Close Protection Operations common mistakes
Close Protection Operations · Understand the traps and how to avoid them.
Treating a threat assessment as a one-time judgement made during the initial briefing and then never revisiting it as the client's itinerary, public exposure, or local conditions change.
Candidates memorise a static threat matrix template and apply it once, so they miss that risk is continuous and that a rating without a review trigger is meaningless. Exam scenarios often introduce a mid-advance change that only rewards candidates who re-score likelihood and impact.
What to do instead
Build a written assessment that separates likelihood and impact, records the source and confidence of each piece of intelligence, and names explicit review triggers (route change, new social-media exposure, credible threat received, venue change). Practise re-scoring the same scenario after an injected change and justify the delta in one or two sentences.
Confusing protective intelligence collection with general background research: candidates list open-source searches as if gathering them were the deliverable, without stating what decision each item informs or how it is validated.
The domain overlaps with research skills, so candidates produce long unfiltered lists of sources and feel productive. Examiners are testing whether intelligence is prioritised, corroborated, and time-stamped, not whether the candidate can name search engines.
What to do instead
For each intelligence item, state the requirement it answers, the source, the collection date, and a confidence level. Separate confirmed fact from single-source reporting and from assumption. Practise writing a one-page intelligence summary where every line ends in a decision it supports.
Producing a route plan that names a primary route only, with no alternates, no decision points, and no stated criteria for switching between them.
Candidates default to describing the shortest or fastest path and treat contingency planning as a separate topic. They also forget that a route is chosen for predictability, choke-point avoidance, and emergency egress, not just distance.
What to do instead
Present routes as a set: primary, alternate, and emergency, each with a map reference, estimated transit time at the relevant traffic period, identified choke points, and named decision points where the team leader can switch. State the trigger for each switch and who authorises it.
Describing venue protection as a checklist of physical measures (access control, screening, CCTV) without linking each measure to a specific threat from the assessment or assigning responsibility for it.
Checklists are easy to recall and give an illusion of completeness. Candidates then cannot answer follow-up questions about who owns a control, how it is verified on the day, or what happens when a control fails.
What to do instead
Write site plans as a control-to-threat matrix: each control names the threat it mitigates, the owner, the verification method, and the fallback if it is unavailable. Include the client's protected zone, the transition points between zones, and the evacuation assembly area.
Placing formation positions by memory of a diagram without explaining spacing, arcs of responsibility, or how the formation flexes when the client stops, turns, or enters a doorway.
Formation drills are taught as fixed shapes, so candidates reproduce the shape but not the reasoning. Exam scenarios that add a crowd, a narrow stairwell, or a client who deviates from the planned path expose the gap.
What to do instead
For every formation, state the principle behind each position: who covers which arc, minimum and maximum spacing, hand signals for flexing, and the transition drill for doorway entry, stairwells, and vehicle transfer. Rehearse the flex verbally by describing what each team member does when the client stops unexpectedly.
Treating surveillance detection as a single check performed at the start of a move, rather than a continuous cycle with a defined route, observation points, and a reporting trigger.
Candidates conflate surveillance detection with a quick glance in the mirror. They also omit what to do with a confirmed detection, so the answer stops at noticing rather than at decision and action.
What to do instead
Describe a detection route with named observation points, the indicators looked for at each, the time spent, and the reporting format. State the thresholds that separate anomaly from confirmed surveillance and the actions for each, including who is informed and whether the principal move continues or is aborted.
Writing a communications plan that lists equipment only, with no call signs, no primary and alternate nets, no check-in schedule, and no protocol for radio silence or compromise.
Candidates equate communications with radios. They forget that command and control is about information flow and decision authority, so the plan fails when the primary net is congested or a device fails.
What to do instead
Produce a plan with call signs, primary and backup channels, a check-in and position-report schedule, standard phrases for contact, compromise, and all-clear, and a stated fallback (secondary device, pre-agreed text code, rendezvous point) if the net fails. Name the decision authority when communications are lost.
Answering emergency-response questions with a generic sequence (react, extract, evacuate) without triage of the incident, defined command transfer, casualty care priorities, or a post-incident handover.
Candidates learn a linear drill and apply it to every scenario, including ones where extraction endangers the client more than holding position. They also skip the transition to emergency services and the preservation of records.
What to do instead
Structure responses around recognition, decision, action, and handover. For each scenario, state whether the priority is move, shelter, or defend, who assumes command and when it transfers to emergency services, the casualty-care sequence, and what is documented afterwards. Justify the choice against the specific threat.
Justifying use of force by outcome alone ("the threat was neutralised") without addressing necessity, proportionality, the legal basis, and the point at which force must stop.
Candidates focus on tactical success and treat law as a separate subject. They also assume a single universal standard, when authority to use force varies with jurisdiction, role, and the client's status.
What to do instead
For every force scenario, state the legal basis relied on, the necessity test applied at the moment of decision, the proportionality analysis, and the duty to reassess and cease. Flag explicitly where the answer depends on jurisdiction and say what would change. Include the reporting and evidence-preservation obligations that follow.
Handling client liaison as a set of instructions issued to the principal, rather than a two-way briefing that establishes the client's preferences, constraints, and consent to protective measures.
Candidates picture leadership as command and forget that the client is not a subordinate. They then propose measures the client will reject in practice, such as cancelling a long-planned public appearance, without any negotiation or documented risk acceptance.
What to do instead
Practise a structured client briefing: state the assessed risk in plain terms, present options with their trade-offs, record the client's decision and any accepted residual risk in writing, and set a review point. For team leadership, add how tasks are delegated, how performance is confirmed, and how dissent is raised and resolved.