Security risk assessment: a UK guide and template for business premises
A security risk assessment is a written review of what could harm your business premises, people and assets, how likely and how serious each risk is, and what you will do about it. List your assets, identify the threats, walk the site from the outside in by day and after dark, score each risk for likelihood and impact from 1 to 5, rank the results, choose measures that deter, detect, delay, respond and mitigate, give each action an owner and a date, and review the assessment at least once a year or after any incident or change.
Last updated 2 November 2026. A security risk assessment is a written look at your business premises from the point of view of someone who wants to steal from it, damage it, set fire to it or harm the people in it. It asks what you need to protect, who or what threatens it, how exposed it is, and what you are going to do about it, and it gives every action an owner and a date. Done well, it is one of the cheapest pieces of security work a business can do, because it tells you where to spend and, just as usefully, where not to.
Most businesses already do a version of this in their heads. The owner knows the back gate is weak, that the diesel tank is in view of the road, that the bins are kept against the wall and that the cameras do not really see the yard at night. The problem is that nobody has written it down, scored it, compared it with the other risks or decided who fixes it. When something does happen, the gap that let it happen was usually known about.
This guide is for owners, site and facilities managers, office managers, operations leads and anyone asked to "do a security risk assessment" for an industrial unit, yard, depot, warehouse, shop, trade counter, office or business park in the UK. It explains what a security risk assessment is and how it differs from a health and safety or fire risk assessment, who may ask to see one, and where Martyn's Law fits in. It sets out what the latest crime figures say about business premises, and what seven real incidents from 2026 had in common. Then it walks through a practical method based on the National Protective Security Authority (NPSA) approach and HSE's five steps: deciding the scope, listing assets, naming threats, walking the site from the outside in, scoring likelihood and impact, plotting a five-by-five risk matrix, choosing measures that deter, detect, delay and respond, and setting review dates.
You will also find a security risk assessment template you can copy into a spreadsheet or document, a worked example, a checklist for each area of a site, notes on insider risk, information and cyber risk, fire and arson, vehicles and fuel, and how to write a proper operational requirement before you buy cameras or alarms. The last sections look at where AI people, vehicle, smoke and flame detection on the cameras you already have can fit into the actions that come out of your assessment.
It is general guidance, not legal, insurance or professional security advice. Higher-risk sites, and premises in scope of the Terrorism (Protection of Premises) Act 2025, may need specialist help, so check with your insurer, your local police crime prevention team or a qualified security consultant before you make decisions about your own premises.
What a security risk assessment is
At its simplest, a security risk assessment is a structured way of deciding which deliberate harms matter most at your site and what you will do about them. The NPSA, the UK government's authority for protective security, describes the starting point as working out what you need to protect, then the threats to it, then how likely each threat is to happen and how much harm it would do. Everything else, from the cameras you buy to the time the gate is locked, should follow from that.
Four words do most of the work, and it helps to use them the same way every time.
- Asset: anything of value that you need to protect. People come first: staff, visitors, contractors and the public. Then the things: buildings, stock, vehicles, plant, tools, fuel, cash, keys, customer and staff data, the systems that run the business, and less obvious things such as your reputation or a customer contract that depends on you delivering on time.
- Threat: someone or something that could cause harm. NPSA guidance describes a threat as the combination of a hostile actor's intent and their capability. A thief who wants your copper cable and has a van and bolt croppers is a threat. Someone who would like to but has no way in is a much smaller one.
- Vulnerability: a weakness a threat could use. A gate with a single chain, a camera that sees only glare at night, a fire door left wedged open, keys on a hook by the door, a shared login, a pile of pallets against a wall.
- Risk: the combination of how likely a harmful event is and how bad its impact would be. The NPSA guidance scores both on a simple relative scale, so that very different risks can be compared and put in order.
The point of the exercise is not to remove every risk. That is impossible on any real site. It is to decide which risks you will accept, which you will reduce, and which are serious enough that you will spend money or change the way you work. The NPSA calls this aligning risks to your risk appetite: how much risk the business is prepared to carry. A builders' merchant with open yards and a hundred visitors an hour will accept risks that a data centre would not.
A useful assessment is also honest about what you already do. Most sites have some measures in place: locks, a fence, an alarm, cameras, a routine for locking up. Part of the job is checking whether those measures actually work, at night, in the rain, at weekends and when the usual person is on holiday. A camera that was installed to watch the gate but now sees a tree is not a measure; it is a vulnerability that feels like a measure.
How it differs from health and safety and fire risk assessments
Three kinds of risk assessment are often mixed up, and many businesses have one or two of them but not the third.
A health and safety risk assessment looks at hazards that could harm people at work. HSE sets out five steps: identify the hazards, assess the risks, control the risks, record your findings and review the controls. If you have five or more employees you must record the significant findings. HSE explains that controls should be "reasonably practicable", which means balancing the level of risk against the money, time or trouble needed to control it. If you need help with this one, our health and safety risk assessment tool is built for it.
A fire risk assessment looks at fire hazards, the people at risk, the means of escape and the fire precautions in the building. It is covered by separate fire safety law and guidance, and many sites already have one in a folder somewhere.
A security risk assessment looks at deliberate harm: theft, burglary, criminal damage, arson, violence and threats against staff, fraud, insider activity and, for some premises, terrorism. It uses the same basic logic as the other two, but the "hazard" is a person who is trying to beat your measures, which changes how you think about it. A trip hazard does not watch you lock up; a thief might.
The overlaps matter. Violence and aggression towards staff is a health and safety risk, and HSE is clear that employers must assess the risk of work-related violence, consult workers and put controls in place. Deliberate fire is both a fire risk and a security risk, and the measures to stop it, such as keeping bins and pallets away from buildings, belong in both documents. Lone working late at night or opening up early in the morning appears in all three. A single site walk can feed all of them, and it is worth cross-referencing so the actions do not contradict each other.
Who needs a security risk assessment
Any business with premises, stock, vehicles, staff or data worth protecting benefits from one, which in practice is every business with a site. Whether you are formally required to have a written security risk assessment depends on what you do, who insures you and, from 2027, how many people can be on your premises at once.
Insurers set security conditions on many commercial policies, from the grade of intruder alarm to locks, lighting and how stock is kept. They base their terms on the information you give them about the risk, so a current assessment helps you answer their questions accurately and spot conditions you may already be breaking. Read the security section of your policy schedule alongside your assessment.
Alarm installers are required to carry out a formal risk assessment to decide a suitable grade and design for an intruder alarm, according to insurer risk management guidance on the European alarm standards, and they must record it before designing the system. If your installer has never asked you about your risks, ask them why. Our business alarm systems guide covers grades, signalling and police response in detail.
Employers must assess the risk of violence and aggression to their workers as part of their health and safety duties. In shops, trade counters, hospitality, cash handling, lone working and late-night roles, this is often the most important security risk on the site.
Some premises and events will be in scope of Martyn's Law, the Terrorism (Protection of Premises) Act 2025, once it comes into force. The next section covers what that means.
Anyone using CCTV needs to be able to explain why each camera is there and what it records under data protection law. A security risk assessment is a natural place to record the purpose of each camera, which helps with the privacy side too.
Planning and new buildings are another route in. The police Secured by Design scheme, which publishes crime prevention guidance for commercial developments, recommends that an operational requirement for CCTV is drawn up before any system goes out to tender, and much of what it asks for is the output of a security risk assessment: what the cameras must see, why, and what happens when they see it.
Martyn's Law and security risk assessments
The Terrorism (Protection of Premises) Act 2025, known as Martyn's Law, received Royal Assent on 3 April 2025. The Home Office expects an implementation period of at least 24 months, and the Security Industry Authority (SIA), which will regulate it, expects the Act to come into force in spring 2027. There is no legal requirement to comply until then, but in April 2026 the Home Office published the section 27 statutory guidance, so the requirements are now clear enough to plan for.
Whether your premises are in scope depends mainly on numbers. Premises are likely to be in scope if they include a building, are wholly or mainly used for one of the purposes listed in the Act, and 200 or more people, including staff, can reasonably be expected to be there at the same time from time to time. Some premises are excluded. Between 200 and 799 people puts premises in the standard tier. 800 or more usually puts them in the enhanced tier, and some large public events with entry checks also qualify.
For standard tier premises, the duties are to notify the SIA who is responsible for the premises once the law is in force, and to have, so far as is reasonably practicable, appropriate public protection procedures to reduce the risk of physical harm if an attack happened there or nearby. The Home Office factsheet is explicit that the Act does not require physical alterations to premises or the purchase of equipment to put those procedures in place.
For enhanced tier premises and qualifying events, there is more. As well as the procedures, the responsible person must have appropriate public protection measures, document the procedures and measures, assess how they reduce risk and vulnerability, and send that document to the SIA. Organisations must name a senior individual responsible for compliance. The four measures cover monitoring of the premises and the immediate vicinity, for example with CCTV; the movement of people into, out of and within the premises; physical security; and keeping information about the premises' layout and operation from people who might use it to plan an attack.
For most industrial units, yards, depots and small offices, Martyn's Law will not apply, because they will rarely have 200 people on site at once. Large retail units, venues, leisure sites, places of worship, education buildings and some workplaces with public areas may well be in scope. If yours is, the security risk assessment described in this guide is a sensible foundation, but follow the Home Office and SIA guidance for the specific duties, and use the SIA's own templates when they are published. This guide does not cover the counter-terrorism side in depth.
Even where Martyn's Law does not apply, the four procedures are worth a line in your assessment. Every site should know how it would get people out, where people would shelter inside, how it would lock the doors quickly, and how it would tell everyone what is happening. Those plans help with far more likely events too, such as an aggressive intruder, a fire next door or a gas leak.
What the crime figures say about business premises
The best national picture of crime against businesses in England and Wales comes from the Home Office Commercial Victimisation Survey (CVS). The 2023 survey found that 26% of business premises, about 409,000, had been a victim of at least one crime covered by the survey in the previous year. Theft was the most common type, at 14% of premises. 8% had a burglary, including attempts, 8% had vandalism and 7% had assaults or threats. Premises in wholesale and retail were hit hardest, with 41% experiencing crime.
Size and public access make a difference. 42% of medium-sized premises and 39% of large premises were victims of crime, against 24% of small ones. Premises open to the public were more likely to be victims than those that were not, at 29% compared with 20%. A site with more people, more stock and more ways in has more for an offender to aim at, which is exactly what a risk assessment tries to capture.
The cost is not only what is taken. Half of victims suffered a direct financial loss and almost half lost staff time dealing with the crime. 41% had goods stolen. 9% said the crime had a severe financial impact, to the point of considering closing the business. Theft by an employee was reported at about 1% of premises, which is low, but insider harm can be hard to see, so it still deserves a line in your assessment.
Two other findings shape how a risk assessment should work. First, repeat victimisation is common: 45% of business victims had a single incident, so more than half had more than one. Among burglary victims, 64% were burgled only once in the year, which also means around a third were burgled again. Second, a lot of crime is never reported: 55% of premises hit by crime reported at least one incident to the police, and of those that did not, more than half said it was too trivial. If your own records rely only on police reports, they will understate what is going on. Ask staff, look at near misses and keep your own incident log.
Cyber risk is part of the picture too. 9% of premises with a computer experienced computer misuse in the survey year, The most common type was staff receiving fraudulent emails, at 7%, followed by hacking and computer viruses at 2% each. Information and systems are assets, and a security risk assessment that ignores them is only half done.
Police recorded crime adds a more recent view. In the year ending June 2026, the Office for National Statistics reported 519,516 shoplifting offences in England and Wales, down 2% on the previous year, and 88,282 robbery offences, up 10%, a rise it linked mainly to the recording of robbery of business property. The ONS notes that reporting rates for shoplifting are known to be very low and that police are actively encouraging businesses to report all incidents and submit supporting evidence, such as CCTV. Recorded figures depend on reporting, but the direction is useful context for shops, trade counters and anyone handling stock in front of the public.
Seven 2026 incidents and the questions they raise
National figures tell you how common crime is. Real incidents tell you how it happens. These seven were reported by police forces and local news in 2026. We have left out the names of the businesses involved. In each case, it is worth asking what a security risk assessment of that site might have spotted beforehand.
Hartlepool, April. At about 11.45pm on Easter Monday, 6 April, ten vehicles were set alight on a compound on the Longhill Industrial Estate, according to Cleveland Police. A vehicle compound concentrates a lot of value, and a lot of fuel, in one place. Questions for an assessment: could someone reach the vehicles without being seen, how far apart are they parked, and would anyone know there was a fire before it spread from the first vehicle to the tenth?
Melsonby, March. Diesel was stolen from plant machinery kept in a private yard near the village, Richmondshire Today reported. About three quarters of the fuel was taken between 16 and 26 March, and the thieves came back between 26 and 31 March for the rest. Questions: how often is plant checked when it is not in use, and would a first visit be noticed in time to stop a second?
Harrogate, April. Between 4pm on Friday 10 April and 7am on Monday 13 April, more than a thousand litres of diesel were stolen from several vehicles at a building site on Kingsley Drive, the Harrogate Advertiser reported. A whole weekend gave the offenders plenty of time. Questions: what watches a site from Friday evening to Monday morning, and who would be told?
St Helens, May. At about 9.45pm on 26 May, a bin shed and a warehouse at a business site on Bold Road were on fire, Merseyside Police reported. Both fires were believed to have been started deliberately. The smaller fire, in the bin shed, was put out with an extinguisher. Questions: what is stored near the building that would burn, and how quickly would anyone see a fire starting outside in the evening?
Swindon, June. Overnight on 9 to 10 June, offenders entered an estate in Thornhill after cutting the lock on the gate, drove in with a lorry and took about two tonnes of copper wiring from the walls of two warehouses, Swindon Link reported. At about 9pm on 9 June, a person pushed down cameras at a neighbouring property. Questions: how strong is the gate, could a large vehicle get in and out unseen, and would anyone notice if a camera stopped working the evening before?
East Boldon, September. A restaurant on East Station Approach was broken into between 12.30am and 2am on Monday 21 September, ChronicleLive reported. Glass was smashed, spirits and wine were taken and the alarm system was damaged. CCTV caught masked thieves. It was the second break-in at the restaurant that year, after one in March. Questions: what changed after the first break-in, and was the alarm itself protected?
Cheltenham, September. At about 9.20pm on Tuesday 15 September, a fire was deliberately started in a large bin placed against two commercial units on a trade park off Upperfield Road, Gloucestershire Constabulary said. Both buildings were damaged. Nobody was hurt. Police said a man had been seen on CCTV acting suspiciously near the units between 6.15pm and 6.30pm, and may have entered other premises earlier that day. Questions: where are the bins kept, could they be moved against the building, and was anyone watching the cameras earlier in the evening?
The common threads are clear. Almost all of these happened out of hours. Almost all started outside the building: at a gate, in a yard, at a bin, at a vehicle. Several involved a second visit or someone looking around first. And each turned on a weakness that a careful walk round the site could have found: a single lock on a gate, bins against a wall, fuel in reach, a camera that could be pushed over. That is the case for writing a security risk assessment: not because it prevents everything, but because it makes you look for the gaps before someone else does.
How to do a security risk assessment, step by step
There is no single official format for a security risk assessment. The NPSA says its protective security risk management model sets out key steps rather than a specific format, and that organisations will have their own preferred way of calculating risk. What matters is that the method is clear, that you use it the same way each time and that it ends in actions. The method below follows the NPSA cycle and HSE's five steps, adapted for an ordinary business site, and it works for a single unit or a large estate.
The NPSA cycle has eight steps: identify assets and systems; categorise and classify them; identify threats; assess the risk; build a risk register; set a protective security strategy; develop and implement measures; and review. HSE's steps for health and safety risk are shorter: identify the hazards, assess the risks, control them, record the findings and review. They are the same shape. The extra NPSA steps exist because security measures are often expensive and can easily be bought before anyone has decided what they are for.
Step 1: set the scope and bring the right people in
Start by writing down what the assessment covers. Name the site, the address and the boundary. Say whether it covers the whole site or only part of it, and whether it includes things like vehicles parked off site, a second store or staff who work alone at customer sites. Note the date, the people involved and the date of the next review. A single sentence of scope prevents a lot of confusion later.
Decide who will help. The NPSA's operational requirements guidance says the process can be followed by one person, but that a stakeholder workshop is usually more effective, because it brings in a wider range of ideas and gets people to back the outcome. Its suggested attendees include the security manager, facilities and operations managers, human resources, the health and safety lead, a budget holder and, for larger sites, the local Counter-Terrorism Security Adviser. On a small site, that might simply be the owner, the person who opens up, the person who locks up and whoever deals with the alarm company.
Include the people who are actually there out of hours. The cleaner who finishes at 21:00, the driver who leaves the yard at 05:30 and the supervisor who gets the call when the alarm goes off at 02:00 all know things the managers do not. Ask them where they feel unsafe, what they have seen and what they would fix first. HSE recommends asking workers about their experiences when assessing the risk of violence, and the same approach works for security as a whole.
Step 2: list your assets and decide which are critical
Make a list of everything on the site that matters. The NPSA describes assets as including physical items, data in any format, people with specific knowledge or skills, and crowded places. For a typical business site, that means six groups: people; buildings and structures; goods, stock, tools and materials; vehicles, plant and fuel; information and systems; and operations, meaning the orders, deliveries and contracts that depend on the site working.
Then rank them. The NPSA suggests categorising assets by how critical they are to the business, based on the harm their loss would cause to you and to others. A simple three-level scale works well: critical, where loss would stop the business or put someone in danger; important, where loss would be costly and slow to recover from; and useful, where loss would be a nuisance but quickly put right. Write the reason next to each one. A refrigerated trailer full of a customer's stock is critical for a haulier in a way that a spare pallet of bricks is not.
Do not forget the less obvious assets. Keys and fobs, alarm codes, the router and the camera recorder, the server cupboard, the till, the safe, the boxes of customer paperwork in the back office, the diesel in the plant, the copper in the walls and the company van that someone takes home are all assets. The NPSA also reminds organisations that people with specific knowledge or skills are assets in their own right, which matters for insider risk and for lone working.
Step 3: identify the threats
For each asset, ask who or what could harm it. The NPSA describes a threat as combining intent and capability: someone who wants to cause harm and is able to. Think about what an offender would gain, how they would get there, what tools they would need and how long they would have. For most business sites, the main threats are theft and burglary, criminal damage, arson, violence or threats against staff, insider misuse of access, and cyber attack or fraud.
Use real information rather than guesswork. The NPSA lists sources of threat information including your own organisational knowledge, the police, NPSA and the National Cyber Security Centre, partner organisations and peer groups. In practice, that means your own incident log and near misses; what has happened to your neighbours, on the same estate or in the same street; police appeals and local news for your area; your insurer's risk surveys; your trade association; and national guidance. If three units on your estate have had their diesel tanks drained this year, the likelihood of it happening to yours is not low.
Be specific. "Theft" is not a useful threat on a register. "Theft of diesel from the plant parked in the rear yard overnight, by people arriving on foot over the rear fence" is, because it tells you where to look for vulnerabilities and what a measure would need to do. The NPSA's role-based guidance makes the same point: risks need enough detail to develop appropriate measures.
Step 4: walk the site from the outside in
Now look for vulnerabilities. The NPSA's operational requirements guidance recommends splitting a site into five areas: beyond the perimeter, the perimeter, within the site, the building, and the asset itself. Walking through them in that order, from the outside in, is the most useful thing you will do in the whole assessment. It shows you the site the way an offender sees it, and it helps you spot the places where you could detect someone early, before they reach anything that matters.
For some sites, the areas need adjusting. The NPSA notes that where the public have access to a building, the "perimeter" may be the internal boundary between public and staff-only areas, as in a shop, a trade counter or a reception. Write down what you mean by each area so that everyone uses the same definitions.
Walk the site at least twice: once in daylight and once after dark, ideally on a weekday night when the site is shut. In daylight, check fences, gates, locks, doors, windows, roofs, drainpipes, stock, keys and the condition of everything. After dark, check what is lit and what is not, where the shadows fall, whether lights dazzle the cameras or leave the gate in darkness, and what you can see from the road. Then look through each camera, on the recorder or the app, and compare what it shows with what you thought it covered. Take photographs and note the time of each finding.
Step 5: score each risk for likelihood and impact
Now put a number on each risk. The NPSA's role-based guidance recommends a relative scale from 1, least likely, to 5, most likely, for likelihood, and the same 1 to 5 scale for impact, from lowest to greatest. "Relative" matters. The scores are there to put your own risks in order, not to compare your site with someone else's.
When deciding likelihood, the NPSA suggests asking whether you are a realistic target, whether others in your sector have been hit, what your security culture is like, how well existing measures deter, detect and help you recover, whether offenders would have the ability, and whether they would have access. On a typical business site, precedent and access usually decide it. If the units either side have lost diesel this year and your plant sits beside a low fence, likelihood is high.
For impact, the NPSA lists factors such as how many sites would be affected and how important they are, whether anyone could be hurt, the financial loss, the effect on reputation, how long it would take to get back to normal, and whether your contingency plans are good enough. Think about the knock-on effects, not just the replacement cost. A stolen van costs money; a stolen van holding tomorrow's tools and stock costs a day's work for a team and maybe a customer.
Write down why you gave each score. The NPSA stresses that recording your assumptions gives continuity, makes reviews easier and stops knowledge being lost when people leave. "Likelihood 4: two diesel thefts on this estate since March, rear fence is 1.8 m chain-link, plant parked against it" is a reason that someone can check next year. "Likelihood 4" on its own is not.
Step 6: rank the risks on a matrix
Multiply likelihood by impact to get a score from 1 to 25, then plot each risk on a 5×5 grid. The NPSA suggests plotting each risk, looking for outliers that might need their scores rechecking, noticing natural groups, and then dividing the grid into priorities such as very high, high, medium and low, or Priority 1 to 4. The bands in the matrix below are an example; choose your own and use them consistently.
Do not let the arithmetic hide what matters. The NPSA recommends that very high-impact risks are among your top priorities, whatever their likelihood. A fire that destroys the building may be unlikely, but if it would end the business, it belongs near the top. A low-impact nuisance that happens every week may deserve action too, simply because it wears staff down and costs time.
Step 7: choose measures that deter, detect, delay, respond and mitigate
Start with the highest priority risks. The NPSA's cycle says to review the measures already in place first and propose more only where those are not good enough. For each risk, think about the five ways a measure can help, as set out in the NPSA's operational requirements guidance: deter, which stops or displaces an attack; detect, which verifies an attack and starts the response; delay, which stops it reaching the asset; respond, which stops it going further; and mitigate, which limits the harm if it happens.
A good plan uses more than one. A strong fence delays, but only if someone knows the fence is being cut. A camera only detects if someone sees the footage in time. An alert is only useful if someone can act on it, which means the respond step has to be planned too: who gets the alert, what they do, when they call the police and when a keyholder attends. Ask "and then what?" for every measure you add.
The NPSA also suggests considering each risk against four security disciplines: physical, personnel, cyber and technical. Physical measures include fences, gates, locks, bollards and lighting. Technical measures include intruder alarms, CCTV and access control. Personnel measures include vetting, training, lock-up routines and lone-working procedures. Cyber measures include passwords, updates, backups and checking requests to change bank details. One discipline often covers another's gaps.
Then check that each measure is actually achievable. The NPSA's operational requirements guidance scores each recommendation from 1 to 3 for resources, operational readiness and stakeholder engagement, then adds the three. A total of 8 or 9 is green: the measure can be applied. A total of 5 to 7 is amber: there are barriers to overcome. A total of 3 or 4 is red: the barriers are significant. That does not make a red measure wrong, but it tells you it needs a plan, a budget or a champion before it will work.
Before buying anything technical, write down what it needs to do. The NPSA describes the operational requirement as a clear statement of need that prevents solutions which do not address the vulnerability, are over-engineered or are poor value. It says that, in failing security projects it has been asked to help with, an operational requirement process has almost always not been followed. For cameras, Secured by Design asks for an operational requirement before any system is specified, which we cover below.
Step 8: record it, give every action an owner and review it
Record everything in a risk register. The NPSA says the format is up to you, but that it should fit with any risk registers you already have, and that the more detail you capture, the more useful it will be. For each risk, record the area, asset, threat, vulnerability, scores and reasons, existing measures, further actions, the person responsible and a date. Where the measures do not reduce a risk enough, the NPSA says the remaining risk should be accepted and recorded on the risk register or further measures found. HSE makes a similar point for health and safety: record the significant findings and what you are doing about them.
Then review it. The NPSA's role-based guidance says a risk register should be reviewed at least every year, and more often after a change in the threat or a major incident, after a significant change to critical assets, or once a new measure is in place to check that it reduced the risk rather than moving it elsewhere. HSE also advises reviewing a risk assessment after significant changes and after incidents or near misses. A review after every break-in, attempted break-in or fire is good practice, even if nothing seems to have changed.
Security risk assessment template
Here is a template you can copy. It has one row per risk and follows the steps above. Put it in a spreadsheet so that you can sort it by score, filter it by area and add a column for each review. If you employ five or more people, HSE says you must record the significant findings of your health and safety risk assessment, so it often makes sense to keep the security register alongside it, with a cross-reference wherever a risk appears in both.
| Column | What to write | Example |
|---|---|---|
| Ref and area | A reference and one of the five areas | R04, perimeter |
| Asset | What could be harmed or lost | Diesel in plant and the site bowser |
| Threat | Who or what, and how | Theft by people on foot over the rear fence at night |
| Vulnerability | Why it could happen here | Low chain-link fence, no lighting at the rear, plant parked by the fence |
| Existing measures | What is already in place | Locking fuel caps, alarm inside the unit only |
| Likelihood (1 to 5) | Score and reason | 4: two thefts on this estate this year |
| Impact (1 to 5) | Score and reason | 3: lost fuel, damage, a lost working day |
| Score and priority | Likelihood × impact, and band | 12, Priority 2 |
| Further action | Measures that deter, detect, delay, respond | Move plant away from the fence, light the rear, line on the fence armed at night |
| Owner and due date | One named person and a date | Yard manager, end of the month |
| Residual risk | Score after the actions, and whether it is accepted | 4, accepted, review in a year |
Each row should answer four questions. What is at risk, and where? Who or what threatens it, and how? Why could it happen here, rather than somewhere else? And what will be done next, by whom and by when? If a row cannot answer all four, it is not finished.
Keep the language plain. The register should make sense to the person who locks up, to your insurer's surveyor and to whoever takes over your job. Avoid jargon, avoid vague words such as "adequate" and "appropriate", and use real names, times and places. Store it somewhere safe, because a security risk assessment is also a map of your weak points.
Worked example: a fictional engineering firm
The example below is for a fictional firm with one unit on an industrial estate: a workshop and office, a trade counter, a yard with a gate to the estate road, a rear yard with plant and a skip, and a 1.8 m chain-link fence along the back. Twelve staff work 07:30 to 17:00 on weekdays. The intruder alarm covers the inside of the unit. There are four cameras that record but are not watched.
| Risk | L | I | Score | Main actions | Owner |
|---|---|---|---|---|---|
| Break-in through the yard gate at night | 4 | 4 | 16 | Heavier lock and chain, gate lit, line across the gateway armed out of hours | Director |
| Diesel theft from plant in the rear yard | 4 | 3 | 12 | Park plant away from the fence, lockable caps, people zone over the plant | Yard manager |
| Arson using the skip and pallets by the wall | 2 | 5 | 10 | Move skip and pallets away from the building, smoke and flame detection on that view | Facilities |
| Fraudulent email changing a supplier's bank details | 3 | 4 | 12 | Call-back check on a known number, staff briefing, two-step login | Finance |
| Abuse of staff at the trade counter | 2 | 3 | 6 | Counter layout, lone-working rule, incident log, camera on the counter with signs | Office manager |
| Keys and alarm codes known to former staff | 3 | 4 | 12 | Key register, change codes when people leave, restrict master keys | Director |
The walk-round found that the main gate is the weak point. It is lit only by the streetlight, it is held by a padlock and chain that could be cut in seconds, and once someone is through it, they can reach the plant, the skip, the vans and the back door of the unit. That is why it is the only Priority 1. Fix the gate and add a way to detect someone at it after hours, and several other risks fall as well.
The arson risk shows why impact matters. The likelihood is low, but a fire in the skip spreading to the unit would stop the business, so it scores 10 and sits in Priority 2. The fix is mostly housekeeping: move the skip and pallets away from the wall. Secured by Design's commercial guide says that, in general, combustible materials should not be stored within 10 metres of the building, which we come back to below.
The fraud risk shows why a security risk assessment is not only about fences. The Home Office survey found that staff receiving fraudulent emails was the most common type of computer misuse, so a call-back check before any change to bank details is among the most valuable actions on the list, and it costs nothing but time.
The keys risk shows why insider and process risks belong on the same register. Former staff who still know the alarm code or have a key are a real risk on many sites. A key register and a routine for changing codes when people leave closes the gap.
After the actions, the firm rescores each risk. The gate drops to likelihood 2, impact 4, score 8. The fuel risk drops to 6. Each new score has a reason, and each remaining risk is either accepted and recorded or given another action.
What to check, area by area
The steps above work for any risk. This section goes through the risks that come up on most business sites and what to look for in each. Treat it as a prompt list for the site walk, not a checklist to tick: every site is different, and the right answer depends on your own assets, threats and budget.
Insider risk
The NPSA defines an insider as anyone who has, or previously had, authorised access to or knowledge of the organisation's resources. That includes employees, part-time staff, contractors and business partners. Its role-based guidance identifies five main types of insider risk: unauthorised disclosure of sensitive information, process corruption such as fraud, helping a third party gain access, physical sabotage, and electronic sabotage.
For most small and mid-sized firms, the practical questions are simple. Who has keys and codes, and do they still need them? Do former staff and contractors still have access to buildings, email, the camera app or the alarm app? Could one person order, approve and pay for something without anyone checking? Does anyone else ever check the stock? The NPSA recommends noting which roles enable a risk, so that extra measures can focus on those roles rather than on everyone.
Staff safety and violence
HSE says employers must carry out a risk assessment to identify significant risks to their workers, and that this includes how to prevent and manage violence. It advises asking workers about their experiences, looking around the workplace, looking back at incident records, and thinking about workers at greater risk, such as lone workers, new starters and trainees. Its definition of the hazard includes verbal and online abuse as well as physical assault.
The Home Office survey found that, among premises that had experienced assaults or threats, verbal abuse was by far the most common form, at 73%. On many sites, the risk to staff is greatest at the start and end of the day, when someone opens or locks up alone, or deals with a delivery, a visitor or an alarm activation. Lone-working procedures, a check-in routine and a clear rule that nobody investigates an alarm alone at night are among the most effective measures, and they cost little.
Cyber, fraud and information
A physical security risk assessment should still have a few cyber lines on it, because the two overlap. The Home Office survey found computer misuse at 9% of business premises with a computer, most often staff receiving fraudulent emails. Camera recorders, routers, alarm apps and door-entry systems are all connected, so a default password or an out-of-date router can let someone see your cameras or switch things off.
Change default passwords on recorders and cameras, keep their firmware up to date, remove access for people who leave, and check who can see the camera app. Treat any request to change a supplier's or customer's bank details as suspicious until you have checked it on a number you already hold. Keep backups somewhere a ransomware attack cannot reach.
Arson and fire from outside
Arson is a security risk as well as a fire risk. Secured by Design's commercial guide warns that wheelie bins can be moved and used to climb onto vulnerable parts of a building, and that their contents can fuel an arson attack. It advises keeping bins in a lockable, roofed store set apart from the main buildings, with lockable lids, and says that, in general, combustible materials should not be stored within 10 metres of the building. It says fuel, including petrol for maintenance and plant, should be kept in a secured building a good distance from the main buildings, to prevent both theft and its use in arson.
Your fire risk assessment, under fire safety law, is a separate document, and this guide does not replace it. But the security assessment should look at how someone could start a fire deliberately from outside: pallets stacked against cladding, skips under eaves, bins next to doors, vehicles parked against the building, and gaps in the fence beside stores of materials. The worked example above shows how a fire risk can score highly on impact even when the likelihood is low.
Vehicles, plant and fuel
Yards with vans, trailers, plant and fuel are common targets, as the 2026 incidents earlier in this guide show. Check where vehicles are parked at night, whether keys are left in cabs or on hooks by the door, whether fuel tanks and bowsers are locked and away from the fence, whether catalytic converters and tools are exposed, and whether anyone would see a vehicle being driven out of the gate at 03:00. Park high-value vehicles where they block each other or the gate, where the site allows it, and make sure the route out is the hardest part to use without being noticed.
Keys, codes and access control
A lock is only as good as the control of its keys. Keep a key register, collect keys and change codes the same day someone leaves, keep master keys to a minimum and lock them away, and give contractors time-limited or escorted access. Electronic access control helps because it can be changed instantly and shows who went where, but only if someone reviews the records and removes leavers promptly.
CCTV: write the operational requirement first
Secured by Design's commercial guide says an operational requirement for CCTV should be drawn up for commercial premises, with the objectives clearly established before tendering starts. It says the system must record in a format acceptable to the police, with images of evidential quality, that staff should be trained to use it and to provide recordings to the police, and that it would normally observe all vehicle and pedestrian entrances. It says systems must be installed to BS EN 62676, should be compatible with lighting and landscaping, and should have vandal-resistant housings in high crime areas.
For each camera, the requirement should say what it is there to do: detect someone at the gate, identify a face at the door, read a vehicle at the entrance or watch the stockpile for smoke. It should say when it matters, what should happen when something is seen, and who will act on it. Cameras that only record are useful after the event; cameras that are watched, by people or by software, can help while it is happening. Your assessment should say which you need where.
Check every view in season. Secured by Design says landscaping must be maintained so that it does not blind CCTV or obscure lighting. A camera installed in winter may see nothing but leaves by June. Add a line to the register for pruning, and check the views after storms and after anything is added to the site, such as a new container, a stack of stock or a parked trailer.
Lighting
Secured by Design says the security objective of lighting commercial units after dark is to deter or detect an intruder, that lighting should be co-ordinated with CCTV and landscaping so that it is sufficient for the cameras, that fittings should be protected where vulnerable to vandalism, and that the scheme should give uniform light with good colour rendition. In practice, check for dark gaps between lights, lights that dazzle the cameras and lights that leave the gate or the fence in shadow.
Intruder alarms
Your intruder alarm installer is required to carry out their own risk assessment to decide the grade and design of the system. Make sure they see yours, because it tells them what you are protecting and from whom. Check how the alarm signals, who the keyholders are, what happens when it goes off and how many false alarms it has had. Remember that most alarms cover the inside of the building only, so the yard, the fence and the vehicles need something else. Our guide to business alarm systems covers grades, signalling and police response in detail.
Where cameras and AI detection fit
Most security risk assessments end with some actions about cameras. The question is what the cameras are for. Recorded CCTV is useful after the event, if the footage is good enough and someone finds it in time. But on most business sites, nobody is watching the screens at 02:20, so the gate in the example site could be cut, the yard crossed and the van loaded before anyone knew. That is the gap between "detect" and "respond" that the NPSA cycle asks you to close.
AI detection on the cameras you already have turns them into early warning. You set each camera to watch for the risks on your register. A polygon zone covers exactly the area that matters, such as the plant in the rear yard, rather than a box that includes the road. A line across the gateway or along the fence, with a direction, counts only someone coming in. A schedule arms them only when the site is shut. And you choose what to look for: people, vehicles, or smoke and flame.
Each register row can map to a camera setting. In the example site, the gate risk becomes a line across the gateway armed from 18:00 to 07:00, the diesel risk becomes a people zone over the plant, and the skip risk becomes smoke and flame detection on the view of the skip. The register then records not only that a camera exists but what it is set to do, which is exactly what the operational requirement asks for.
When a zone is crossed, the alert goes to the phones of the people you choose, with a snapshot, a short clip and an AI description of what the camera saw, for example one person walking through the yard gate past a cut chain at 02:20. The person on call can see at once whether it is real, how many people there are and which way they are going. If a crime is in progress, they call 999 with the address and a description. They do not go to the site alone to look. Write that rule into the register as part of the respond step.
Different kinds of site
Each kind of site has its own typical risks. Choose a kind of site below to see what its assessment usually finds outside and how zones on the cameras could help.
Which kind of site?
Plant and vehicle yards usually face theft of fuel, tools, plant and vans, often by people who come over the fence on foot. Park plant and bowsers away from the fence, lock fuel caps and cabs, keep keys locked away and light the yard. A line along the fence and a people zone over the plant, armed out of hours, send the clip while someone is still at the fence.
Fuel, plant, vans and fences
Trade counters and retail units face theft from service yards, abuse at the counter and fires set in bins and pallets against the building. Keep bins locked in a store away from the wall, keep pallets and stock away from the building, and check the low roofs. A zone over the service yard, armed after closing, and smoke and flame detection on the same view, watch the outside after the shutters are down.
Service yards, bins and roofs
Offices and business parks face doors left open, tailgating at reception, thefts from cars and break-ins at night and at weekends. Agree a lock-up routine, check every door at close, and agree with the landlord or other tenants who the keyholders are. A zone on side doors and a vehicle zone over the car park after hours show what is happening before anyone attends.
Doors, car parks and reception
Each kind of site gets zones that suit it: fences and plant in yards, service yards at trade units, and doors and car parks at offices.
What AI on your cameras is not
Be honest about the limits in your assessment. AI detection on cameras is not an intruder alarm: it is not graded and it does not get police response. It is not a guard: someone still has to look at the alert and act. It sees only what the cameras can see, so dark corners, blind spots and views blocked by branches or stacked stock stay blind. And smoke and flame detection on a camera does not replace your fire alarm system or your duties under fire safety law. Record each of these as a limit, so that nobody assumes the cameras cover more than they do.
Cameras and privacy
If your cameras capture people, UK GDPR and the Data Protection Act 2018 apply. Secured by Design's commercial guide says CCTV systems should be registered with the Information Commissioner's Office and comply with data protection and human rights law. The ICO's video surveillance guidance covers installation, management, operation, public awareness and signage. Have a clear purpose for each camera, written in your operational requirement, put up signs, keep views on your own site rather than neighbouring homes, and keep recordings only as long as you need them. Our guide to AI CCTV and GDPR in the UK covers how AI detection fits into this.
Security risk assessment checklist
- Have you written down the scope: the site, the boundary, the date and who took part?
- Have you listed your assets in the six groups and ranked them by how critical they are?
- Have you described each threat specifically: who, what, where and how?
- Have you used real threat information: your own log, neighbours, the police and national guidance?
- Have you walked the site from the outside in, by day and after dark, and looked through every camera?
- Has each risk got a likelihood and impact score from 1 to 5, with the reason written down?
- Have you ranked the risks and put very high-impact risks among the top priorities?
- Does each action say how it deters, detects, delays, responds or mitigates, and is it achievable?
- Has every action got one named owner and a date?
- Have you set a review date, and will you review after any incident, near miss or change?
If you can answer yes to all ten, your assessment is in better shape than most. If not, start with the site walk and the top three risks, and build from there. Our out-of-hours site security checklist is a useful companion for the night walk, and our guide to CCTV camera placement helps with the camera views.
How Woodcock AI fits your security risk assessment
Woodcock AI connects to existing IP cameras and runs on an edge server on site or on a cloud server. It adds people and vehicle detection, and smoke and flame detection, to the cameras you already have. You draw polygon zones and lines that match the risks on your register, set schedules so they are armed when the site is shut, and choose who gets the alerts. Each alert has a snapshot, a short clip and an AI description of what the camera saw.
Woodcock AI is self-learning, so it gets better over time at knowing what is normal on each camera, such as the cleaner who leaves late or the delivery that always arrives at 05:30. It is the result of years of development and is now in use on real sites in the UK. It works alongside your intruder alarm, your fire safety arrangements and your people rather than replacing them. For more, see AI intrusion detection, and our guides to perimeter intrusion detection, industrial estate security, warehouse security, commercial burglary prevention and how to choose an AI CCTV system. Ask your cameras, where you type a question about what the cameras have seen, is coming soon, early 2027.
Ways to start
Start with a site assessment. We walk your site from the outside in, look at what each camera sees by day and after dark, and show where zones, lines and smoke and flame detection would match the risks on your register. Or ask for a live test on your cameras: we connect two or three of your existing cameras for about a fortnight, so you can see the alerts for yourself before deciding. We are also happy to arrange an on-site demo.
Sources
- National Protective Security Authority, Protective Security Risk Management, Role-based Protective Security Risk Assessment Guidance, Insider Risk Assessment and Operational Requirements guidance (PDF).
- Health and Safety Executive, steps needed to manage risk and assessing the risks of violence at work.
- Secured by Design, Commercial Developments 2023 (PDF).
- Home Office, Terrorism (Protection of Premises) Act 2025 factsheets, and GOV.UK, understanding Martyn's Law and the SIA's role as regulator.
- Protector Insurance, Risk management guidance: intruder alarm systems (PDF).
- Home Office, Crime against businesses: findings from the 2023 Commercial Victimisation Survey; Office for National Statistics, Crime in England and Wales: year ending June 2026.
- Incident reports: Cleveland Police (Hartlepool), Richmondshire Today (Melsonby), Harrogate Advertiser (Harrogate), Merseyside Police (St Helens), Swindon Link (Swindon), Chronicle Live (East Boldon) and Gloucestershire Police (Cheltenham).
- Information Commissioner's Office, video surveillance guidance.
We have summarised these sources in our own words. Guidance is updated from time to time, so read the current versions. This page is general guidance, not legal or insurance advice; your insurer, installer, local police and solicitor can advise on your own premises, and your fire risk assessment is a separate duty. In an emergency, always call 999.
Would anyone know someone was at your gate at 02:20?
Book a site assessment and we will walk your site from the outside in, look at what your cameras can see by day and after dark, and show where zones, lines and smoke and flame detection would match the risks on your register, or ask for a live test on your cameras.
Related pages
Frequently asked questions
What is a security risk assessment?
A security risk assessment is a written review of what could harm your premises, people, assets and information, how likely and how serious each risk is, and what you will do about it. It lists assets and threats, records the weak points found on a walk round the site, scores each risk for likelihood and impact, and ends with actions that each have an owner and a date. There is no single official format.
Is a security risk assessment a legal requirement?
There is no general law requiring a security risk assessment as such. But HSE says employers must assess risks to their workers, including how to prevent and manage violence, and insurers and alarm installers often expect a risk assessment. From spring 2027, Martyn’s Law is expected to require qualifying premises where 200 or more people can be present to have public protection procedures, and enhanced tier premises of 800 or more to document their measures.
How do you score a security risk?
A common method, recommended in NPSA guidance, scores likelihood from 1 (least likely) to 5 (most likely) and impact from 1 (lowest) to 5 (greatest), then plots each risk on a 5×5 grid. Multiplying the two gives a score from 1 to 25. Divide the grid into priorities, put very high-impact risks near the top whatever their likelihood, and write down the reasons for every score.
What should a security risk assessment template include?
One row per risk, with a reference, the area of the site, the asset, the threat, the vulnerability, existing measures, likelihood and impact scores with reasons, the overall score and priority, further actions, one named owner, a due date and the residual risk after the actions. The template on this page sets these out with an example for each column.
How often should a security risk assessment be reviewed?
NPSA guidance says a risk register should be reviewed at least once a year, and more often after a change in the threat, a major incident, a significant change to critical assets or once a new measure is in place. HSE also advises reviewing after significant changes and after accidents or near misses. Reviewing after every break-in or attempted break-in is good practice.
Where do CCTV and AI detection fit in a security risk assessment?
Cameras help detect and respond, but only if someone sees what they show in time. Secured by Design says to write a CCTV operational requirement before any tender. AI detection on existing cameras can send an alert with a clip when someone crosses a line or enters a zone after hours. Woodcock AI runs on an edge server on site or on a cloud server; it is not an intruder alarm or a fire alarm system.
Last reviewed 2 November 2026
Your fire risk assessment is a separate legal duty: see our fire risk assessment guide and template.