Risk Assessment, Incident Response and Documentation
Risk Assessment
Risk = threat x vulnerability x consequence
Risk assessment is not a list of bad things that might happen. It is structured judgement about three elements: threat (who or what could cause harm, and their capability, intent, and opportunity), vulnerability (how exposed the asset is - layout, lighting, access control, staffing, procedures, response time), and consequence (what happens if it does: injury, loss, disruption, reputational and legal exposure). Controls should point at one of those three. If your assessment only names threats, you have written a worry list.
The cycle is: identify assets and hazards, assess, apply controls (eliminate, reduce, transfer, accept), then monitor and review. A written site risk assessment is a starting point; on shift you run a continuous dynamic risk assessment - observe, assess, decide, act, re-assess. The situation in front of you is always the current version.
For site surveys, CPTED gives a practical checklist: natural surveillance (sightlines, lighting, clear glazing), natural access control (fewer, monitored entry points), territorial reinforcement (signage, boundaries, clear public/private separation), and maintenance (a well-kept site signals care and reduces opportunity).
Traps: confusing a hazard (a wet floor) with a risk (the likelihood and consequence of someone falling); treating the document as finished once written; ignoring human factors such as fatigue, lone working, and complacency; assuming a camera is a control - cameras mostly record, they rarely prevent. Watch also for items that give you a high-likelihood nuisance and a low-likelihood catastrophe and ask which to prioritize.
Worked example: an unlit stairwell beside a cash office with a single exit. Threat: opportunistic theft. Vulnerability: no lighting, one escape route, no sightlines. Consequence: high. Control: lighting, camera coverage, restricted access, and a patrol check - then re-assess.
Rule of thumb: rank by consequence first, then likelihood; a rare catastrophe outranks a frequent annoyance.
Incident Response and Documentation
Respond in priority order, then write it down properly
Incident response follows a fixed priority: your own and scene safety - preserve life (first aid, EMS, police) - contain or isolate the problem - preserve the scene and evidence - identify witnesses - document. Guards get hurt when they rush step one to reach step three. Do not become a second casualty, or a second witness who contaminated the scene.
Notes. Write contemporaneously, before end of shift, in chronological order. Include date, time, and location; full identification of everyone involved; what you saw, heard, said, and did, in sequence; exact words in quotation marks; and the outcome. Separate what you observed from what you were told. Describe behaviour rather than labels: not 'the subject was belligerent' but 'the subject clenched his fists, stepped toward me, and said ...'. No opinions, conclusions, guesses, or slang. Your notebook is a legal document that may be disclosed and tested in court; never destroy, rewrite, or backdate it. Correct errors with a single line-through and your initials.
Use-of-force reports need each application described separately: what you did, why, where it landed, how long, and what effect it had.
Evidence and CCTV. Maintain continuity - who had the item, when, and where, logged at each transfer. Preserve CCTV promptly: note the recorder's time offset, export a copy, and never edit the original.
Traps: a report that is accurate but useless because it lacks times and names; omitting what you did not do and why; writing the report days later; copying another guard's version of events; describing a person's character instead of their conduct.
Rule of thumb: write for a reader who was not there, who will read it two years from now in a hearing room, and who will ask 'how do you know that?'