Twenty Minutes, Once a Quarter: A Security Systems Health Check That Earns Its Place in the Audit File

Most security installations in UK commercial premises are maintained, not monitored. A planned preventative maintenance visit takes place once or twice a year, an engineer signs a worksheet, and the document is filed. The arrangement satisfies the contract. It does not answer the question a duty holder is actually asked after an incident: was the system working on the day?

Between those visits, equipment drifts. A door held open for eleven minutes triggers nothing because the alarm was disabled during a fit-out and never reinstated. A camera timestamp falls forty minutes behind the network time server, which quietly undermines evidential value. An intruder panel reports “healthy” while its signalling path to the alarm receiving centre has been failing intermittently for weeks.

None of these faults announces itself. That is the point of a short, frequent, documented inspection.

Why a quarterly check sits alongside the maintenance contract

A maintenance contract is a supplier obligation. A quarterly check is an internal assurance activity, and the two are not interchangeable. The first tells you what an engineer found. The second tells you what your own team observed, on a known date, against a fixed set of criteria — and that is the version an auditor, insurer or investigating authority will find more useful.

Twenty minutes is a realistic budget for a single site. It is not a substitute for commissioning, servicing or a full system review. It is a tripwire.

The routine, in five blocks

Minutes 0–5: access control

• Attempt entry with a valid credential at two doors on separate controllers, and with an invalid one at a third. Confirm the grant and the refusal.
• Hold a controlled door open past the permitted threshold and confirm the alarm, or the local sounder, operates.
• Test the request-to-exit device at one door — the one most likely to be used.
• Check the panel for battery, mains and tamper indicators.
• Note any door propped open, taped latch or bypassed contact seen on the walk-round.

Minutes 5–11: CCTV and recording

• Confirm the recorder is recording on all licensed channels, not merely displaying a live view.
• Compare the on-screen timestamp with a known accurate clock; record the drift in minutes.
• Review one camera covering an entrance and one covering a high-risk area. Assess image quality, obstruction, and whether the field of view still matches the site plan.
• Check storage health and the number of days actually retained, as opposed to the number specified.
• Confirm signage is present at the perimeter and at reception.

Minutes 11–15: intruder alarms

• Confirm the system is set and unset as expected, and that the setting method has not been altered informally.
• Place the system on test with the alarm receiving centre and trigger one detector, or use the panel test function if agreed.
• Check that the keyholder list is current, that leavers have been removed, and that the ARC holds the correct contact sequence.
• Look for zone faults, bypasses or isolated detectors recorded in the event log.

Minutes 15–18: intercoms and gate entry

• Call the reception station from the external panel and assess audio quality and delay.
• Confirm remote release works and that the release is logged.
• Check that visitor instructions and call-point signage are legible.

Minutes 18–20: the record

Complete the log before leaving the area. Retrospective completion from memory is the most common way these routines decay.

What a pass looks like, and what forces an escalation

A pass means the expected behaviour was observed and recorded. It does not mean the equipment is well designed or appropriately specified — those are separate questions.

Faults should be routed through a simple three-tier escalation. An immediate risk to life safety, a total loss of recording on an entrance camera, or a failed signalling path warrants an emergency call-out and written notification to the duty holder the same day. A drifting timestamp, a failed request-to-exit device or a zone bypass warrants an engineer visit within five working days. Cosmetic and housekeeping items can wait for the next scheduled attendance, provided they are logged and tracked.

The escalation decision, not just the fault, should be recorded. Who decided, on what basis, and when.

Why the log belongs in the evidence pack

The value of this record is cumulative. A single completed sheet proves very little. Twelve consecutive sheets, with a named inspector, a date and a clear escalation trail, demonstrate a system of control — and that is what is being tested when an insurer reviews a claim, when a tenant raises a query about an incident, or when a certification body reviews documented arrangements.

Three practical points strengthen the file:

1. Retention. CCTV footage is typically retained for 30 days; the health check log should not be. Align retention with the wider compliance evidence schedule — commonly twelve months, or the life of the maintenance contract, whichever is longer.
2. Attribution. Each entry needs a name and a role, not initials in a shared spreadsheet cell. Where the task rotates, the rota should be held with the file.
3. Photographic support. A dated image of a camera view, a panel display or a door contact is difficult to dispute and takes seconds to capture.

The log is also a useful procurement instrument. Three quarters of repeated timestamp drift or recurring intercom faults is a coherent argument for capital replacement, in a way that an anecdote is not.

Making the routine survive contact with a busy week

Routines of this kind fail for organisational reasons, not technical ones. A single owner with no deputy will lapse during annual leave. A template with twenty free-text fields will be completed inconsistently. A schedule that assumes a quiet Friday will be abandoned in December.

Keep the template to one page, name a deputy, and pin the schedule to the same calendar as fire drills and water hygiene checks. Where the maintenance contractor attends, compare their worksheet against the last quarterly log — discrepancies between the two are informative in themselves.

For premises subject to enhanced security duties, this record forms one strand of the wider evidence trail, alongside risk assessments, training records and incident reports. It is not the most sophisticated control in the pack. It is, however, one of the few that can be produced quickly, dated accurately and read by a non-specialist in under two minutes — which, in an audit, matters more than it should.