In most mid-sized organizations, if you follow the trail of who handles the alarm contract, the badge system, the guard vendor, and the locks, it ends at the facilities manager. Nobody decided this. The facilities manager holds the keys, knows the building, and already manages contractors, so security landed on that desk one item at a time until it became a permanent part of the job. If this describes your organization, I want to be clear at the outset that the problem with letting the facilities manager run security is a structural one. The person is almost never the issue.
I have worked with a great many facilities managers over my career, and they are among the most capable and overextended people in any organization. They keep the building running, respond to everything from a flooded restroom to a failed generator, and absorb responsibilities that no one else wants. When security is added to that list, they handle it the way they handle everything else, which is competently and without complaint. What they cannot do is supply the training, the authority, and the time that security leadership requires, because none of those things came with the assignment. The result is a security function that is managed and never led, and the organization carries the exposure without knowing it.
How Security Ends Up in Facilities
The path is almost always the same. The organization moves into a building with an existing access control system, and the facilities manager takes over the vendor relationship because it is a building system. The lease requires a staffed lobby, and the facilities manager finds a guard company because they already manage outside services. An incident occurs, cameras are installed, and the facilities manager oversees the installation because it involves cabling and walls. Each step is logical on its own. Together they produce a security program owned by someone who was hired to run a building.
The arrangement persists because it appears to work. The doors lock, the officers show up, the alarm company sends invoices. Leadership sees a set of tasks being handled and has no reason to look more closely. The facilities manager, who is measured on uptime, cost, and tenant satisfaction, treats security as one more system to keep running at reasonable cost, because that is what the job rewards. No one in this picture is behaving badly. The gap is in what no one was asked to do.
What the Facilities Lens Cannot See
Facilities management is a discipline of systems and service. Its instinct is to keep things functioning, to minimize disruption, and to resolve complaints quickly. Security leadership is a discipline of adversaries and consequences. Its instinct is to ask who might want to get in, what they would do, and what would fail first. These are different ways of looking at the same building, and a facilities manager who has spent a career on the first will not naturally see through the second, any more than I would naturally see a building the way an engineer does.
The practical effect shows up in specific places. Access control is configured for convenience, with broad permissions and a credential list that grows and is rarely pruned, because pruning creates complaints and complaints are what facilities is measured against. The guard contract is managed on price and responsiveness rather than on post orders, training records, and supervision. Incident reports are filed rather than analyzed. Threats that come from people, such as a terminated employee or a domestic situation that follows someone to work, fall entirely outside the facilities frame, and the organization has no one who is thinking about them at all.
The Authority Problem
Even a facilities manager with strong security instincts runs into a wall of authority. Security decisions that matter cross departmental lines. Access policy touches HR. Visitor procedures touch reception and every department that hosts guests. Termination protocols touch legal and management. Executive protection touches the people at the top of the organization. A facilities manager can raise these issues but cannot settle them, and in most organizations they learn quickly that raising them creates friction without producing change. So the issues stop being raised.
There is also the matter of the board. When leadership asks whether the organization is secure, the answer needs to come from someone who can speak to risk, liability, and readiness in terms the board recognizes, and who has the standing to deliver uncomfortable findings. That is an executive conversation. Asking the facilities manager to carry it puts a capable person in an unfair position and gives the board an answer shaped by someone who does not have the full picture and was never given the authority to obtain it.
What It Costs the Organization
The cost stays hidden until an incident makes it visible. A former contractor’s badge still works. A guard post is unstaffed at the moment it matters. A threat from a departing employee is mentioned to the facilities manager, who has no protocol and no one to escalate it to, and is filed as a note. The incident response plan, if one exists, has never been exercised because exercising it was nobody’s job. When these things surface, the organization discovers that it has been paying for a security program and receiving a building services program, and the difference becomes a legal and reputational problem in a single afternoon.
The cost to the facilities manager is real as well. They carry accountability for outcomes they were never equipped to control, and when something goes wrong, they are the person in the room. I have seen good people blamed for failures that were built into the structure years before they arrived. That is a poor way to treat someone who has been holding two jobs for the price of one.
How to Fix It Without Replacing Anyone
The solution is to separate leadership from operations, and to keep the facilities manager in the role they are good at. Start with a conversation that acknowledges what has been carried and asks the facilities manager where the gaps are. They will know, and the list will be more accurate than any consultant’s first assessment. Then put someone with security expertise and executive authority above the function. For most mid-sized organizations that person does not need to be full-time. A fractional security director can set the priorities, write the policies, manage the guard vendor against the contract, build the threat assessment protocol, and brief the board, while the facilities manager continues to operate the systems with clear direction and a colleague who can take the cross-departmental problems off their hands.
Then test the program rather than assuming it works. Have the credential list reviewed against the current roster. Have someone visit the guard post on a weekend night. Run the incident plan as a tabletop with the people who would have to execute it. This is the discipline at the center of Until Tested: Security Is Only Assumed, and the first round of testing will show you, quickly and without blame, exactly what the facilities lens was never in a position to see.
Go Deeper
Adding a leadership layer above the people already running security is the core of the fractional model, and I explain it in What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director describes how a part-time executive director works alongside facilities, HR, and IT rather than displacing them.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply