PNP-SOSIA Security Officer Exam cheat sheet

A private security officer's authority derives from the property owner or occupier (agency/delegated authority), from statute (citizen's arrest, licensed security officer powers), and from common law; it never exceeds the delegating party's rights.

Citizen's arrest power in most Canadian common-law provinces requires a reasonable belief that a person has committed an indictable offence and that the arrest is necessary to prevent escape or continuation; the officer must deliver the person to police without delay.

A security officer is not a peace officer unless specifically appointed (e.g., special constable, sworn officer); statutory search, detention, and use-of-force powers reserved to peace officers do not transfer automatically.

Detention is a deprivation of liberty (physical or psychological); it triggers the detained person's right to be informed of the reason and to retain and instruct counsel without delay under s. 10 of the Charter.

The use of force by a private citizen is limited to what is reasonable in the circumstances for self-defence, defence of property, or effecting a lawful arrest; proportionality and necessity are assessed objectively.

Trespass to property legislation permits an occupier or authorized agent to direct a person to leave and to use only as much force as is reasonable to remove a person who refuses to leave.

A security officer may be liable in tort for false imprisonment, assault, battery, and negligence; criminal liability may follow for assault, unlawful confinement, or manslaughter if force is excessive.

Solicitor-client privilege, confidentiality of incident reports, and privacy legislation (e.g., PIPEDA, provincial privacy acts) constrain what a security officer may collect, share, or disclose about individuals.

Assault is the intentional application of force to another person without consent, or an attempt or threat by act or gesture to apply force where the person has the present ability to effect the purpose; it does not require injury.

Aggravated assault requires wounding, maiming, disfiguring, or endangering life; sexual assault is any sexual contact without consent, and consent must be voluntary, informed, and ongoing.

Theft is the fraudulent taking of property without colour of right with intent to deprive the owner; robbery is theft with violence or threats of violence, and it is an indictable offence.

Break and enter requires breaking (actual or constructive, including opening a door) and entering a place with intent to commit an indictable offence; the intent element must be present at the time of entry.

Mischief is the wilful destruction, damage, or interference with property or data; the value of damage can affect the classification of the offence and the sentencing range.

Uttering threats, criminal harassment, and intimidation are person-directed offences commonly encountered by security officers; each requires proof of the prohibited conduct and the required mental state.

Possession of stolen property requires knowledge, control, and an intent to keep the property; mere proximity to stolen goods is not sufficient proof of possession.

For property offences, the officer's role is preservation of the scene, identification of witnesses, and documentation of facts; the officer does not determine guilt or charge the person.

A lawful arrest requires (1) actual or constructive detention, (2) notice of the arrest and the reason, (3) the officer's authority, and (4) the person's submission; failure to advise of the reason can render the arrest unlawful.

A search incidental to a lawful arrest is permitted only for officer safety, preservation of evidence, and to prevent escape; it must be contemporaneous and confined to the person and the immediate area of control.

A warrantless search is presumptively unreasonable under s. 8 of the Charter; the party seeking to justify it must show it falls within a recognized exception (consent, incident to arrest, exigent circumstances, plain view).

Consent to search must be voluntary, informed (the person must know they may refuse), and given by a person with authority over the place or item searched; consent can be withdrawn at any time.

The plain view doctrine permits seizure of items whose incriminating character is immediately apparent, where the officer is lawfully present and the discovery is inadvertent.

Evidence obtained in violation of the Charter may be excluded under s. 24(2) if its admission would bring the administration of justice into disrepute, considering the seriousness of the breach and the impact on the accused.

Chain of custody documentation must record every person who handled the item, the time and date of each transfer, and the storage location; breaks in the chain can affect the weight of the evidence.

Hearsay is an out-of-court statement offered for its truth and is generally inadmissible unless it falls within an exception (e.g., business records, dying declarations, present sense impressions).

The force used must be objectively reasonable, necessary, and proportionate to the threat; the officer's subjective belief is relevant but not determinative, and the standard is judged from the perspective of a reasonable officer in the same circumstances.

The use-of-force continuum typically progresses from presence, verbal direction, soft empty-hand control, hard empty-hand control, intermediate weapons (OC spray, baton, conducted energy weapon), to lethal force; each level must be justified by the threat.

Pre-assault indicators include clenching fists, blading the body, target glancing, verbal threats, and rapid changes in breathing or skin colour; recognizing them allows earlier de-escalation or tactical repositioning.

Defensive tactics must include a plan for disengagement and repositioning; distance, cover, and time are force multipliers that reduce the need for physical control.

After any use of force, the officer must provide or seek medical aid, monitor the subject, and document the force used, the reason, and the subject's condition and statements.

Conducted energy weapons and OC spray are intermediate weapons with specific deployment criteria and post-deployment medical monitoring obligations (e.g., removal from prone position, breathing assessment).

Positional asphyxia risk increases when a subject is restrained prone with weight on the back or neck; the subject must be moved to a recovery position as soon as control is achieved.

Defensive tactics training must be documented and current; an officer who uses force outside their training or certification may face increased liability.

Layered defence (defence in depth) places concentric controls: perimeter, building envelope, interior zones, and high-security assets, so that a failure of one layer does not compromise the asset.

The four Ds of physical security are deter, detect, delay, and deny (or respond); each control should be mapped to at least one of these functions.

Access control principles include least privilege, need-to-know, separation of duties, and the two-person rule for high-value or high-risk areas.

Authentication factors are something you know (PIN), something you have (card, token), something you are (biometrics); multi-factor authentication combines two or more independent factors.

A mantrap or interlocking door prevents tailgating by admitting one person at a time; anti-passback prevents a credential from being used twice without an intervening exit.

Perimeter intrusion detection includes fence sensors, buried cable, microwave barriers, and infrared beams; each has different nuisance-alarm and detection characteristics.

CPTED (Crime Prevention Through Environmental Design) uses natural surveillance, natural access control, territorial reinforcement, and maintenance to reduce opportunity for crime.

Lighting standards for security typically require minimum illumination levels at entrances, parking areas, and pathways; inadequate lighting is a common negligence allegation after an incident.

Alarm systems should be monitored, tested on a schedule, and have a documented response protocol; a silent alarm is used where audible alarms would endanger responders or the public.

Screening is a search; the legal authority must come from consent (implied by the conditions of entry), statute, or a warrant; the scope of the search must match the authority.

X-ray screening identifies organic versus inorganic materials by colour and density; operators must be trained to recognize threat items such as weapons, explosives, and prohibited items.

Walk-through metal detectors use pulsed electromagnetic fields; sensitivity settings and proper calibration affect false alarm rates and detection capability.

Hand-held metal detectors supplement walk-through units; the wand should be passed slowly and close to the body, with the operator avoiding contact unless a secondary search is authorized.

Explosive trace detection (ETD) uses swabs and ion mobility spectrometry; positive results require confirmation and escalation under the site's protocol.

Contraband categories commonly include weapons, drugs, alcohol, explosives, and prohibited electronic devices; the definition depends on the site's rules and applicable law.

Pat-down searches must be conducted by a person of the same gender where practicable, with a witness present, and with a clear explanation of the procedure to the person being searched.

Screening records should capture the time, location, screener, method, result, and any items seized or refused; these records are discoverable in litigation.

The fire tetrahedron requires fuel, oxygen, heat, and a chemical chain reaction; removing any one element extinguishes the fire.

Fire classes: A (ordinary combustibles, water), B (flammable liquids, foam/CO2/dry chemical), C (electrical, CO2/dry chemical), D (combustible metals, special agents), K (cooking oils, wet chemical).

PASS for extinguisher use: Pull the pin, Aim at the base of the fire, Squeeze the handle, Sweep side to side; only use an extinguisher on a small, contained fire with a clear escape route.

RACE for fire response: Remove people from danger, Alert (pull alarm/call 911), Contain (close doors), Evacuate or Extinguish if safe.

Adult CPR: 30 compressions to 2 breaths at 100-120 compressions per minute, depth 5-6 cm (2-2.4 inches); for children use one or two hands and for infants two fingers, with a ratio of 30:2 for single rescuers.

AED use: turn on, follow prompts, apply pads to bare chest, ensure no one is touching the patient during analysis and shock, and resume CPR immediately after the shock.

Choking: for a conscious adult, give five back blows and five abdominal thrusts (Heimlich); for an unconscious person, begin CPR and check the mouth for visible objects.

For severe bleeding, apply direct pressure, then a tourniquet if bleeding is life-threatening and direct pressure fails; note the time of application and do not loosen it.

Emergency evacuation must account for persons with disabilities, use designated assembly areas, and include a head count and accountability report to the fire department.

A report should answer who, what, when, where, why, and how, and should record only facts observed or reported, not opinions, conclusions, or speculation.

Notes should be made contemporaneously or as soon as practicable; the original notes are discoverable and should not be destroyed after a formal report is written.

Reports should be written in plain language, in chronological order, with times, locations, names, and badge numbers of all persons involved.

Evidence handling requires unique item numbers, description, location found, collector's name, date and time, and a chain-of-custody log for every transfer.

Digital evidence (CCTV, access control logs) must be preserved in native format with hash values where possible; a working copy should be used for review and the original preserved.

Photographs of a scene should include overall, mid-range, and close-up shots, with a scale where relevant, and a photo log linking each image to its location.

Reports may be used in criminal, civil, and regulatory proceedings; the officer should assume every report will be read in court and cross-examined.

Corrections to a report should be made by addendum or supplementary report, never by altering the original; the original version must be retained.

Crowd dynamics include crowd crush, stampede, and contagion; density above roughly 4-5 persons per square metre significantly increases the risk of compressive asphyxia.

De-escalation techniques include active listening, lowering voice volume and pitch, slowing movements, maintaining a safe distance, and offering choices within limits.

The behavioural influence stairway model (verbal escalation continuum) progresses from anxiety, defensive, verbal aggression, physical aggression, to destruction; interventions should match the level observed.

Public order policing distinguishes lawful assembly from unlawful assembly and riot; the Charter protects peaceful assembly, and any dispersal order must be lawful, necessary, and clearly communicated.

When giving a dispersal order, use multiple channels (PA, verbal, visual), allow a reasonable time and route to comply, and document the warning given.

Positional asphyxia and crowd crush are the leading causes of death at mass gatherings; event planning must include capacity limits, exit widths, and crowd-flow modelling.

Conflict resolution approaches include avoidance, accommodation, competition, compromise, and collaboration; collaboration is preferred where the relationship is ongoing and time permits.

Use of force in a crowd setting must be individually justified; indiscriminate use of force against a crowd is unlawful and escalates rather than resolves conflict.

Core ethical values for security officers include integrity, honesty, fairness, respect for persons, accountability, and confidentiality.

The Charter of Rights and Freedoms applies to government action; private security officers performing public functions or acting under statutory authority may be subject to Charter scrutiny.

Human rights legislation prohibits discrimination on enumerated grounds (race, sex, disability, religion, age, etc.) in employment and in the provision of services.

The use of force must be non-discriminatory; disproportionate force against persons based on race, mental health, or perceived threat is both unlawful and unethical.

Conflicts of interest must be disclosed and avoided; accepting gifts, gratuities, or favours that could influence decisions is prohibited by most codes of conduct.

Confidentiality obligations continue after employment ends; personal information must be collected, used, and disclosed only for the purpose for which it was collected, unless consent or law permits otherwise.

Use of force reporting must be honest and complete; falsifying a report or omitting material facts is a serious misconduct and may constitute a criminal offence.

Duty to act: a security officer who creates a risk or has a special relationship with a person must take reasonable steps to prevent harm; failure can result in negligence liability.

CCTV systems should be designed with defined coverage zones, camera placement to capture identification-quality images (typically 40-80 pixels per foot at the target), and appropriate lighting.

Video retention periods should be set by policy and legal requirements; footage must be preserved when an incident is reported, and access should be logged and restricted.

Privacy laws require notice of surveillance, limits on the collection of personal information, and restrictions on the use of cameras in private areas such as washrooms and change rooms.

Access control systems log credential use, door status, and alarms; these logs are key evidence and must be time-synchronized across systems.

Radio communication protocols include clear speech, standard phonetic alphabet, prowords (e.g., "over," "out," "roger"), and channel discipline; sensitive information should not be broadcast in the clear.

Two-way radio coverage should be tested in all areas, including stairwells, basements, and parking structures; dead zones must be identified and mitigated.

Alarm monitoring should include a documented response protocol, false alarm reduction measures, and a call list that is current and tested.

Cybersecurity for physical security systems includes changing default passwords, network segmentation, firmware updates, and vendor access controls.