How to conduct a security risk assessment

A security risk assessment identifies the risks and vulnerabilities in your security infrastructure so you can build a plan to protect against them. It is the step that decides where the money goes — and it is the step most often skipped, because it produces a document rather than an installation. Skipping it is how sites end up with expensive controls aimed at the wrong problem.

For an employer it is also not purely voluntary: duties on workplace safety and health, including the assessment of risk, sit largely in the Occupational Safety, Health and Working Conditions Code, 2020. A security assessment that feeds the same register is one piece of work instead of two.

This guide walks through the method in the order that keeps it honest.

What the assessment should produce

Agree what “done” looks like before you start. A useful assessment gives you three things:

• A ranked list of risks, so you can tell a nuisance apart from something that could stop the business.
• For each significant risk, a named owner and a treatment decision — not a general instruction to “improve security”.
• Evidence of the current state, so the next assessment can judge whether the position actually improved or quietly slipped.

If the output is a list of things to buy, it is a sales document wearing an assessment’s clothes.

Step 1 — Identify critical assets

Start with what you are protecting, because everything later is measured against it. List the critical assets across both physical and technology infrastructure, and record the value and the impact of losing each one:

• People — staff, contractors, visitors, and anyone whose safety depends on the site’s controls.
• Property and equipment — plant, vehicles, tools, stock and anything expensive to replace or slow to procure.
• Information — customer records, pricing, contracts and personal data, wherever they physically sit or however they are accessed.
• Continuity — utilities, connectivity, and the single points of failure that keep the operation running.

An asset list is most useful when it distinguishes what is valuable from what is critical. A costly machine that can be idle for a month is a different problem from the utility connection that stops every process the moment it fails.

Step 2 — Evaluate current security measures

Now test what is actually there. Review physical security measures, access controls and data protection, and grade each control by effectiveness, not existence.

This is the step where assessments most often go soft. “CCTV installed” is not a finding; a camera whose retention window is shorter than your incident-detection time is a gap that looks like a control. Ask of each measure:

• Does it detect, delay or deter the thing it was installed for?
• Is it monitored, and does an alert reach someone who can respond?
• When was it last tested, and what did the test show?
• Has the operation around it changed since it was installed?

Step 3 — Identify threats and vulnerabilities

These are two different things, and separating them is what makes the analysis useful. A threat is something that can cause harm; a vulnerability is the weakness that lets it succeed. A delivery driver is not a risk on their own — a loading bay where drivers can walk freely through the stock area is the vulnerability that turns them into one.

Work through the sources of harm systematically rather than by imagination:

• External deliberate — burglary, cargo theft, vandalism, protest, cyber intrusion.
• Internal deliberate — theft by staff, collusion with drivers or contractors, data theft, fraud.
• Accidental — human error, poor training, maintenance failure, process shortcuts.
• Environmental — fire, flood, storm, utility loss, and the knock-on effects of each.

Include the mundane categories. Insider risk in particular is under-reported because it is uncomfortable, and it is consistently among the largest sources of loss in facilities holding valuable stock.

Step 4 — Determine and prioritise risks

For each threat, assess the likelihood of it occurring and the impact on the business if it does, then rank on the combination. A simple matrix is enough — the point is to make the reasoning explicit and comparable, not to produce a spurious decimal score.

Score impact across more than money:

• Harm to people
• Financial loss, including the cost of interruption rather than just the value of the asset
• Regulatory or contractual consequences
• Reputational damage and customer confidence

Then prioritise. A high-likelihood, high-impact risk with a cheap control is the obvious first move. A low-likelihood, high-impact risk may still justify planning for even if it does not justify spending. Writing the reasoning down matters as much as the ranking: whoever funds the work will ask why this risk and not that one, and an assessment that cannot answer is the one that gets deferred.

Step 5 — Treat the risks, then monitor them

For each prioritised risk, choose a treatment deliberately. There are only four, and naming which one you are using prevents the default — which is to buy something:

• Reduce — add or strengthen a control, the most common option.
• Avoid — stop doing the activity that creates the exposure.
• Transfer — insure it, or place the obligation contractually on a party who can carry it.
• Accept — decide consciously to live with it, and record who made that decision.

Every treatment needs an owner and a date. Controls then have to keep working after the assessment is signed off, which is where most plans fail. Implement them, then monitor them over time. Ensure a business continuity plan is in place so operations can continue when a risk materialises. Review security policies and procedures regularly, run security audits, and provide security training to employees — the Security Operations Management System is the framework that keeps this running rather than a one-off.

Where assessments go wrong

• Assessing the building instead of the operation. The plan has to match how the site actually runs, including the shortcuts people take under pressure.
• No owners. Risks without an owner and a date are observations, not decisions.
• Score once, never revisit. Business changes — new tenants, new shifts, new stock profiles — create new exposure in the same building.
• Let the vendor scope the assessment. The party who sells the controls should not be the only party defining the problem.
• Treating a control’s presence as its effectiveness. Untested alarms and unmonitored cameras are expensive reassurance.

Frequently asked questions

How often should a security risk assessment be done?

Review it annually as a minimum, but trigger a fresh assessment on change rather than only on the calendar: a new site, a change of use, a shift-pattern change, a new high-value contract, or any serious incident. The building rarely changes as fast as the operation inside it.

Who should carry out the assessment?

Someone who understands both security and how the site operates, and who is independent of the controls being evaluated. Where a provider performs it, ask for the method, the asset list and the scoring — so you can see the reasoning rather than just the recommendations.

What is the difference between a risk assessment and a security audit?

The assessment decides what matters and where to act; the audit checks whether the chosen controls are in place and still effective. They feed each other — an audit without an assessment grades the wrong things, and an assessment without an audit never learns whether the treatment worked.

Do we need a formal methodology?

A recognised framework helps you structure the work and compare sites, but the discipline matters more than the framework. What you cannot skip is stating assets, separating threats from vulnerabilities, scoring likelihood and impact explicitly, and naming an owner for every decision.

How do we show the work was worth it?

Keep the previous version. Comparing two assessments — same assets, same scoring, different dates — is the only credible way to demonstrate that risk went down, and it is the evidence a customer, insurer or auditor will ask for.

What this does not cover

This guide covers the assessment process. It does not cover the legal authority to deploy guards — a PSARA licence, granted state by state — or the supervision and reporting model that makes a vendor accountable. Those are separate decisions covered in the security agency selection guide and the due-diligence guide.