A completed checklist can show that a task was done. It cannot show whether people will make good decisions when conditions change. That is the central issue in compliance versus capability. One proves that an organisation has met a stated requirement. The other determines whether its people can recognise risk, act early and manage the consequences when the plan no longer fits the situation.

For protective security, counter terrorism preparedness and crisis management, the distinction matters. A venue may hold current policies, training records, evacuation plans and contractor certificates. Yet a supervisor may still hesitate over an emerging concern, a control room operator may fail to pass on useful information, or a team may not know who has authority to make a difficult call. The paperwork is in order. The operational position is not.

Compliance has a place, but it is not the finish line

Compliance exists for good reasons. It establishes minimum expectations, creates accountability and gives organisations a common framework for managing duties. In the United Kingdom, organisations preparing for Martyn’s Law will need to understand relevant requirements, record their arrangements and demonstrate that proportionate measures are in place.

That work is necessary. It is also limited.

A policy does not assess a situation. A risk assessment does not brief a new member of staff who has arrived during a busy shift. An eLearning completion record does not tell a duty manager whether a person understands the difference between unusual behaviour and harmless inconvenience. These documents support good practice only when competent people use them as intended.

The uncomfortable reality is that compliance can create false assurance. Senior leaders see evidence that actions have been completed and reasonably assume the risk has been addressed. Meanwhile, the people expected to act may have received generic training, little practice and no meaningful assessment of their judgement. The gap often remains hidden until an incident, inspection or serious near miss exposes it.

Capability is performance under real conditions

Capability is not simply knowledge. It is the ability to apply knowledge reliably in the environment where the work happens. It includes situational awareness, communication, decision making, confidence, leadership and the discipline to escalate concerns when doing so is inconvenient.

A capable security team understands its site, its people and its operating pressures. It knows which risks are plausible, where normal routines create blind spots and how to use available controls without disrupting the organisation unnecessarily. More importantly, it can adapt when circumstances are unclear.

Consider two reception teams. Both have received a security briefing and both know visitor procedures. One team follows the process only when the reception area is quiet and the visitor is straightforward. The other can manage a delivery delay, an unexpected contractor, a queue of guests and a report of concerning behaviour without losing control of the basics. The latter has capability because its members can prioritise, communicate and make proportionate decisions under pressure.

That capability is built, not declared. It develops through relevant learning, realistic discussion, clear roles, constructive challenge and repeated opportunities to practise judgement. It also requires managers who understand what good performance looks like and who are willing to address weak performance before it becomes a problem.

Why compliance-driven training often falls short

Training is frequently treated as an administrative exercise. Staff complete a module, pass a short knowledge check and are marked as trained. This may satisfy a record-keeping need, but it rarely tests whether someone can apply the learning in a demanding operational setting.

The problem is not eLearning itself. Well-designed digital learning can provide consistent foundations, expose gaps quickly and give people a useful base before practical discussion or assessment. The problem is believing that completion equals competence.

A counter terrorism awareness module may explain the importance of reporting suspicious behaviour. It cannot, by itself, establish whether staff can identify meaningful indicators, avoid assumptions, record information accurately or communicate a concern to the right person. Those are applied skills. They need context, feedback and evaluation.

The same is true of plans and exercises. A tabletop session can be valuable, but only if it tests decisions rather than invites people to recite the policy. When an exercise is too predictable, teams learn how to perform for the exercise rather than how to respond to uncertainty. Real incidents are rarely tidy. Information is incomplete, people disagree and operational pressures continue while decisions are being made.

The hidden cost of paper assurance

Poor capability is expensive long before a major incident occurs. It appears as slow escalation, confused handovers, inconsistent standards, unnecessary disruption and a reliance on one experienced individual who holds the operation together. It can also damage staff confidence. People who do not understand their authority will either avoid action or overreact.

For leaders, this creates a particular risk. They may invest in physical measures, procedures and external assurance while overlooking the human system that makes those measures effective. Cameras, access control and reporting processes all depend on people noticing, interpreting and acting appropriately.

This is why security design cannot be separated from behaviour. If a control is difficult to use during peak periods, it will be bypassed. If reporting feels bureaucratic or punitive, concerns will stay unreported. If roles are vague, critical time will be lost deciding who should act. A technically sound solution that people cannot operate reliably is not a complete solution.

Moving from compliance to capability

The practical question is not whether an organisation is compliant or capable. It needs both. Compliance sets the baseline. Capability makes that baseline work when normal conditions fail.

Start by examining the roles that carry real responsibility. Ask what decisions people must make, what information they need, who they must communicate with and where hesitation would create consequences. This is more useful than asking only whether training has been completed.

Then test understanding in context. A security manager should be able to explain how site procedures work during a busy event, not merely point to the current version of the plan. A team leader should be able to describe how they would manage a concern while maintaining public safety, business continuity and accurate reporting. The answers reveal far more than a certificate.

Assessment should be developmental, not theatrical. The aim is not to catch people out. It is to identify where knowledge is thin, confidence is misplaced or decision making is inconsistent. Immediate feedback is particularly valuable because it turns an assessment into a learning opportunity. It helps practitioners understand not only that an answer was weak, but why the judgement behind it needs improvement.

Organisations should also look at the quality of their debriefs. After an exercise, incident or near miss, ask what actually happened rather than what the procedure says should have happened. Were concerns raised promptly? Did people understand their roles? Did supervisors create clarity or add confusion? Were decisions proportionate to the information available at the time? Honest answers can be uncomfortable, but they provide the evidence needed to improve.

Leadership decides whether capability survives

Capability can be lost quickly when leaders reward appearance over performance. If staff are criticised for raising reasonable concerns, they will learn to keep quiet. If managers treat exercises as a distraction from operations, teams will not take them seriously. If only paperwork is measured, paperwork will become the priority.

Good leaders set a different expectation. They make time for relevant practice, ask practical questions and accept that a capable team will sometimes challenge assumptions. They also distinguish between an honest mistake made under pressure and repeated poor judgement that has not been addressed. Both need attention, but not the same response.

This matters for individual practitioners as well. Career development is not just collecting qualifications. It is building the ability to think clearly, communicate credibly and make sound decisions when there is no perfect answer. A qualification may open a door. Demonstrable judgement is what earns trust once you are through it.

Measure what people can do

A useful assurance process should provide evidence of capability, not just activity. That may include scenario-based evaluation, observation during exercises, role-specific discussions, reviews of decision making and structured feedback from supervisors. The method depends on the role and the risk, but the principle remains constant: assess performance that resembles the work.

There is no value in making every assessment complicated. For some roles, a short, well-designed capability diagnostic will identify the areas that need development. For others, particularly those with leadership or specialist security responsibilities, deeper evaluation is justified. The assessment should be proportionate, relevant and followed by a clear route to improvement.

The strongest organisations do not wait for an incident to discover whether their arrangements work. They use compliance to establish control, then keep asking the harder question: when people face uncertainty, pressure and competing priorities, can they still do the right thing?

That question is worth asking before someone else asks it for you.