If someone on your board asked you tomorrow whether your security program actually works, you would probably say yes. You have a guard contract, you have cameras, you have badges, and nothing terrible has happened. That answer is honest as far as it goes, and it is also the answer I have heard from leaders a few weeks before something did happen. The absence of an incident tells you very little about the strength of a program, because most organizations go years between serious events whether their security is sound or not.
The harder question is what evidence you would point to. Not the invoice from the guard company, and not the list of equipment, but proof that the pieces do what you are paying for them to do. This article is about how to get that evidence without hiring anyone, at least at first. It describes what I look at in the first week of any engagement, and every item on it is something an operations leader can check personally.
Why Quiet Is Not the Same as Working
Security programs fail quietly for a long time before they fail loudly. A door that does not latch will sit that way for months. A terminated contractor’s badge will keep opening the loading dock every night, and nobody notices because the system logs it as a valid entry. An alarm signal will route to a phone number that belonged to a facilities manager who left two years ago. None of these produce an incident on their own. They produce an opening, and the incident arrives when someone finally walks through it.
This is why I tell leaders that security should be tested, not assumed. A program that has never been checked is a set of assumptions dressed up as a program. The good news is that most of the checks are simple, and the bad news is that almost nobody runs them. When I ask an executive team who last verified that the panic button at reception reaches anyone, the room usually goes quiet. That silence is the real state of the program.
Does Your Security Program Actually Work? Start With the Doors
The fastest test I know is to walk the perimeter of your building after hours and pull on every door. Do it yourself or send someone you trust, and do it without telling the guard vendor. Note which doors are propped, which ones close but do not latch, and which ones open with a badge that should not work there. Then walk in through the main entrance during business hours carrying a box and see whether anyone stops you. In my experience the first walk finds something at more than half of sites, and the finding is usually a door that has been wrong for a long time.
While you are at it, look at the guard post at shift change. That is the moment a post is most likely to be empty, most likely to be distracted, and most likely to wave through a familiar face without checking a credential. Compare what you see against the post orders in the contract. If the contract says the officer patrols the parking structure hourly, ask for the patrol logs and then look at whether the timestamps make sense. A log that shows a perfect hourly patrol for six months without a single variation is usually telling you the log is filled in from memory.
Confirm the Alarm Reaches a Person
Your intrusion alarm, your fire panel, and your duress buttons all send a signal somewhere. Call the monitoring company and ask them to read back the call list for your account. Ask who receives the signal, in what order, and what they are instructed to do if nobody answers. I have seen call lists that led with people who no longer worked for the organization, and I have seen accounts where the monitoring company was instructed to call the site phone, which rang at an empty desk. Then schedule a test with the monitoring company and press the button. If the process works, you have learned something worth knowing. If it does not, you have learned something worth fixing before it matters.
Audit the Access List
Ask whoever administers your access control system to export the full list of active credentials, then sit down with HR and compare it against the list of current employees and active contractors. Every name on the first list that is missing from the second is a badge that still opens your doors for someone who should no longer have it. Pay particular attention to vendors, temporary staff, and anyone whose badge was issued more than a few years ago, because those are the credentials nobody remembers to cancel. While you have the export, look at who holds access to the server room, the executive floor, and the cash-handling areas, and ask whether each of those people needs it for their current job.
This single exercise finds more real exposure than almost anything else I do, and it costs nothing but an afternoon. Once you have cleaned the list, put a quarterly review on the calendar and assign it to a named person. An access list is only accurate on the day it was audited, and it starts drifting the next morning.
Run the Plan Before You Need It
Every organization has something it calls an incident plan, even if it is a page in the employee handbook. Take that plan and run it as a tabletop exercise with the people who would have to execute it. Give them a plausible scenario, such as a credible threat from a former employee or a medical emergency during a large event, and walk through it hour by hour. Ask who calls whom, who has authority to lock down the building, who talks to the press, and where the staff go. The exercise takes ninety minutes and it will show you within the first twenty whether the plan lives in people’s heads or only on paper.
What you learn in a tabletop is rarely that the plan is wrong. It is that the plan depends on a person who is on vacation, a phone tree that has not been updated, or a decision nobody has authority to make. Those are cheap to fix once you know about them and expensive to discover during a real event.
What to Do With What You Find
Write it down plainly, rank it by how much harm it could cause and how easy it is to exploit, and put a name and a date next to each item. Some findings cost nothing to fix, like removing dead credentials or updating a call list. Some require a small budget, like repairing a door closer or adding a camera at a blind corner. A few will require a real decision about staffing, vendors, or capital. The point of testing is to make those decisions with facts instead of instincts, and to be able to tell the board what you know rather than what you hope.
If the list is long, or if you find that nobody in the organization owns any of it, that is the signal that you have a leadership gap rather than an equipment gap. Buying more equipment will not close it. Someone with security experience and executive authority has to own the program, run these tests on a schedule, and report the results to leadership. For many mid-sized organizations that is a part-time executive role rather than a full-time hire, and I have written at length about how it works. The doctrine behind all of it, and the P.R.O.O.F. framework for verifying that a program works through testing rather than assumption, is laid out in Until Tested: Security Is Only Assumed.
Go Deeper
For the full picture of what security leadership looks like at a mid-sized organization and who should own it, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director explains how a part-time executive security director closes the leadership gap and puts a testing discipline in place that lasts.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply