NZ Property Guard COA cheat sheet

A property guard's authority is delegated, not inherent: powers come from the client's lawful instructions plus statute (e.g. trespass, shoplifting/detention powers) and never exceed those of an ordinary citizen unless a specific Act grants more.

Private Security Personnel and Private Investigators Act 2010 (NZ) requires individual guards to hold a current Certificate of Approval (CoA) and to carry it at all times while working; working without one is an offence.

Certificate of Approval classes: employee of a licensed security firm, sole operator, and temporary/event CoA; the class must match the actual work performed and the licence holder you work under.

CoA obligations include notifying the Licensing Authority of changes to name, address, or criminal convictions within the prescribed period, and producing the certificate on request by Police or an authorised person.

Trespass Act 1980: a guard may warn a person to leave private property on behalf of the occupier; failing to leave after a warning, or returning within 2 years after a trespass notice, is an offence.

Citizens' arrest (Crimes Act 1961 s 35-36) is limited to offences against the peace or a crime committed in your presence; the person must be delivered to Police as soon as practicable, and force used must be reasonable in the circumstances.

Privacy Act 2020 governs collection, storage, use, and disclosure of personal information (CCTV, incident reports, ID scans); only collect what is necessary for a lawful purpose and retain only as long as needed.

Health and Safety at Work Act 2015 imposes a duty on PCBUs (including security employers and site controllers) to eliminate or minimise risks so far as reasonably practicable; guards must follow lawful safety instructions and report hazards.

Evidence in court must be relevant, accurate, and unaltered; guards should record facts (time, place, words, actions) not opinions, and preserve original notes and footage for disclosure.

Core duties of a property guard: protect people and property, control access, observe and report, deter crime, respond to incidents within scope, and maintain site logs - never investigate crimes reserved for Police.

Scope boundary rule: if a task requires a statutory power (search, arrest, interview, seizure) that you do not hold, stop and escalate to Police or the site controller.

Conflict of interest and integrity: refuse gifts, gratuities, or favours that could influence decisions; declare any relationship with a person you are controlling access for.

Confidentiality: do not disclose client operations, staff movements, access codes, or incident details to anyone without a need-to-know, including on social media.

Professional presentation: correct uniform, visible ID/CoA, clean appearance, punctuality at handover, and completing the site log before leaving post.

Use of force is a last resort: only the minimum force necessary to prevent harm or effect a lawful arrest, and only when other options (communication, withdrawal, calling Police) have failed or are not feasible.

Negligence exposure: failing to follow site procedures (e.g. not checking ID, not patrolling, not logging) can create civil liability for you and your employer; follow the post orders as written or report why you cannot.

Reporting hierarchy: follow the chain of command - supervisor, then site controller, then Police - and document every escalation with time and outcome.

De-escalation sequence: calm tone and open body language, acknowledge the person's concern, state the rule or request clearly, offer a choice/alternative, give time, and only then escalate to a supervisor or Police.

Use 'I' statements and neutral language ('I need you to…') rather than accusations ('You always…'); avoid arguing about facts in the moment.

Personal space and positioning: keep at least 1.5 m distance, stay at an angle (not square-on), keep hands visible, and never block the only exit route.

Active listening: paraphrase the concern back, ask open questions, and confirm understanding before giving an instruction; this reduces perceived threat.

Radio protocol: identify your call sign, state location, then situation, then request; keep transmissions short, avoid names over open channels, and confirm receipt.

Customer service standard: greet, identify yourself and role, explain what you are doing and why, and thank the person - even when refusing access.

When to stop engaging: if a person is intoxicated, armed, or escalating physically, withdraw to a safe distance, call for backup/Police, and observe rather than confront.

Written communication: incident reports use plain factual language, chronological order, full names and times, and avoid jargon or speculation.

Observation method: scan systematically (left to right, near to far), note baseline conditions, and look for anomalies such as unusual behaviour, unattended items, or forced entry marks.

Description capture: use the person/vehicle framework - sex, age, height, build, hair, clothing, distinguishing features, direction of travel; for vehicles, rego, make, model, colour, damage.

Note-taking: record time, date, location, who was present, what was said and done, and your actions; write contemporaneously and never alter original notes - corrections are made as dated additions.

Report content rule: facts only - what you saw, heard, and did - not conclusions ('he looked suspicious' becomes 'he was looking into three parked cars for 4 minutes').

CCTV and footage: preserve originals, log who accessed it, note the time offset, and never edit or delete; chain of custody must be documented.

Physical evidence: do not handle unless necessary; if you must, wear gloves, bag and label with time/place/finder, and hand to Police or store securely.

Chain of custody record must show every transfer: from whom, to whom, date/time, and reason; gaps weaken evidence in court.

Incident report timing: complete as soon as practicable after the incident while memory is fresh, and submit to supervisor within the site's required timeframe.

Access control principles: verify identity, verify authority (visitor list, booking, pass), record entry/exit, and issue/collect passes; deny access when authority cannot be established.

Three-factor check for visitors: name matches ID, host/booking confirms, and purpose is consistent with site rules; log time in, time out, and vehicle if applicable.

Patrol types: fixed post, foot patrol, vehicle patrol, and random patrol; vary timing and routes to avoid predictability, and use a checkpoint/scan system to prove coverage.

Patrol routine: check doors, windows, fences, lighting, fire exits, and unauthorised vehicles; record every check with time and condition, and report defects immediately.

Key and pass control: sign keys in/out, never leave keys unattended, and report lost keys immediately so locks can be changed.

Alarm response: verify the alarm, approach with caution, check the exterior first, and only enter if safe and authorised; call Police for signs of forced entry.

Site handover: read the post orders and log, confirm keys/equipment, note outstanding issues, and sign the handover record before taking over the post.

Lock-up procedure: confirm the building is empty where required, secure all doors/windows, set alarms, and record the time and any anomalies.

Emergency priority order: life safety first, then incident containment, then property protection; never risk your life to protect property.

Fire response: raise the alarm, call 111, evacuate via the nearest safe exit, do not use lifts, and only use an extinguisher if trained and the fire is small and you have a clear escape route.

Medical emergency: call 111, follow dispatcher instructions, do not move a casualty unless in danger, and record times of collapse, response, and handover.

Personal safety: maintain situational awareness, keep an exit route, avoid entering confined or dark areas alone, and use radio check-ins at agreed intervals.

Lone worker controls: scheduled check-ins, duress alarm, and a written escalation plan if a check-in is missed.

Incident management steps: secure the scene, preserve evidence, identify witnesses, record details, and hand over to Police/emergency services with a briefing.

Use of force reporting: any physical intervention must be reported immediately to your supervisor and documented with time, reason, and force used.

Post-incident: complete an incident report, obtain medical attention if needed, and participate in any debrief; do not discuss the incident with media or on social media.

PCBU duty (HSWA 2015): eliminate or minimise risks so far as reasonably practicable; workers must take reasonable care for their own and others' safety and follow lawful instructions.

Hazard identification: check the site at the start of each shift for lighting, trip hazards, damaged doors, aggressive persons, and weather exposure; record and report.

Risk assessment formula: risk = likelihood × consequence; controls follow the hierarchy - eliminate, substitute, isolate, engineer, administrate, then PPE last.

Fatigue management: maximum shift lengths and minimum rest breaks apply; report fatigue to your supervisor rather than working impaired.

Manual handling: assess the load, keep it close, bend knees not back, and use team lifts or equipment for heavy or awkward items.

Emergency equipment: know the location and use of fire extinguishers, first aid kits, defibrillators, and emergency exits on every site you work.

Reporting obligations: report all injuries, near misses, and hazards to your supervisor and record them in the site register; near misses are leading indicators of future harm.

Wellbeing: shift work, confrontation, and isolation increase stress risk; use peer support, EAP, and debriefs after critical incidents.

PPE: wear the PPE provided for the task (hi-vis, gloves, torch, wet-weather gear) and report damaged or missing equipment before starting work.

First contact script: greet, state your name and role, state the purpose, and ask a question - this establishes authority and rapport in under 30 seconds.

Refusal script: acknowledge the request, state the rule briefly, offer an alternative or escalation path, and thank the person; do not apologise for the rule itself.

Conflict escalation signs: clenched fists, raised voice, invading space, and rapid speech - these indicate rising risk; increase distance and lower your voice.

Radio phonetic alphabet and clear speech: use standard phonetics for letters, numbers digit-by-digit, and avoid slang.

Language access: use a telephone interpreter service for people with limited English, and never rely on a family member for interpreting in enforcement situations.

Documentation of communication: record what was said, by whom, and when - verbal warnings of trespass must be logged to be enforceable.

Customer service recovery: if you make an error, acknowledge it, correct it, and report it; concealment turns a minor error into a misconduct issue.

Deny access when: ID cannot be verified, the person is not on the authorised list, the pass is expired, or the person refuses the required check - record the refusal and reason.

Escort rule: visitors without a site pass must be escorted by their host at all times; guards do not leave unescorted visitors in restricted areas.

Vehicle access: check driver ID, rego against the booking, and inspect the load area where authorised; log entry and exit times.

Patrol frequency: follow the post orders; if not specified, vary routes and times so patterns cannot be predicted, and log every checkpoint.

Suspicious activity indicators: loitering near vehicles, testing door handles, looking at cameras, and carrying tools inconsistent with the site.

Alarm activation decision rule: treat every alarm as real until verified; check the exterior and perimeter first, and call Police if there are signs of forced entry.

Key control rule: no key leaves the site without a signed record; lost keys are reported immediately and the lock change is requested.

Handover rule: never leave post until the relief has signed the handover and read the log; report any gap to the supervisor.

Threat assessment: if a person is armed or violent, do not intervene physically - withdraw, call 111, observe from safety, and record descriptions.

Force decision rule: force must be necessary, reasonable, and proportionate to the threat; stop as soon as the threat is contained.

Arrest decision rule: only arrest for an offence committed in your presence or against the peace, deliver to Police as soon as practicable, and document the grounds.

Scene preservation: do not touch, move, or clean anything until Police authorise it; secure the area and record who entered.

Witness management: separate witnesses, record names and contact details, and take statements as soon as practicable without leading questions.

Emergency call content: location, what happened, how many people, injuries, weapons, and your name - stay on the line until told to hang up.

Lone worker rule: if a check-in is missed, the escalation plan is activated immediately - do not wait for the next scheduled check.

Post-incident rule: report to supervisor immediately, complete the incident report, and do not discuss with media or on social media.

Risk control hierarchy: eliminate, substitute, isolate, engineer, administrate, PPE - PPE is the last line of defence, not the first.

Hazard reporting rule: report any hazard you cannot control immediately to your supervisor and record it in the site hazard register.

Fatigue rule: do not start or continue a shift if impaired by fatigue, alcohol, drugs, or medication; report to your supervisor.

Manual handling rule: assess the load, keep it close to the body, bend knees, and use team lifts or equipment for heavy or awkward items.

Emergency equipment check: at the start of each shift, confirm the location and condition of extinguishers, first aid kits, defibrillators, and exits.

Near-miss rule: report all near misses - they are free lessons and must be recorded even when no one was hurt.

PPE rule: wear the PPE provided for the task and report damaged or missing equipment before starting work.

Wellbeing rule: after a critical incident, attend the debrief and use EAP or peer support; cumulative stress is a workplace hazard.

Contemporaneous notes rule: write notes at the time or as soon as practicable, and never alter original notes - corrections are dated additions.

Facts vs opinions rule: record what you saw, heard, and did; avoid conclusions such as 'suspicious' or 'aggressive' without describing the behaviour.

Description framework: person - sex, age, height, build, hair, clothing, features, direction; vehicle - rego, make, model, colour, damage.

Time rule: record times from a single reliable source (site clock or radio time) and note any offset with CCTV.

Chain of custody rule: every transfer of evidence is recorded with from/to, date/time, and reason; gaps weaken the evidence.

Footage rule: preserve originals, log access, and never edit or delete; export copies with a hash or verification record where available.

Report timing rule: submit the incident report within the site's required timeframe and before the end of shift where practicable.

Report review rule: check the report for names, times, and sequence before submitting; correct errors as dated amendments, not overwrites.

Certificate of Approval: must be current, carried at all times, and match the class of work; working without one is an offence under the Private Security Personnel and Private Investigators Act 2010.

Trespass Act 1980: warn a person to leave on behalf of the occupier; failing to leave after warning, or returning within 2 years after a trespass notice, is an offence.

Crimes Act 1961 citizens' arrest: limited to offences against the peace or a crime in your presence; deliver to Police as soon as practicable; force must be reasonable.

Privacy Act 2020: collect only necessary personal information for a lawful purpose, store securely, and retain only as long as needed.

HSWA 2015: PCBUs must eliminate or minimise risks so far as reasonably practicable; workers must follow lawful safety instructions and report hazards.

Scope rule: if a task needs a statutory power you do not hold (search, interview, seizure), stop and escalate to Police.

Force rule: force must be necessary, reasonable, and proportionate; stop when the threat is contained.

Confidentiality rule: do not disclose client operations, staff movements, access codes, or incident details without a need-to-know.

Integrity rule: refuse gifts, gratuities, or favours that could influence decisions, and declare any relationship with a person you are controlling access for.

Confidentiality rule: do not disclose client operations, staff movements, access codes, or incident details without a need-to-know, including on social media.

Presentation rule: correct uniform, visible ID/CoA, clean appearance, punctuality at handover, and completed site log before leaving post.

Negligence rule: failing to follow site procedures can create civil liability for you and your employer; follow post orders or report why you cannot.

Escalation rule: follow the chain of command - supervisor, then site controller, then Police - and document every escalation with time and outcome.

Scope rule: never investigate crimes reserved for Police; observe, report, and preserve evidence instead.

Reporting rule: report your own errors promptly; concealment turns a minor error into a misconduct issue.

Handover rule: never leave post until the relief has signed the handover and read the log; report any gap to the supervisor.

De-escalation sequence: calm tone and open body language, acknowledge the concern, state the rule, offer a choice, give time, then escalate.

Distance rule: keep at least 1.5 m distance, stay at an angle, keep hands visible, and never block the only exit route.

Language rule: use 'I' statements and neutral language rather than accusations; avoid arguing about facts in the moment.

Active listening rule: paraphrase the concern back, ask open questions, and confirm understanding before giving an instruction.

Radio rule: identify call sign, state location, then situation, then request; keep transmissions short and confirm receipt.

Stop rule: if a person is intoxicated, armed, or escalating physically, withdraw to a safe distance, call for backup/Police, and observe rather than confront.

Refusal rule: acknowledge the request, state the rule briefly, offer an alternative or escalation path, and thank the person.

Interpreter rule: use a telephone interpreter service for people with limited English; never rely on a family member in enforcement situations.

Priority rule: life safety first, then incident containment, then property protection; never risk your life to protect property.

Fire rule: raise the alarm, call 111, evacuate via the nearest safe exit, do not use lifts, and only use an extinguisher if trained and the fire is small with a clear escape route.

Medical rule: call 111, follow dispatcher instructions, do not move a casualty unless in danger, and record times of collapse, response, and handover.

Personal safety rule: maintain situational awareness, keep an exit route, avoid entering confined or dark areas alone, and use radio check-ins at agreed intervals.

Lone worker rule: scheduled check-ins, duress alarm, and a written escalation plan if a check-in is missed.

Incident management rule: secure the scene, preserve evidence, identify witnesses, record details, and brief Police/emergency services on arrival.

Force reporting rule: any physical intervention must be reported immediately to your supervisor and documented with time, reason, and force used.

Post-incident rule: complete an incident report, obtain medical attention if needed, attend the debrief, and do not discuss the incident with media or on social media.