Auditing your security provider: how the client does it

• Coverage: is the guard on post, in uniform and identifiable?
• Knowledge of the post: do they know the post orders, who to call in an incident, where the keys and emergency exits are?
• Records: is the shift report up to date to that moment?
• Equipment: do the torch, radio or phone and checkpoint scanner work?
• Time of the visit: note it, so you can compare it with the records later.

An unannounced check is done respectfully. Talk to the guard normally, don’t try to “catch them out”, and discuss findings with the provider’s manager, not in front of others.

• Your visit: does it appear in that day’s shift report?
• Patrols: are checkpoint times plausible for the distance between them? Sequences on round hours suggest reports written after the fact.
• Hours: do shift times match the roster you were given?
• Incidents: is what your own staff told you in the incident reports?
• Sample: pick a few random shifts in the month and ask for all their records.

The comparison is easier when records are timestamped and come from checkpoints. The same data feeds the security KPIs you track each month.

• Company licence: non-transferable, valid five years, renewable for another five if the conditions still hold (art. 2 §3 of Law 2518/1997).
• Each guard’s work licence: staff need a category A or B work licence (art. 3 §1); it is personal, valid five years and renewable (art. 3 §6).
• Monthly staff list: every month the company submits to the police a list with each employee’s work-licence number and post (art. 4). Ask for confirmation that the guards on your site are on it.
• Company documents: must show its licence number (art. 4 §1(a), as amended by art. 159 of Law 5187/2025). Check the contract and invoices.

For a step-by-step licence check, see the security company licence check guide. In an audit the question isn’t only whether the licences exist, but whether they’re valid today and cover the people you see on post.

• Site induction: was every new guard briefed on your site before their first shift? By whom, and is there a signature?
• Post orders: when the instructions changed, were all guards covering the post briefed?
• Emergency procedures: do guards know what to do in a fire, an evacuation, a medical emergency? Ask them during the unannounced check.
• Whatever the contract requires: if the contract specifies training, ask for proof.

A certificate on file doesn’t tell you whether the guard knows your site. The best proof of training is a correct answer on post.

1. Choose incidents of different types, not only the serious ones.
2. Compare the actions taken with the post orders.
3. Check the notification chain: who was alerted, in what order, how long it took.
4. See whether the incident report was written at the time or later.
5. Ask what changed afterwards: instructions, patrol route, training.

An incident with no follow-up is a missed opportunity. A good provider doesn’t just say “we handled it”; it shows what it learned.

• Date and scope: what was checked and for which period.
• Findings: each with the evidence that shows it — time of visit, record, photo of the site.
• Severity: what is critical (an uncovered post, an expired licence) and what is an improvement.
• Actions: what you require, from whom, by when.
• Provider response: in writing, within an agreed time.
• Re-check: a date to confirm the findings are closed.

If the same critical findings keep coming back, the problem is the provider’s supervision. Then review the relationship using the criteria in how to choose a security company, or see how to switch security company. OVIT’s services rely on local teams and an operations desk where a real person answers.