Martyn’s Law Readiness: The Five Evidence Trails Most Premises Still Cannot Produce
Photo: UK facilities manager reviewing contractor induction records and CCTV retention log at reception desk, via facts.net
Many UK facilities teams can show a Martyn’s Law policy. Far fewer can show the operational evidence that sits behind it. As of November 2026, the Terrorism (Protection of Premises) Act is part of the operating environment for larger venues, and standard-tier organisations are working to deadlines that are no longer theoretical. The audit question is rarely whether a policy exists. It is whether the site can prove, on a given day, that the policy was followed.
The five gaps below are common because they sit between systems: between access control and HR, between CCTV and IT, between a contractor’s folder and the front desk. None requires a new platform. Each requires an owner, a routine and a file that an auditor can follow.
1. Contractor induction records that do not identify a person, a date and a site
A generic induction pack and a signature on a clipboard is not evidence. The auditor will want to know who attended, when, at which site, which version of the induction they received and who delivered it. In multi-tenant buildings, the gap widens when subcontractors arrive under a principal contractor’s banner.
Close it by using the sign-in system you already have. Add five fields to the induction sheet: full name, employer, date and time, site zone and induction version. Scan the sheet to the same folder as the access record. Ask reception to spot-check three records a week. If the contractor uses a subcontractor, require the principal to provide the same fields before the gate pass is issued. This is not a new system; it is a tighter use of the existing one.
2. CCTV retention schedules without retrieval evidence
A policy that says footage is retained for 28 days proves intent, not practice. Auditors and insurers increasingly ask for evidence that exports can be retrieved, that retention is actually enforced and that a named person owns the process. A schedule on a shared drive is not the same as a test.
Close it with the tools already in the control room. Run a monthly test export from a non-critical camera, record the date, operator, camera reference and retrieval time, and file it alongside the retention schedule. Check that the recorder’s overwrite settings match the written policy. If the site uses a third-party monitoring provider, ask for the same test record quarterly. Keep the log simple: one page per month is enough to show a routine.
3. Training records that show completion but not role relevance
A completion report from an e-learning module is useful, but it does not prove that the right people received the right briefing. Standard-tier readiness depends on staff knowing what to do in the first few minutes, not on a dashboard percentage. The common gap is a record that shows a name and a date but no role, no refresher date and no link to the site’s procedures.
Close it by mapping roles to modules using the learning management system or training matrix you already pay for. Record briefings delivered at team meetings with a short attendance sheet. Set a review date in the calendar and check that new starters are added before their first shift. The evidence should answer a simple question: can this person explain their role in the site’s response? A one-page role card, signed and dated, is often more persuasive than a generic certificate.
4. Exercise records that stop at attendance
A drill log with twelve names and a date is a start, but it does not show whether the exercise changed anything. The evidence gap is the action log: who was tasked, by when, and whether the action was closed. Without that trail, an auditor sees activity rather than improvement.
Close it by adding a single action table to the existing exercise report. Columns should include action, owner, due date, status and evidence of closure. Review open actions at the next operations meeting and keep the minutes. A tabletop exercise with security or facilities staff can be recorded in the same format. The point is not to run more exercises; it is to show that the last one led somewhere.
5. Change-control records for temporary layouts, events and tenancies
Procedures are often written for the building as it was, not as it is. A pop-up event, a new tenant fit-out or a temporary hoarding can change access routes, CCTV coverage and evacuation arrangements. If the change is not recorded, the policy on paper and the practice on site drift apart.
Close it by attaching a short counter-terrorism check to the event plan or permit-to-work you already use. Ask three questions: what has changed, which procedure is affected and who has confirmed the change. Record the answer in the event file. For tenancy changes, add the check to the handover checklist. Version-control the site plan and keep the old version for audit. This is low-cost discipline, not a new software purchase.
What to do next
Pick one gap and test it this month. Choose the evidence an auditor would ask for first, assign a named owner and set a recurring review. The aim is not a thicker manual. It is a short, current evidence trail that survives a spot check.
Martyn’s Law readiness will be judged on practice, not presentation. The sites that pass will be the ones that can show last month’s record, not last year’s policy.
