A behavioural observation programme review should answer a hard operational question, are people genuinely better at noticing, reporting and responding to concerning behaviour, or has the organisation simply created another compliance process?

In exposed environments, the difference matters.

A report made early, assessed properly and passed to the right person can create time, options and safety.

A process that staff do not trust creates noise, delay and false confidence.

Behavioural observation is not about asking frontline teams to profile people or make assumptions based on appearance, ethnicity, faith, disability or background.

It is about recognising behaviour in context, identifying anomalies, and escalating concerns through clear, lawful and proportionate routes.

Done well, it strengthens protective security without turning colleagues into amateur investigators.

Why behavioural observation programmes lose value

Many programmes begin with a sound intention.

Staff receive awareness training, posters appear in back of house areas, and a reporting route is launched.

Six months later, leaders may have little evidence that the programme has changed operational capability.

This normally happens for three reasons.

First, the programme measures activity rather than performance.

Completion rates and attendance figures show that information was delivered. They do not show whether staff can apply it when a venue is busy, a customer is distressed, or a colleague is uncertain about what they have seen.

Second, reporting expectations are vague.

Staff are told to report suspicious behaviour but are not given enough practical guidance to distinguish a genuine concern from ordinary, inconvenient or unfamiliar conduct. This creates either under reporting or a stream of low quality reports that overwhelms the people responsible for assessment.

Third, organisations fail to close the feedback loop.

If a member of staff reports a concern and hears nothing further, they may reasonably conclude that reporting is pointless. They do not need sensitive case details, but they do need to know their actions were received, considered and valued.

Modern threats expose old security thinking.

An organisation cannot rely solely on procedures written for predictable incidents.

It needs people who can observe their environment, recognise when something does not fit, and act with composure.

What a behavioural observation programme review should test

A credible review looks beyond the policy document.

It examines the programme as it operates on the ground, across shifts, locations and roles.

The focus should be capability, not presentation.

Clear purpose and defined risk

Start with the threat and vulnerability picture.

A retail estate, hotel, stadium, transport hub and corporate headquarters each present different behavioural indicators, access risks and reporting pressures. The programme must be aligned to the environment rather than copied from a generic template.

The review should establish what staff are expected to help detect.

This may include hostile reconnaissance, unauthorised access attempts, theft related activity, insider risk, escalating aggression, safeguarding concerns or indicators linked to terrorism.

Not every employee needs the same level of knowledge.

Reception staff, event stewards, facilities teams, control room operators and senior managers require role appropriate instruction and decision support.

Observable behaviours, not personal characteristics

The quality of the training material is central.

Staff need practical examples of behaviours that may warrant attention in context, repeated attempts to access restricted areas, unusual interest in security arrangements, unexplained recording of entrances or emergency exits, abandoning property, or testing staff boundaries.

No individual behaviour proves malicious intent.

That is why context, pattern and professional assessment matter.

The review should check that learning materials make this clear and actively guard against bias. A programme that encourages subjective judgement without boundaries can damage trust, generate poor information and create serious legal and reputational risk.

Reporting routes that work under pressure

A reporting route must be simple enough to use in a real shift.

Staff should know who to contact, what information to provide, when to call emergency services, and what to do if the concern is immediate.

If the route requires a lengthy form, uncertain terminology or several layers of approval, it will fail when stress becomes an issue.

Review the process from the reporter’s point of view.

Can a night worker use it? Can an employee report discreetly while dealing with members of the public? Does it work across contractors, temporary staff and multiple sites? Are there arrangements for people who do not routinely access corporate systems?

The receiving end deserves equal scrutiny.

A report is only useful if it is triaged by someone who understands the operating environment, records the facts accurately and knows when to escalate.

This includes out of hours arrangements.

A concern that sits unread until the next business day may represent a critical gap.

Evidence that capability is improving

The strongest reviews combine operational data with direct testing.

Data can reveal trends, but it cannot always explain whether people are making better decisions.

Look at the quality of reports, not just the volume.

Useful reports usually contain a clear location, time, observed behaviour, description of the circumstances and any immediate action taken.

Poor reports may show that staff lack confidence, the reporting tool is unclear, or supervisors are giving inconsistent guidance.

Scenario based exercises provide stronger evidence.

A short, controlled test can assess whether employees notice a relevant anomaly, use the reporting route and communicate the facts without embellishment.

These exercises should be planned carefully, proportionate to the setting, and never designed to embarrass staff.

The objective is to expose weaknesses before a real incident does.

Interviews and shift observations also matter.

They reveal the space between what senior leaders believe happens and what teams actually do.

A security plan may state that all concerns are escalated immediately.

Frontline staff may explain that they first seek a manager who is often unavailable.

That is not a minor procedural issue. It is a capability failure.

The measures that matter

A programme should have a limited set of measures linked to operational outcomes.

Excessive dashboards create administration without insight.

A practical set may include report quality, time from report to triage, escalation decisions, staff confidence, exercise performance and recurring themes by site or function.

Numbers need interpretation.

A rise in reporting can indicate improved awareness, but it may also signal confusion following a poorly delivered campaign.

A fall in reporting is not automatically a success either. It could mean risks have reduced, or it could mean staff have stopped believing that action follows.

Measure trends alongside case sampling and frontline feedback.

This gives leaders a more honest view of whether the programme is building judgement or merely generating data.

Turn findings into operational change

A review has limited value if its recommendations are broad statements such as improve awareness or provide refresher training.

Findings should lead to named actions, accountable owners and realistic deadlines.

If reports lack useful detail, simplify the reporting prompt and use short practical examples during team briefings.

If shifts apply different standards, equip supervisors with a common decision guide and test it through scenarios. If reports are assessed inconsistently, define triage thresholds and provide targeted development for those receiving concerns.

Training should also be refreshed through realistic, short interventions rather than relying only on annual eLearning.

Digital learning is valuable for a consistent baseline and for checking knowledge, particularly across large or dispersed workforces.

It is not a substitute for local briefing, leadership reinforcement and rehearsal in the actual environment where staff work.

For organisations preparing for Martyn’s Law duties, behavioural observation can support wider counter terrorism readiness when it is integrated with incident response, communications, access control and staff training.

It should not sit alone as a poster campaign or an isolated learning module.

The strongest arrangements join prevention, detection, reporting and response.

Keep the programme credible

Trust is the operating system of behavioural reporting.

Staff must believe that they will be treated fairly, that concerns will be assessed professionally, and that the programme is intended to protect people rather than monitor them unnecessarily.

Leaders set that standard through their response.

Thank people for reporting in good faith. Correct misunderstandings without ridicule. Be clear about the limits of the programme.

Most importantly, demonstrate that reports lead to proportionate action, whether that means reassurance, a security adjustment, further assessment or emergency escalation.

Mildot Group approaches behavioural risk as a performance issue, people need clear thresholds, credible practice and feedback that improves the next decision.

A well run programme does not ask staff to become suspicious of everyone.

It gives them the confidence to notice what matters, report it properly and act before uncertainty becomes harm.

The useful closing test is simple.

Ask a frontline colleague, on their busiest day, what they would do if something felt wrong.

If they can explain the behaviour they would observe, the route they would use and the action they would take, the programme is beginning to deliver real resilience.

.

Useful LInks:

.