After a business break-in, start by finding out how the intruder gained access, what happened next and which protective measures failed before buying more equipment. A stronger door will not fix an alarm that nobody responds to. Another camera will not resolve uncertainty about who closes the premises.
The aim is to reduce the opportunity for another burglary and limit the damage if one occurs. This approach suits an ordinary commercial premises. A high-risk facility, a specific threat against a person or a site holding dangerous materials needs a more specialised assessment.
Make the site safe before investigating the controls
If an intruder may still be present, keep people away and contact emergency services. Do not send a staff member inside to check. Once the immediate situation is under control, follow police directions about preserving the scene and arrange safe temporary protection with the people responsible for the building.
Separate urgent repairs from your longer-term security decision. A temporary repair may allow the business to operate while still leaving a weakness that needs attention. Record what the repair does, what it does not do, who will check it and when the permanent decision is due.
Keep the incident record factual. Record what staff observed, the available alarm and access records, and any information provided by police. Mark assumptions as assumptions. Avoid circulating photographs of vulnerabilities more widely than necessary.
Reconstruct the business break-in
Walk through the incident as a sequence: approach, attempted entry, entry, movement, access to property, detection and response. You do not need a precise reconstruction of every minute to identify an important failure. You do need to distinguish evidence from a plausible explanation.
For each stage, ask what was supposed to happen. Then ask what evidence shows whether it happened. For example, an alarm log might show a signal reached the monitoring service. It does not, by itself, establish that the correct person received and acted on the notification.
Check whether the incident occurred under normal conditions. A delivery, building works, a holiday closure or a temporary change of staff may have altered the controls. If the explanation is “the usual person was away”, the assessment needs to consider how the arrangement works during ordinary absences.
Queensland Police business-security guidance recommends assessing protection in layers and targeting improvements to the circumstances of the business. That provides a useful starting principle: choose the layer that addresses the observed problem rather than buying the most visible device.
Turn findings into decisions
The following fictional example concerns a small equipment-repair business. The observations and actions are illustrative, not a diagnosis of a real property.
| Finding | What it means for the decision | Proposed action and check |
|---|---|---|
| A damaged external door was repaired temporarily, but no permanent repair was assigned. | The business is relying on an arrangement nobody has accepted for continued use. | Facilities obtains a suitable repair specification and records the inspection needed before closure. |
| The alarm signalled, but the first contact number was no longer current. | Detection did not reliably lead to a response. | The manager confirms authorised contacts and arranges a coordinated notification test with the provider. |
| Portable equipment was routinely left outside its designated storage area. | Normal work had drifted away from the storage arrangement. | Staff review the end-of-day workflow and test whether the agreed storage process is practical. |
| Staff could not identify who had completed the closing check. | The business cannot verify whether the check happened. | The shift supervisor assigns one closing owner and checks a sample of completed records. |
These findings point to several kinds of action. One needs a physical repair. Another needs contact management. A third needs a workable routine. Treating all of them as a need for more hardware would miss much of the problem.
Decide what matters most
Prioritise an exposed access point or a failed essential response arrangement before a cosmetic improvement. Consider the potential harm to people as well as stolen property, lost trading time, replacement lead times and information held on equipment.
Do not rank actions solely by the cost of the last incident. That incident may have been less serious than another credible outcome. Equally, do not assume the worst imaginable outcome is the expected one. Write down the scenario you are addressing and why it is plausible at this premises.
A useful risk statement for the fictional business is: “Unauthorised entry outside operating hours could allow theft of customer equipment, interrupt repairs and expose information stored on devices, particularly while the temporary door repair remains in use.”
This statement helps distinguish preventive actions from measures that limit consequences. Repairing the access point addresses entry. Controlling overnight storage reduces what can be reached. Current asset records help establish what is missing. A tested response arrangement makes an alarm more useful.
Check that the proposed improvement can work
Before accepting a quotation, describe the result you need. Include the conditions under which it must work, the person responsible for operating it and the evidence you will accept at handover. Ask a suitable specialist to turn those needs into a specification where technical design is required.
Keep fire safety, safe exit, accessibility and legitimate business use in the decision. Staff should not have to choose between using an unsafe arrangement and bypassing the security measure. Coordinate proposed changes with the relevant building and safety specialists.
For an alarm, agree what is detected, who receives the signal and how an authorised responder is contacted. Queensland Police explains that alarm arrangements include choices about monitoring and response. Do not assume an installed alarm comes with police monitoring or a guaranteed attendance time.
Use coordinated tests with the provider. Avoid surprise activations, sending staff towards a suspected intruder or disabling other protections for convenience.
Close the action only after checking the result
“Installed” and “working as required” are different findings. Record who inspected the repair, whether the contact test succeeded and whether staff can complete the closing routine during normal work. Keep failed tests open until the problem is corrected or the responsible manager makes a documented interim decision.
Review the arrangements after a significant change: new opening hours, a different tenant, a revised layout or a new security provider. The review need not repeat the entire assessment if the change is narrow, but it must check the affected controls and their dependencies.
Keep the review within a clear assessment scope and carry the agreed changes into an actionable treatment plan.
Your next action is to take one finding from the incident and write its owner, interim measure, permanent action and acceptance check. Expand from that entry until every material weakness has an accountable decision.
For a structured place to record those decisions, use the SRMBOK Physical Security Risk Assessment Tool. This paid Excel workbook includes a fictional site example and fields for risks, controls, treatments and review dates. Replace the example conditions and ratings with evidence about your own business.