How the environment is used

The assessment should consider normal activity before looking only for visible weaknesses. Staff arrivals, visitor flow, deliveries, contractor access, public areas and after-hours activity all shape the risk picture.

Physical and procedural controls

Gates, doors, lighting, fencing, keys and credentials matter, but so do the procedures governing them. A strong control can still fail when authorisation is unclear or exceptions are not recorded.

Technology and human action

Cameras, alarms and access systems require an operational purpose. The assessment should identify who observes an alert, what action follows and how faults are reported and resolved.

Priorities that can be implemented

Recommendations should be proportionate and prioritised. The client should understand what requires immediate attention, what can be scheduled and how each improvement reduces a specific exposure.