true copy "without undue delay" (regulation 9(4));
• render the service as contracted, "with such a degree of skill, diligence and care as may be expected of a reasonable, competent and qualified security service provider" (regulation 9(5));
• give a written account on request (regulation 9(6));
• use only people who are registered and trained as the law requires for the service (regulation 9(10)(a); see PSIRA grades);
• not use another security service provider unless the client has consented and that provider is registered and able to do the work (regulation 9(10)(b)).

A client does not have to wait for a dispute to use these rules. Asking, before signing, for the registration and training level of the officers, the supervision arrangements and any subcontractor is asking for what regulation 9(2) already requires.

05

The company's duties as employer, and how PSIRA enforces the Code

Regulation 11 turns to the security company as employer. It must pay the full wages and benefits due (regulation 11(1)(b)); before employing a security officer, "take all reasonable steps to verify the registration status as security service provider, level of training, qualifications" (regulation 11(2)); never use an officer for a service they are not trained or registered for (regulation 11(3)); and ensure each officer "is properly managed, controlled and supervised" (regulation 11(5)(b)). It must also train every officer on the law regulating the industry and the Code "at least once a year" (regulation 11(7)), and draw up and "properly and consistently enforce" a disciplinary code (regulation 11(8)).

Regulation 13(2) requires systems of management, control and supervision "reasonably necessary in view of the nature and size of the security business", to ensure "effective control over the rendering of security services". An employer of in-house security officers may use only registered, trained employees and must appoint "a responsible person to manage, supervise and control" them (regulation 23).

PSIRA checks compliance with the Code through inspection and enforces it through prosecution. Sections 33 and 34 of the Act let an inspector inspect the affairs of a security service provider or anyone who employs a security officer, and enter the premises used for the service "without prior notice". PSIRA's Law Enforcement and Legal division lists inspections, investigations and "Code of Conduct prosecution" among its functions. Regulation 10 of the 2002 Regulations requires a security business to keep records, including an attendance register, a daily posting sheet and a personnel file on each officer, for at least four years.

Under regulation 24, a contravention of the Act or the Code is improper conduct, each contravention a separate count, heard at an enquiry and proved "on a balance of probabilities" (regulation 30(3)). The penalties are:

• for a security service provider (regulation 25): a warning or reprimand, suspension of registration for up to six months, withdrawal of registration, a fine of up to R10 000, publication of the conviction, or any combination;
• for an employer of in-house security officers (regulation 27): a warning or reprimand, a fine of up to R10 000, publication, or any combination.

Improper conduct is also a criminal offence, punishable by a fine or imprisonment of up to 24 months, or both (regulation 28). Section 30 of the Act allows an appeal to an appeal committee within 60 days of being notified of a finding.

06

Where the record fails, and where SiteClara fits

Much of the Code asks for control that can be shown: officers "properly managed, controlled and supervised", "effective control over the rendering of security services", a service delivered with the care the contract promised. When a client queries a break-in, or an inspector asks how a site is supervised, the answer is often an occurrence book reading "all correct" every hour in one hand, and a supervisor's visit noted after the event. Regulation 30(8) says a document an inspector finds at the business's premises is proof of the information in it where the prosecutor relies on it, unless evidence to the contrary raises a reasonable doubt. A record written after the fact is still the business's own evidence.

SiteClara records the checks a post exists to do, at the place they are done. A printed QR poster, with an optional NFC tag behind it, sits at each checkpoint: the main gate, a fire escape, the perimeter fence, the generator room. The officer scans or taps with their own phone, with no app to install, and marks the scheduled check done or says what stopped them. The time and the named officer are recorded as it happens, with a photo when one is asked for, and a fault reported there goes onto the team's list of open jobs until someone closes it.

The security supervisor sees what is due, done and missed, and gives the reason a check was missed. Each day they review the totals and photos, add a note and approve a report that goes to nominated client or management contacts at 08:00 the next morning. That gives the provider something to show when it describes its supervision, and the client a way to see whether the patrols it pays for were walked.

07

Questions people ask

Where can I find a PDF copy of the PSIRA Code of Conduct?

PSIRA publishes the Code of Conduct for Security Service Providers, 2003 as a PDF on its website, and again in its combined Act, Regulations and Code of Conduct document. Its consumer awareness page links to the full Code too.

What are the 12 principles of the Code of Conduct for security officers?

The Code of Conduct for Security Service Providers, 2003 has no list of twelve principles; it is 33 numbered regulations. The nearest thing to a statement of principle is regulation 8(1), which says a security service provider must at all times act in a manner which does not threaten or harm the public or national interest, and which promotes the stability of the industry, good discipline, the status of the occupation, and efficiency and responsibility in rendering security services.

What are the rules and regulations of PSIRA?

The main ones are the Private Security Industry Regulation Act 56 of 2001, the Private Security Industry Regulations, 2002, the Code of Conduct for Security Service Providers, 2003 and the Improper Conduct Enquiries Regulations, 2003. Section 44(2)(c) of the Act also keeps regulations made under the repealed Security Officers Act, 1987 in force to the extent they are compatible with it, until they are replaced.

What happens if a security company breaks the Code of Conduct?

Under regulation 24 of the Code of Conduct for Security Service Providers, 2003, a breach is improper conduct. After an enquiry, the penalties under regulation 25 range from a warning or reprimand to a fine of up to R10 000 and suspension of registration for up to six months or its withdrawal. Regulation 28 also makes improper conduct a criminal offence, carrying a fine or imprisonment of up to 24 months, or both.

How do I complain to PSIRA about a security company?

PSIRA's consumer awareness page says a complaint can be made in person at any PSIRA office, in writing to complaints@psira.co.za, or through the PSIRA app, and that a contravention of the Code can be reported to the same address. It lists a separate fraud and ethics hotline, 0860 333 036, for corruption, fraud, theft, misconduct or unethical behaviour.

08

Where to read the Code, and a list to take away

The Private Security Industry Regulation Act 56 of 2001 is on gov.za. PSIRA publishes the Code of Conduct for Security Service Providers, 2003 on its own and in its combined Act, Regulations and Code of Conduct document. Its consumer awareness page lists what a client should check and how to complain; checking PSIRA registration covers verifying officers and businesses.

Before you sign or renew a security contract, check that:

• the full agreement is in writing, signed, and you hold a copy (regulation 9(4));
• you have been told the registration status and training level of the officers (regulation 9(2)(e));
• the supervision arrangements and supervisors' contact details are written down (regulation 9(2)(f));
• any subcontractor is named and needs your consent (regulation 9(10)(b));
• no clause excludes liability for malicious, fraudulent, reckless or grossly negligent acts (regulation 9(3)(d));
• the site instructions tell officers their duties and powers, and ask nothing the law does not allow;
• officers are trained on the Code at least once a year (regulation 11(7));
• you will see records of patrols and supervision visits, not only a monthly invoice.