Somewhere on your org chart there is a box labeled security, or there is a person who handles it without a box at all. Where that box connects to the rest of the chart matters more than most executives realize. It decides what the security function can see, who it can push back against, whether it gets a seat when budgets are set, and whether the person in the role hears about problems before or after they become incidents. The question of who security should report to is a structural decision, and I have watched it determine the outcome of programs long before anyone judged the people running them.
I have reported to chiefs, commissioners, agency heads, and corporate executives over a career in law enforcement, fire service, private security, and federal service. The reporting line shaped every one of those roles. This article walks through the four places security usually lands in a mid-sized organization, what each one does to the function, and how to pick the right one for yours.
Why the Reporting Line Matters More Than the Title
Security touches every department and is owned by none of them. It needs information from HR about terminations and complaints, from facilities about doors and construction, from IT about badging systems and cameras, from operations about schedules and site changes, and from legal about exposure. It also needs the standing to tell any of those departments that something they are doing creates risk. A function that reports low in the chart can gather the information but cannot deliver the message. A function that reports high can deliver the message but may be too far from the daily work to know what to say.
The reporting line also decides how security gets described to leadership. If it lives under facilities, it is presented as a building cost. If it lives under HR, it is presented as an employee relations matter. If it lives under the COO, it is presented as an operating risk. Each framing is partially true and each one leaves something out. The executive who chooses the reporting line is choosing which parts of the picture the board will see.
Reporting to Facilities
This is the most common arrangement in organizations that have never thought about it, and it is the weakest. Facilities leaders are usually capable people who understand buildings, and physical security does involve buildings. But security under facilities gets treated as locks, cameras, and guard hours, which are the parts of the program that cost money and show up on a spreadsheet. The parts that prevent the worst outcomes, meaning threat assessment, policy, training, and coordination with HR and legal, have no natural home there. I have seen facilities-owned programs with excellent hardware and no idea what to do when an employee makes a threat.
If security must sit under facilities for now, compensate for the blind spots. Give the person a standing monthly meeting with HR and legal, a direct escalation path to the COO or CEO for threats and incidents, and written authority to raise issues outside the facilities budget. Without those, the program will be judged on whether the cameras work, and it will fail on everything else.
Reporting to Human Resources
HR ownership makes sense in organizations where the dominant risks are internal: workplace violence, hostile terminations, domestic situations that follow employees to work, and misconduct investigations. HR already handles the sensitive information and already owns the policies that govern conduct. Security under HR tends to be strong on people and weak on premises, and it can struggle with visitor management, contractor access, and anything involving the physical plant. It also creates an awkward dynamic when the investigation involves someone in HR.
The practical fix is the mirror image of the facilities problem. Give the security lead direct access to the facilities and IT teams, a role in construction and renovation planning, and an independent path to legal and the executive team for matters that HR itself is party to. Written into the role description, these provisions cost nothing and prevent the most predictable failures.
Reporting to the COO or CEO
In my experience, security works best when it reports to the executive who owns operations across the whole organization. In most mid-sized companies that is the COO, and in smaller ones or those without a COO it is the CEO. This placement gives the function visibility into every department, the authority to raise issues with any of them, and a place at the table when budgets and priorities are set. It also puts security in the language of operating risk, which is the language the board already speaks and the one that gets funded.
The objection I hear is that the COO does not have time to manage another direct report, especially one in a field they do not understand. That is a fair concern and it is one reason a fractional security director works well in this position. The director does not need daily supervision. They need a monthly briefing, a clear mandate, and an executive who will back them when a department head pushes back. The reporting line exists for authority and visibility rather than for management in the ordinary sense.
How to Decide for Your Organization
Start by listing the security incidents and near misses from the past two years, however informally they were handled, and sort them by whether the root cause was a person, a place, or a process. The category with the most entries tells you where the risk lives and which executive should have the clearest line of sight to it. Then look at where security currently reports and ask whether that leader has seen those incidents, has the authority to act on them, and has a seat in the budget discussion. If the answer to any of those is no, the structure is working against you regardless of who holds the role.
Whatever line you choose, write it down. Put the reporting relationship, the escalation path for threats and incidents, the standing meetings with HR, facilities, IT, and legal, and the budget authority into a one-page charter that the executive team signs. Then test it. Walk through a plausible scenario, a credible threat from a former employee for instance, and trace who would learn what, in what order, and who would decide. That exercise takes an hour and it reveals more about your reporting structure than any org chart. This is the same doctrine I wrote about in Until Tested: Security Is Only Assumed: a structure that has never been exercised is a structure you are assuming works.
Go Deeper
For the full definition of the role that most often fills this reporting line in mid-sized organizations, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director covers reporting structure, charter language, and the first conversations to have with each executive in detail.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply