A useful Q4 security review turns expected late-autumn and winter operating changes into named decisions: who may enter, how visitors and contractors are managed, what happens between shifts, how issues are escalated, and who checks the record. Review controls in use, test the handover route, and give every action an owner and date.

Start with the conditions that will actually change

A Q4 review is a practical check that arrangements at one building, estate or portfolio still fit the way it will operate over the coming months. Start with known or reasonably foreseeable changes: altered opening hours, planned works, holiday closures, temporary occupancy, higher delivery volumes, changed tenant use or reduced facilities cover. Then walk the site with the people who operate it.

Record the people, areas, assets and services that matter to the site, together with controls already in place. ProtectUK recommends identifying physical and procedural controls before looking for weaknesses, and reviewing controls that may be ineffective. For a wider method on identifying risks and controls, see SSS’s corporate security risk assessment checklist.

Decide whether access still reflects the people who need it

Begin at each entrance, not the policy document. Check which doors, gates, loading areas and internal zones will be in use; who is authorised to enter each one; and how that authority is applied in and outside normal hours. Test failed access cards, spare keys, shared credentials, disabled doors and the fault-reporting route.

Access should change when the operating reality changes. ProtectUK identifies weak visitor arrangements and a poor review of user access rights, particularly when staff leave, as potential access-control vulnerabilities. A Q4 review should therefore confirm the process for removing or amending access, the owner of that decision and the record that shows it has happened. Do not assume that a system setting alone proves the procedure works in practice.

Make visitor and contractor routes workable

Visitor management is most reliable when reception, the host, facilities and security use the same route. Agree which visits need advance notice; what identity, purpose, host and arrival/departure details are recorded; how passes are issued and returned; and who can resolve an unexpected arrival. ProtectUK recommends recording sign-in and sign-out times, the person accompanying a visitor or contractor, and the purpose of the visit. It also recommends visible identification passes and accompaniment while on site, while recognising that extended contractor attendance may require additional checks instead of permanent escort. The site should decide and document a proportionate arrangement for its own risk and work pattern.

For contractors, the security interface belongs alongside the work interface. Confirm work areas and hours, access route, loading arrangements, named contact, emergency information, temporary-replacement process and pass return. HSE guidance covers assessing work risks, information and instruction, supervision and cooperation. If people may work alone, confirm the relevant controls, contact method and escalation arrangement with the employer responsible for that workplace.

Review point Decision to make before pressure rises Useful evidence
Access Which areas, credentials and out-of-hours routes remain authorised? Current access list, key register and fault route
Visitors What must be pre-notified, checked, recorded and accompanied? Visitor procedure, pass process and host contacts
Contractors Who owns the interface from arrival to pass return? Work schedule, induction information and named contacts
Handovers What must pass between shifts, teams or suppliers? Handover record and open-actions list
Escalation Who receives which issue, by which route, at any hour? Current contact tree and incident procedure
Review When will decisions, incidents and outstanding actions be checked? Meeting date, action owner and completion evidence

Turn handovers into a single operational picture

A shift handover should make the next person able to act, not simply confirm that a shift ended. Use one site-specific record to capture access or equipment faults, keys and passes, scheduled visitors and works, unusual conditions, open incidents, welfare concerns, actions awaiting a decision and the person now responsible. Where a building uses several suppliers, agree which information each party needs and who is permitted to see it.

Make escalation usable outside normal office hours

An escalation route is only useful if the person facing an issue can find it and use it. For each likely category of issue, set out the immediate action, the trigger for escalation, the named role or number to contact, the alternative if unavailable, and the record to complete. Keep emergency-service contact arrangements distinct from internal management escalation. Check that the list reflects current tenant, facilities, landlord, security-provider and contractor contacts.

ProtectUK distinguishes immediate incident response from the wider management of consequences through command, coordination and communication. The route should support both: action at the point of an incident, then a way to inform decision-makers, coordinate resources and record follow-up. Test it against an out-of-hours scenario.

Use the review meeting to make decisions, not just report activity

Set a Q4 review meeting with the people who can close actions: facilities or property management, security, reception or occupier representatives, and relevant contractors. Review incident records, near misses, unresolved faults, changes to occupancy or work, visitor and contractor exceptions, handover themes and overdue actions. Decide what changes, who owns each change, what evidence will show completion and when it will be checked again.

HSE advises employers to review controls when they may no longer be effective, when workplace changes create new risks, or after accidents or near misses. ProtectUK also advises regular review and exercising of incident-response and business-continuity plans when circumstances, suppliers, contractors or stakeholders change. Use an action log, rather than a report with no decisions.

What to prepare before speaking to a security provider

  • A simple site plan showing entry points, reception, loading, restricted areas and any shared access.
  • The expected Q4 operating changes, including works, closures, tenant changes, events or altered opening hours.
  • Current visitor, contractor, access, handover and incident procedures, including the contacts that own them.
  • Recent incident, observation, fault and action records, with recurring issues identified where possible.
  • Your decision-makers, approval route, expected service outcomes and the date by which changes need to be in place.

Discussing a Q4 review with SSS

SSS can discuss a site-specific operational review for London organisations, including access, visitor flow, staffing, communication and existing arrangements, through its security consulting and risk-assessment service. Where a deployment and agreed configuration are appropriate, the SSS Application can support attendance, site instructions, foot and mobile patrol logs, lone-worker capability and incident records. Clients can also be given access to agreed rotas, vetting and licence details, and incident reports. These tools support oversight; they do not replace site-specific decisions or legal responsibilities.

Contact SSS to discuss the operating context of a building, estate or portfolio before Q4 changes take effect.

Sources and further reading

Published: 14 October 2026. Reviewed: 14 October 2026.

This is general operational information, not legal, health-and-safety or security advice for a particular site. Use current official guidance and obtain advice appropriate to your circumstances.