Assess security contractor performance against agreed service outcomes and evidence within the provider's reasonable influence. Separate provider failures from problems in your own instructions, systems or decisions. Start with one important service promise and work out what successful delivery would look like.
Counting patrols or completed forms may show that work occurred. It does not establish that the work achieved its purpose. Equally, an incident does not by itself prove that a contractor failed: the agreed control may have operated while a different weakness contributed to the loss.
This approach is for clients reviewing an existing service. Commercial remedies, employment matters and legal compliance need the relevant authorised people. A performance review should produce supported findings and practical corrections, rather than surprise penalties based on a new interpretation of the contract.
Agree the requirement before scoring it
Find the relevant contract, service specification and current instructions. Identify the required outcome, operating conditions, responsibilities and evidence. Where they conflict, resolve the difference before judging a person against it.
For example, “respond promptly” leaves too much room for disagreement. A usable requirement defines the relevant action, the event that starts it, the agreed timing where applicable and the circumstances affecting delivery. Do not invent a universal response time for every site.
Ask the contractor to explain how they deliver the service. This may reveal a gap between what the client believes it purchased and what the provider has resourced.
Record any revised requirement prospectively. Historical evidence can reveal a need to improve the service, but it should not be presented as proof that an unagreed requirement was breached. Keep contractual non-performance and a newly identified improvement opportunity as separate findings.
Choose evidence close to the outcome
Use several evidence types where the consequence warrants it. Records show what was documented; interviews explain decisions; authorised observation or exercises show how a task operates under defined conditions.
NIST SP 800-53A Revision 5 describes examine, interview and test as assessment methods in its information-system context. The useful general principle here is to select evidence that can support the claim, not to treat that publication as a certification scheme for a guarding contract.
For visitor control, useful evidence might connect the booking, host decision, permitted access and exception handling. A monthly total of visitors processed cannot establish whether unauthorised exceptions occurred.
For fault response, follow selected faults from report to diagnosis, interim action and verified correction. A closed ticket is one record; it is not necessarily proof that the control now works.
Sample deliberately and state the limits
Include conditions likely to affect delivery: relief staff, different shifts, busy periods and changes in site operation. Do not choose only the easiest records or the most experienced officer.
State how the sample was selected and what it can show. A small targeted review can identify a meaningful problem without estimating its frequency across every shift. Avoid percentages that imply a representative statistical sample when none was designed.
Discuss exceptions with the provider before finalising findings. Missing evidence may reflect a recording gap, an unavailable record or a failure to perform the task. Those possibilities require different corrections.
Where immediate exposure is material, agree interim protection while the facts are resolved. Fair assessment does not require ignoring a current weakness.
Worked example: access exceptions
A fictional client reviews a contractor's after-hours visitor process. The agreed requirement is that exceptions receive approval from the client's duty manager before access. A targeted review produces these observations.
| Observation | Supported finding | Corrective owner |
|---|---|---|
| Three sampled exceptions have approval and access records | These cases support operation of the agreed process | No correction for those cases |
| One record names an approver but does not identify the decision | Approval cannot be verified from the available record | Provider checks the case and improves the record if needed |
| Duty-manager contact failed during an agreed exercise | Client's approval route was unavailable in that condition | Client repairs the rota or fallback authority |
| Relief officer used an obsolete instruction | Document distribution did not reliably reach the relief arrangement | Client and provider resolve issue and receipt responsibilities |
The review does not turn four observations into a claim about the entire service. It identifies what the evidence supports and allocates corrections to the parties able to make them.
Avoid measures that reward the wrong behaviour
A target to reduce incident reports may encourage under-reporting. Asking for more patrols may encourage quick rounds that miss the intended checks. Requiring every ticket to close may reward administrative closure before verification.
Pair activity measures with quality evidence. If patrol completion matters, inspect whether relevant observations were recorded and acted on. If timeliness matters, distinguish acknowledgement, attendance and restoration; they are different events.
Consider workload and client changes. A new tenant, expanded opening hours or increased deliveries may alter the service demand. Record the change and decide whether the existing staffing and instructions remain suitable.
Do not excuse a supported failure merely because the provider is busy. Identify whether the correction belongs in supervision, training, resources, client decisions or the service specification.
Turn the review into an agreed improvement record
For each finding, include the requirement, evidence, uncertainty, effect, owner and completion criterion. Give the provider a chance to correct factual errors while retaining the client's responsibility for the final judgement.
Separate immediate fixes from systemic improvements. Rebriefing one officer may address today's gap; fixing how relief staff receive current instructions addresses the recurring cause.
Arrange a proportionate retest. Confirm that the changed process works under the condition that previously exposed the weakness. Keep unresolved client actions visible alongside contractor actions.
Keep service deficiencies connected to an actionable risk register and assign corrections through a treatment schedule.
Your next action
Choose one important service outcome and trace a few relevant cases with the contractor. Agree the evidence and assessment limits before assigning a rating.
The paid SRMBOK Risk Control Effectiveness Criteria provides editable criteria for recording an evidence-based judgement. Adapt the criteria to the agreed service and keep unsupported or unknown performance distinct from demonstrated effectiveness.