A plan that looks convincing in a board pack can still fail in the first five minutes of a live incident. That is the gap an operational readiness assessment is meant to expose. For organisations facing terrorism risk, public safety pressures, or demanding duty-of-care obligations, readiness is not a paperwork exercise. It is the hard question of whether people, systems and decisions will hold up when timing, pressure and uncertainty collide.

Too many assessments stop at policy review. They confirm documents exist, note training completion rates, and record that response procedures have been signed off. That may satisfy an internal checkpoint, but it does not tell an operations director whether a venue team can spot hostile reconnaissance, whether escalation thresholds are understood, or whether a control room can maintain command discipline when information is incomplete.

What an operational readiness assessment should actually test

A credible operational readiness assessment examines capability, not just compliance. It asks whether the organisation can detect, decide, communicate and act under realistic conditions. That distinction matters. A site can be technically compliant and still operationally weak.

In practice, the assessment should test the connection between strategy and frontline execution. Security design, staffing models, procedures, technology, leadership, external liaison and behavioural performance all need to work together. If one element is brittle, the rest of the system tends to fail with it.

For higher-risk environments such as retail estates, crowded places, events, hospitality, critical infrastructure and corporate locations with elevated threat exposure, that means looking beyond whether controls exist. The right question is whether those controls are usable, understood and resilient under pressure.

Why compliance alone is not enough

Martyn’s Law has sharpened attention on preparedness, but the broader problem existed long before new legislation. Organisations often build security programmes around audit evidence because evidence is visible. Capability is harder to measure. It requires observation, testing and honest diagnosis.

That creates a common weakness. Senior leaders may receive assurance that training has been delivered, plans have been issued and exercises have been completed, while the operational picture remains unclear. Was the training retained? Were the exercises realistic? Did staff perform, or simply attend?

Compliance has its place. Standards, governance and documented controls matter. But they are only useful if they improve operational effect. When threat levels rise, the organisation does not fall back on policy wording. It falls back on habits, judgement, supervision and rehearsed action.

The core components of an operational readiness assessment

The exact model depends on sector, threat profile and operating environment, but the strongest assessments usually cover a consistent set of themes.

People and decision-making

Readiness starts with people. Do staff understand their role in prevention, detection and response? Can supervisors make timely decisions without waiting for perfect information? Are leaders able to prioritise life safety, maintain control and communicate clearly across teams?

This is where behavioural risk often becomes the hidden gap. Under stress, people narrow attention, miss cues, overcomplicate decisions or freeze behind hierarchy. An assessment that ignores human performance will miss the point. The issue is not whether a procedure exists. It is whether people can apply it when adrenaline, ambiguity and competing demands are all in play.

Plans, procedures and escalation

Plans should be clear, usable and aligned to the operating reality of the site or organisation. Overwritten procedures are often a warning sign. If staff need ten minutes to interpret a response document, the document is not fit for purpose.

An effective assessment tests whether escalation thresholds are defined and understood, whether command responsibilities are clear, and whether there is genuine interoperability between teams. Security, operations, facilities, HR, communications and senior leadership all need to know how the response framework works. Where that integration is absent, delay follows.

Systems, infrastructure and technical support

Technology should support decisions, not create false confidence. CCTV, access control, radios, mass notification tools, barriers, screening measures and incident management platforms all have to be assessed in terms of performance, not brochure claims.

That means asking practical questions. Is camera coverage matched to actual threat pathways? Can radio traffic be managed during a fast-moving incident? Do access control settings support lockdown or phased restriction? Are operators trained to use systems properly, or just to log routine activity?

Training, exercising and competence

Training records only tell part of the story. A stronger assessment looks at competence retention, quality of drills, scenario realism and the extent to which lessons are acted upon. There is a difference between annual awareness training and a workforce that can recognise suspicious behaviour, report clearly and support an effective initial response.

Exercising is especially revealing. Tabletop sessions are useful for strategic discussion, but they cannot replace practical validation. Sometimes the issue is not ignorance but friction – keys unavailable, contact details outdated, command handovers confused, or external partners brought in too late.

What good assessment looks like in practice

A worthwhile assessment is structured, evidence-based and operationally credible. It combines document review with interviews, observation, walkthroughs and realistic challenge. It should be rigorous enough to identify weaknesses, but practical enough to produce action the client can implement.

This is where many organisations benefit from specialist external support. Internal teams can know the operation well, but they are often too close to legacy assumptions. An independent view brings challenge, comparison and realism. It also helps cut through the tendency to grade preparedness on effort rather than effect.

For example, a venue may believe its hostile threat response is strong because stewards have completed awareness training and evacuation plans are documented. Yet a proper assessment may find that supervisors interpret triggers differently, key comms channels are overloaded, and control measures are built around a single scenario. The weakness is not obvious until the system is tested as a whole.

Where organisations usually get caught out

Most readiness failures are not dramatic. They are cumulative. Small weaknesses line up and then become serious under pressure.

One common issue is role confusion. When everyone is responsible, no one is clearly responsible. Another is overreliance on a few experienced individuals. If readiness depends on one operations manager, one control room lead or one external adviser, it is fragile by design.

A third problem is the mismatch between strategic intention and frontline reality. Head office may believe procedures are standardised across sites, while local teams are adapting informally because the written process does not fit operating conditions. That kind of drift is predictable, and dangerous if left unexamined.

There is also the question of tempo. Some organisations can manage routine incidents well but slow down badly when scale increases. The first issue is handled competently, the second stretches command, and the third exposes that nobody has a clean process for prioritisation. An assessment should test for this, because threat events rarely arrive in a neat format.

Turning findings into capability improvement

An operational readiness assessment has value only if it leads to better performance. That means findings should be prioritised by operational risk, not just grouped into a general action log.

Some improvements are immediate – clarifying command roles, fixing escalation triggers, updating contact protocols, or adjusting site-specific procedures. Others require a deeper programme of work, such as revising training design, strengthening exercise schedules, improving technical integration or developing leaders who can operate calmly under pressure.

This is also where proportion matters. Not every gap requires a large-scale investment. Sometimes capability improves most through better rehearsal, sharper supervision and simpler procedures. In other cases, the organisation does need structural change because the current model cannot support the threat environment it faces. The right response depends on consequence, likelihood and operational context.

Mildot Group’s approach in this space reflects a simple principle: theory has to survive contact with reality. Assessments should give leaders a clear picture of where capability stands now, where risk is sitting in the system, and what action will produce meaningful improvement rather than more paper.

Operational readiness assessment as a leadership tool

The strongest organisations use assessment as more than a security check. They use it as a leadership tool. It gives boards, security managers and operations leaders a common view of readiness, a basis for prioritising investment, and a more honest understanding of whether the business can perform under pressure.

That matters in sectors where public confidence, legal exposure and life safety are all at stake. It also matters because modern threats expose old security thinking. Static assumptions, generic plans and low-challenge assurance models do not hold up for long.

A serious operational readiness assessment brings clarity. It shows whether the organisation can translate intent into action, and whether resilience is real or merely stated. If you are responsible for people, sites or high-consequence operations, that is not a nice-to-have. It is one of the few checks that tells you what will happen before the moment arrives.

Useful LInks:

.