Sahel Static Guarding: Turning a Property Loss Register into a Planning Basis

What the scope must do

The scope is a boundary statement, not a brochure line. It must let a reader tell which activities, locations and interfaces are inside the system and which are outside, and it must be consistent with what the organisation actually does.

Elements to include and why

• Services: manned guarding, alarm response (including monitoring and dispatch), and reception/front-of-house control. 'Provision of guarding services' excludes alarm response, which is a real activity with its own response-time risk and subcontractor interfaces.
• Sites and geography: the named city and the categories of site, since embassy work carries different threat and client requirements from residential compounds. A single-site or single-category scope would mislead about coverage.
• Organisational boundary: head office functions (recruitment, vetting, training, discipline), the control room, and supervisory layers - these are where most controls actually live.
• Outsourced processes: any monitoring centre, transport or cash-in-transit partner whose failure would affect the services. Outsourcing a process does not remove it from the system.
• Interfaces with client systems: client CCTV, access control and alarm infrastructure, together with a clear statement of who controls what, prevents later disputes about where Sahel's responsibility starts.

What must be justified

Any exclusion has to be defensible and must not mislead clients or regulators. Excluding a service Sahel actively sells, or a site it staffs, would undermine the scope's credibility and, if discovered at certification, become a finding about the integrity of the management system itself. The scope must also be traceable to the context analysis and interested-party requirements, and be maintained as documented information so that new contracts trigger a scope review rather than being quietly absorbed.

Why the current register cannot simply be extended

The insurer register is backward-looking, property-focused and filtered by what generates claims. A security risk assessment must be forward-looking and must include severity to people, because the events that most endanger a guarding company - excessive force, unlawful detention, harassment or extortion at a gate - typically produce no property loss and often no claim.

A workable method

1. Identify what is being protected and who is exposed: assets, people (guards, client staff, visitors, residents, bystanders) and activities (patrols, gate control, alarm response, key handling).
2. Threat assessment: local crime data, client intelligence, past incidents - including the six events listed and what they reveal about repeat mechanisms rather than one-off causes.
3. Vulnerability assessment: the 34% turnover and 14-month average tenure are structural vulnerabilities: weak site knowledge, thin supervision ratios, inconsistent drills. So is slow response at the mall fire.
4. Consequence and severity: assess impact on safety and rights separately from financial and reputational impact, then combine. A guard arrested for theft and an assault on a guard should not be scored on the same scale without acknowledging different harm.
5. Risk criteria and treatment: define acceptance thresholds, then choose controls (supervision frequency, two-person cash or key rules, response-time standards, de-escalation training, vetting depth).
6. Legal and other requirements: licensing, labour law, working hours, use-of-force limits, client contracts and embassy security standards must be identified as obligations feeding the assessment.

Opportunities from the same analysis

Turnover reduction as a retention programme; standardised alarm response protocols and dispatch logging; site-specific post instructions instead of one generic order; technology that reduces lone working; and a contract clause template that prices supervision rather than treating it as overhead.

Three objectives that are actually auditable

1. Response performance: reduce median alarm response time at bank and embassy sites from the current measured baseline (to be established in month 1) to under 12 minutes by the end of Q3; owner: Head of Operations; measure: dispatch-to-arrival timestamp from the control room log, reported monthly with outliers reviewed individually.
2. Guard safety: reduce recorded assaults on guards from 2 per year to 1 or fewer, and achieve 100% of post-incident welfare and investigation reviews within 5 working days; owner: HR Director with the Security Manager; measure: incident register plus investigation closure log.
3. Stability of the workforce: reduce annual guard turnover from 34% to 24% and raise average tenure to 20 months within 12 months; owner: HR Director; measure: monthly payroll attrition with exit-reason coding.

Each objective must state what will be done, what resources are needed, who is accountable, when it is achieved, and how results are evaluated - otherwise it is a slogan with a number attached.

Handling the 8% target honestly

The cost target is a constraint, not a security objective. The reasoning to put to management is that turnover and supervision are the drivers of the incident pattern, so cutting posts, training days or supervisor visits to reach 8% would push the other objectives backwards and raise total risk. The defensible route is to find the 8% in non-security-value areas first (procurement, rostering efficiency, overtime control, site profitability review), and to treat any proposed reduction in security staffing or training as a decision requiring explicit risk acceptance. If after that the 8% cannot be met without eroding controls, that conflict should be recorded as a risk decision by top management - not absorbed silently into the objectives, which would make the whole planning process decorative.