Northline Protective Services: A Dashboard With No Targets and Three Different Truths

What the standard requires is a determination, not a data dump

Monitoring and measurement must be planned: what is monitored, the methods used, when it is done, who analyses and evaluates the results, and when. Northline's pack fails on most of these. Twelve indicators with month-on-month comparison and no target, threshold or owner produce commentary, not evaluation - nothing in the pack can be 'not met'.

Coverage is biased

Half the pack is financial, and the rest is predominantly lagging: incidents, complaints, collisions, absences. Lagging data tells you harm has already occurred. A security operation needs leading indicators that predict: training and drill completion, supervisor site visits, patrol and checkpoint compliance from telematics, alarm response time distribution, welfare and fatigue indicators, grievance closure timeliness, subcontractor audit results, and use-of-force reviews completed.

Data quality is the actual blocker

The 41-minute late arrival logged as three different times in three systems is the decisive fact. Without a single authoritative source, agreed definitions, timestamping from the dispatch system, and reconciliation rules, any response-time figure presented to an insurer is unreliable. Before publishing performance, Northline must: define 'response time' precisely (call receipt to arrival at the address, not dispatch to arrival); fix the control room log as the system of record; document how corrections are made and by whom; and test accuracy by sampling a month of calls against the log.

Instruments to add

Targets and thresholds tied to risk (with an amber/red trigger), a named owner per indicator, a defined reporting cadence, and an annual review of whether the indicator set still reflects the risks and objectives. The insurer's question is really: can you show a defined measure, a reliable data chain, and evidence of acting when the measure slipped?

Programme design

• Criteria and scope first: the audit programme should be planned against the SOMS requirements, the organisation's own procedures, and the risk assessment - not against a generic checklist. Each audit needs a defined scope, criteria, auditor and reporting line.
• Risk-based frequency: audit high-risk areas more often. The control room (dispatch, logging, escalation), armed or high-authority roles, incident investigation, grievance handling, subcontractor management and vetting should be audited at least annually, some twice. Low-risk administrative processes can be covered once in the cycle.
• Full coverage over the cycle: the programme must reach all clauses and all sites over time, so record a coverage map and check at year end that nothing was skipped.
• Timing around operations: avoid auditing the control room during peak Friday-night demand; observe the busy period as part of the audit rather than disrupting it.

Competence and independence

• The two operations managers cannot audit their own departments - that is both an independence failure and, in practice, a competence problem, since they will not challenge their own decisions.
• Options: train a small pool of auditors from other functions with formal competence records (training, shadowing, supervised audits); use a competent external auditor under the organisation's control; or combine both, keeping internal auditors for process audits and external for the control room and incident handling.
• Auditors need to understand security operations, not just management systems. An accountancy firm can audit document control; it cannot judge whether an escalation decision at 02:00 was sound.

Reporting and follow-up

Findings graded by significance, reported to the process owner and to management review, with corrective action tracked to verified closure. The programme itself should be reviewed annually for whether it detected the things that actually went wrong.

Why the current review produces nothing

Fourteen standing items in two hours guarantees presentation without analysis, and the single recorded action shows the meeting has no decision mandate. Review is not a briefing; it is where top management evaluates whether the system is still suitable, adequate and effective, and decides what changes.

Inputs to require

Status of actions from the previous review; changes in external and internal issues, including new contracts and new operating areas; interested-party feedback, especially grievances and community complaints; extent to which security objectives were met, with the indicator pack as pre-read; audit results; nonconformities and corrective action status; monitoring and measurement results including response-time distributions and use-of-force reviews; resource adequacy; and the effectiveness of risk treatment and opportunities. Human rights and community impacts should be an explicit standing input, not folded into 'incidents'.

Outputs to require

Decisions on improvement opportunities, changes needed to the system, and resource allocations - each with an owner and a date. Nothing else counts as an output.

Practical mechanics

• Circulate the pack five days ahead with thresholds marked red/amber; the meeting discusses exceptions only.
• Cap the agenda at five decision items plus one deep-dive topic (for example, control room performance this quarter).
• Minutes record decisions, owners, dates, and the risk accepted where a decision defers action.

The overtime indicator

Overtime is not a benign efficiency measure in a guarding business: it is a fatigue, turnover and error proxy. Cutting overtime can improve the number while degrading coverage and increasing response times. Treat the two together - overtime hours paired with patrol completion, response time and incidents - with a rule that any overtime reduction must be shown not to reduce posts or rest periods. Reading them separately invites exactly the wrong decision.