NEWS
What Is a Site Security Risk Assessment and Do You Need One?
The short answer to the second question is: almost certainly yes. Whether it’s explicitly required by your main contractor, your insurer, or your own health and safety obligations, a documented site security risk assessment is increasingly the baseline expectation on UK construction projects in 2026, not an optional extra.
The longer answer is about what a proper security risk assessment actually involves, why a generic document doesn’t satisfy the requirement, and how to use one to drive genuinely better security decisions rather than just tick a box.
What a site security risk assessment is
A site security risk assessment is a structured evaluation of the security threats facing a specific site, the likelihood of each threat, the potential impact, and the controls that should be in place to mitigate them. It is site-specific, not generic. A document that describes general construction site security risks without reference to your specific site, location, build phase, and asset profile is not a security risk assessment, it is a template.
A proper assessment covers:
- Threat identification: what are the realistic threats to this site? Opportunist theft, organised plant theft, metal theft, vandalism, arson, trespass, unauthorised access?
- Site-specific vulnerability: what features of this site make it more or less vulnerable? Location, perimeter type, proximity to roads, visibility, access points, adjacent land use?
- Asset profile: what is on site and what is its value? Plant, materials, fuel, welfare equipment, partially completed work?
- Existing controls: what security is already in place and how effective is it?
- Residual risk: after existing controls are considered, what risk remains and what additional measures are required?
- Review triggers: at what points should the assessment be updated? Phase changes, layout changes, new high-value asset deliveries?
Why main contractors increasingly require it
The shift towards formal security risk assessments on UK construction projects has been driven by two pressures: insurance requirements and main contractor pre-qualification processes.
From an insurance perspective, underwriters want to see that security decisions have been made deliberately, based on a site-specific assessment of risk, not that a camera was bolted to a fence post because that’s what was always done. A documented risk assessment supports a better premium at inception and a stronger claims position if something goes wrong.
From a main contractor perspective, the pre-qualification and tender process for many larger contractors now includes specific questions about security management, including whether a formal risk assessment process is in place. Subcontractors and site managers who can demonstrate a structured approach are at an advantage.
The difference between a security survey and a risk assessment
These terms are sometimes used interchangeably, but they’re not the same thing.
A security survey is a physical inspection of the site, identifying access points, blind spots, lighting gaps, and existing security measures. It is the input.
A security risk assessment takes the findings of the survey and applies a risk evaluation framework, likelihood, impact, and residual risk after controls, to produce documented recommendations and a priority order for action. It is the output.
Both are necessary. A survey without an assessment produces observations with no structure for acting on them. An assessment without a proper survey is a desk exercise that misses site-specific realities.
When to carry out a security risk assessment
The right time is before mobilisation, ideally during the pre-construction phase when security can be designed into the site layout rather than retrofitted. In practice, assessments should also be reviewed:
- At each significant phase change, as the site layout, access requirements, and asset profile change
- After any security incident, to understand whether controls failed and what needs to change
- When new high-value assets arrive on site, plant deliveries, material deliveries ahead of a critical install phase
- Ahead of the summer shutdown or any other extended unattended period
How StarFM Group approaches security assessment
When we mobilise a new site, we don’t just deliver equipment, we carry out a site-specific assessment that informs exactly where cameras and lighting should be positioned, which access points are the priority, and what the monitoring specification should look like for that particular site.
about a pre-mobilisation security assessment for your next project.