Where to start
A new security business can receive its licence, organise its supporting documents and still be unprepared for the questions that arrive once work begins.
Who checks that each officer’s licence remains current? Where are the latest client instructions stored? What happens after an incident report is submitted?
That is where the difference between having documents and having a working system becomes clear.
In Victoria, private security businesses operate under the Private Security Act 2004 and the Private Security Regulations 2025. Victoria Police’s business-licence application guidance says applicants may have to provide standard operating procedures, a business plan, public liability insurance evidence, financial viability information and evidence of understanding employer responsibilities. They are foundations, not the full suite.
When compliance exists only on paper
This problem develops when a business has the required documents, but they are not built into the way the business actually operates.
It is rarely deliberate. New owners are often focused on licensing, finding clients, recruiting officers and filling shifts. The SOPs, policies, forms and employment documents may all exist, but nobody has clearly decided how they will be used, who is responsible for each process or what records must be kept.
Site instructions remain buried in emails. Induction is discussed but not recorded. Incident reports are completed, but nobody tracks the follow-up. A policy assigns responsibility to a manager or department that does not exist in the real business.
On paper, the business appears organised. In practice, the system depends on the owner remembering what needs to happen and personally following it through. That becomes increasingly fragile as the business adds workers, clients, sites, supervisors or subcontractors.
Why it becomes a business problem
Officers may receive inconsistent instructions. Client commitments may not reach the people delivering the service. Payroll information may be incomplete. Incidents may repeat because nobody reviewed the cause or assigned corrective action. When a client, regulator or tender assessor asks for evidence, the business may only be able to show a blank template.
If every approval and exception must pass through one person, then business growth increases workload without increasing control.
The answer is not another pile of documents. It is connecting documents to responsibilities, actions, evidence and review.
The five parts of a working compliance system
A practical compliance system has five parts.
Document: Explains the expected approach. It may be a policy, SOP, agreement, site plan, checklist or reporting form.
Process: Explains what actually happens. For example, licence verification should be a defined check rather than a paragraph buried in an SOP.
Responsibility: Identifies who completes and checks the action. “Management will review” is not enough when nobody knows who is responsible or when the review occurs.
Evidence: Shows that the process occurred. This might be an induction checklist, licence-verification record or incident follow-up note.
Oversight: Tests whether the process is working. This may be a monthly expiry check, document review or recurring review of incidents and corrective actions.
A document without a process is theory. A process without responsibility is optional. Records without review become storage rather than management.
Start with the processes that carry the most risk
A small security provider does not need to imitate a national company. It does need to identify the processes that would cause the greatest harm if they failed.
Start with:
- Worker and security-licence checks
- Recruitment, employment and induction
- Rostering, hours and payroll inputs
- Client scope, site instructions and deployment
- Incident, hazard and escalation processes
- Document control and review
Victoria Police maintains a public register of private security licence, registration and permit holders. Its guidance states that employers and business operators are responsible for regularly checking the register to ensure employees are correctly licensed or registered. That turns “check licences” into a real process: decide who checks, when it occurs, how it is recorded and what happens when an issue appears.
Employment records need the same discipline. The Fair Work Ombudsman’s record-keeping and pay slips guidance says employers covered by relevant Commonwealth workplace laws must keep accurate and complete employee records, including information such as time worked and wages paid. Employee records generally need to be kept for seven years. An employment agreement does not replace reliable time, pay and entitlement records.
Check whether the documents describe the same business
Compare the important documents side by side:
- Does the Business Plan describe the services covered by the SOPs?
- Do proposals and client agreements define the same scope?
- Do employment documents match the duties officers actually perform?
- Does induction cover the expectations contained in the SOPs?
- Do site instructions reflect the client agreement?
- Does the incident procedure match the reporting form and escalation pathway?
One document may say an operations manager reviews incidents, another assigns the task to a supervisor, while the actual business leaves it with the owner. Everyone assumes someone else is handling it.
Keep the system proportionate, but review it as the business changes
A credible small-business system can be straightforward. A checklist, register, calendar reminder and named responsibility may be enough for a particular control.
The important test is whether the system reflects the real business. Avoid inventing departments or positions simply to make documents look impressive.
Review the system when services change, workers are engaged differently, a new site begins, subcontractors are introduced or the owner can no longer personally oversee every activity.
A useful diagnostic question is: which processes would stop if the owner were unavailable for two weeks?
Building the Business Behind the Licence
GuardHERE’s THE BUSINESS OF PROTECTION eBook was written for security officers, supervisors and new owners who understand the work but need to build the business behind it. It explains how licensing, pricing, employment, client, workforce and operational decisions connect. The accompanying Master Example Rate Calculator helps operators test the numbers behind wages, employment on-costs, overheads and charge rates.
Some operators will also need coordinated documents to support that structure. The Security Business Complete Package brings business planning, licensing, employment, induction, client and operational resources together so they describe and support the same business.
Compliance has to operate
A licence authorises the business to carry out the security activities it is licensed for. Documents explain how it intends to operate. The compliance system is created when people understand their responsibilities, complete the required actions, retain evidence and review whether the controls are working.
The aim is not more paperwork for its own sake. It is making sure the paperwork describes and supports a security business that actually works.
This article provides general information only and is not legal, employment, financial, tax or safety advice. Operators should check the current requirements applying to their business, licence, state or territory and seek professional advice where appropriate.