A security diagnostic review should answer a harder question than whether an organisation has policies, training records and security equipment. It should establish whether people can recognise a developing problem, make sound decisions and act effectively when time, information and confidence are limited.

Many organisations discover too late that their security arrangements looked stronger on paper than they were in practice. A procedure may be current, a risk assessment may be signed off and staff may have completed training. None of that guarantees a supervisor will challenge unusual behaviour, a control room operator will escalate concerns correctly, or a senior manager will make a proportionate decision during a fast-moving incident.

That gap between documented assurance and operational capability is where real risk sits.

What a security diagnostic review should examine

A useful review is not an audit with a different name. Audits have a clear role, particularly where legal, contractual or regulatory duties must be evidenced. But they often test whether a requirement exists, not whether it works under pressure.

A diagnostic review looks at the working relationship between people, process, physical measures and leadership. It asks whether the organisation understands its actual threat and vulnerability picture, rather than relying on a generic template. It tests whether responsibilities are clear at the point of action. It considers whether controls are realistic for the environment, staffing levels and operating hours.

For a retail site, that may mean examining how staff report concerns when the duty manager is occupied and the security officer is dealing with another issue. In a venue, it may mean testing how information from front-of-house staff reaches the person able to make a timely decision. In construction, it may involve understanding how changes in site layout, contractors and deliveries alter the risk picture from week to week.

The principle is simple: security controls must work in the conditions in which people actually operate, not only in the conditions assumed when the policy was written.

The uncomfortable value of testing behaviour

Most security failures are not caused by a complete absence of policy. They arise because somebody hesitates, assumes someone else has acted, misreads a situation or lacks the confidence to challenge it. These are behavioural and organisational issues as much as technical ones.

A diagnostic review should therefore examine decision-making, communication and leadership behaviour. Are staff clear about what constitutes a reportable concern? Can they distinguish between ordinary operational friction and something requiring escalation? Do they know who has authority to make a decision, and what to do if that person is unavailable?

This is especially relevant to counter terrorism preparedness and Martyn’s Law planning. Organisations can concentrate heavily on premises measures and written plans while giving too little attention to the people expected to recognise, report and respond. Equipment matters. So do procedures. But the quality of human judgement often determines whether those measures are used at the right time.

A well-designed exercise can reveal more than a stack of completed checklists. It does not need to be theatrical or disruptive. A short, credible scenario discussed with the relevant team can expose uncertainty around roles, communications and thresholds for action. The purpose is not to catch people out. It is to identify where extra clarity, practice or leadership is needed before a real incident forces the issue.

Start with the operating reality

The strongest reviews begin by understanding what the organisation does, where it operates and what pressures its people face. A security model that makes sense at a controlled corporate office may be unsuitable for a busy hospitality venue with high staff turnover. A plan designed for daytime operations can fail badly at night, at weekends or during peak events.

This requires honest conversations with the people closest to the work. Security managers may have a clear view of the intended arrangements, while reception staff, operations teams, contractors and duty managers can explain how those arrangements are actually experienced. When accounts differ, that difference is useful evidence.

It is also necessary to challenge inherited assumptions. Organisations sometimes retain controls because they have always had them, not because they address a current risk. Others invest in visible measures that reassure stakeholders but do little to improve detection, communication or response. Security is not strengthened by adding layers without understanding how they interact.

A review should identify what is proportionate. Not every organisation needs the same level of technical capability, staffing or formal exercise programme. The correct standard depends on threat, exposure, consequence and operational context. However, every organisation needs people who understand their role and can carry it out.

Turning findings into priorities

A weak review produces a long list of observations, assigns broad ownership and leaves the organisation with little sense of what matters first. This creates activity without improvement. The result is often a familiar cycle of meetings, revised documents and deferred actions.

A good diagnostic process separates immediate weaknesses from longer-term development. If staff do not know how to raise an urgent concern, that is not a twelve-month strategy item. If a critical communication route is unclear, it needs a practical fix, testing and reinforcement. Longer-term work may include redesigning governance, improving procurement oversight, revising a security strategy or building a more mature exercise programme.

Priorities should be expressed in operational terms. “Improve awareness” is too vague to manage. “Ensure all duty managers can assess, escalate and record a credible security concern using the agreed process” is measurable. It identifies the audience, the required behaviour and the standard expected.

Ownership also matters. Security cannot be left solely with the security team when operational leaders control staffing, budgets, access to information and day-to-day standards. Senior leaders do not need to become security specialists, but they do need to understand the consequences of delayed decisions, unclear authority and competing priorities.

Evidence should be more than paperwork

Documentation remains necessary. Plans, assessments, maintenance records and training evidence all support assurance. The mistake is treating them as the assurance itself.

Meaningful evidence includes what people can explain, what they can demonstrate and what happens when assumptions are tested. Can staff describe the reporting route without searching for a document? Can a manager explain how a decision would be made outside normal hours? Has a technical system been checked against the operational process it is meant to support? Are lessons from incidents, near misses and exercises actually changing practice?

Digital capability evaluations can be particularly useful here. They provide a structured way to identify knowledge gaps across individuals or teams, with immediate feedback that supports development rather than simply recording completion. They should not replace practical assessment, but they can show where further coaching, scenario work or role-specific training is required.

The distinction matters. Completion tells you someone was present. Capability tells you whether they can contribute when it counts.

When an external perspective is worth having

Internal teams often understand their environment better than anyone. They also work within its assumptions, relationships and constraints every day. That can make it difficult to challenge accepted practice, especially when security arrangements have developed gradually over many years.

An external reviewer can ask questions that internal teams may have stopped asking. Why is this control still in place? What happens if this person is absent? Who verifies this contractor requirement? How would this arrangement cope with a different operating tempo? The value is not in producing a dramatic critique. It is in providing an independent, operationally credible view of where effort will reduce risk.

For organisations with complex estates, public-facing operations or changing threat exposure, a review can also help align security, operations, facilities, HR and leadership around a common picture. Without that alignment, security improvements tend to become isolated projects that lose momentum once the immediate concern fades.

The review is only useful if it changes practice

A security diagnostic review is not a final report to file away. It is a starting point for targeted action. The best outcome is not a perfect score. It is a clearer understanding of where people are capable, where they are exposed and what must change first.

Ask a direct question of your own arrangements: if a credible concern emerged during your busiest, least convenient operating period, would your people know what to do without being told where to find the plan? The answer will tell you far more than a compliance folder ever can.