Lone Working Risk Assessment for Security Officers

Lone security officer walking a wet service road between warehouse units on a British industrial estate before dawn

The Health and Safety Executive names security staff twice in its own lone working guidance: once as an example of people who work outside normal hours, and once among the conditions that raise the risk of violence at work. Its six published example risk assessments cover an office, a shop, food service, vehicle repair, factory maintenance and a warehouse. None is a security business.

In short: UK law requires a suitable and sufficient assessment and stops there. There is no lone working score, matrix or threshold. This article covers what the HSE actually asks for, three questions that make the assessment defensible, and a worked example for a night patrol.

What UK law requires when a security officer works alone

Section 2 of the Health and Safety at Work etc. Act 1974 sets the general duty towards employees. Regulation 3(1) of the Management of Health and Safety at Work Regulations 1999 makes it specific: every employer shall make a suitable and sufficient assessment of the risks their employees face at work.

Neither uses the word alone, and INDG73 spells out the consequence: there is no legal requirement to conduct a specific, separate risk assessment for lone workers. The duty is to include lone working risks in the general assessment and control them.

Regulation 3(6) obliges an employer with five or more employees to record the significant findings and any group identified as especially at risk. Officers who patrol alone at night are such a group. Regulation 3(3) sets the review trigger: reason to suspect the assessment is no longer valid, or a significant change in what it covers.

One company-wide assessment rarely survives a contract portfolio: a daytime reception post and a 03:00 lock-up round are different exposures, even when the same officer covers both.

Why there is no score, no matrix and no threshold

Because UK law regulates the outcome and leaves the method to the employer. The HSE names no scoring system anywhere in its lone working guidance, so suitable and sufficient is judged on your reasoning rather than on a number.

Operators who have worked to a continental European standard get caught here. German practice grades lone working into hazard levels and computes an acceptability figure from them. That has no standing in the United Kingdom, and importing it would make a British assessment longer rather than more defensible.

What the HSE does supply is a short list of work needing a second person present: confined spaces, work near exposed live electricity conductors, diving operations, vehicles carrying explosives and fumigation. Security work is not on it, so contract guarding is lawful as single-officer work by default, and the burden of showing where that default stops sits with your assessment.

The six examples the HSE publishes cover an office, a shop, food preparation, vehicle repair, factory maintenance and a warehouse, and the regulator warns against lifting one and adding your own company name. For a security company the point is sharper: there is nothing to lift.

Three questions that make a lone working risk assessment defensible

Build the assessment from the HSE's own prompts rather than an imported formula. Three questions do most of the work on any guarding post.

Security officer holding a rugged phone against a checkpoint disc on a steel door frame at night
A scan proves the officer reached the point; it says nothing about whether they could still call for help from it.

Can the officer still call for help?

INDG73 asks whether the worker has adequate and reliable means of communication and a way to call for help. A phone answers that only for incidents leaving the officer conscious and able to dial, which rules out a fall in an unlit stairwell and an assault from behind. Where the harm removes the officer's ability to act, the gap is closed by a device that raises the alarm without them, manually or automatically in the HSE's phrasing.

How long until someone reaches them?

The HSE requires emergency procedures that are established, put in place, trained and practised. Measure the interval to arrival rather than estimating it. On a mobile patrol contract the honest number includes the drive at night, the locked perimeter gate, and the key sitting in the pocket of the officer nobody can reach. An alarm landing in a control room within seconds and a responder arriving forty minutes later are two different controls, and only one is a rescue.

What makes an incident more likely here?

The HSE lists five conditions that raise the risk of violence at work, and four describe routine guarding: locations with a known high risk of violence, late evening or early morning work when fewer people are around, workers holding positions of authority over customers or clients, and contact with people who have been drinking or taking drugs. Carrying money or valuable equipment supplies the fifth. Where several apply to one post, say so in writing and let the level of control follow. INDG73 then turns to the individual: experience of working alone, training, medical suitability and vulnerability.

One date belongs here. From 30 October 2026 the Employment Rights Act 2025 requires employers to take all reasonable steps to prevent sexual harassment of their employees and, separately, not to permit third parties to harass them. All reasonable steps is an evidential standard, and this assessment is where the reasoning about abuse from the public already lives. GOV.UK notes these dates remain subject to parliamentary processes.

Four lone working situations in security, and why they grade differently

The same officer, for the same employer, can sit at four very different levels of exposure across one week. Grading them together is the most common weakness in a security lone working assessment, and the one a client auditor finds fastest.

Lone officer standing at an empty reception counter in a British office lobby late at night, wet street outside
An out-of-hours reception post is the mildest of the four, which is why grading it alongside alarm response is what an auditor finds first.

Out-of-hours reception. A fixed post, lit, with a known layout and often a caretaker in the building. Communication is reliable and help is close. Of the violence factors, authority over visitors and the late hour apply; the environmental ones do not. A phone and an agreed check-in are usually proportionate here.

Internal patrol of an empty building. The officer moves through stairwells, plant rooms and roof access where a fall can leave them unable to call, and their position stops being known between checkpoints. The credible harm is no longer only assault; it is an injury nobody learns about, so fixed check-in intervals become the control and the frequency has to be written down.

Mobile patrol across a large or isolated site. The HSE flags rural and isolated locations, and asks whether there is a safe way in and out for one person working outside normal hours. On a large estate the time to reach an injured officer can exceed the window in which first aid would have mattered, which is a reason to change the route, the crewing or the response arrangement rather than a finding to file.

Single-crewed alarm response and keyholding. The highest exposure of the four, because the officer is dispatched towards a situation somebody else has already reported as wrong, with time of night, an unknown building state, possible intruders and lone access all coinciding. Where the assessment cannot show a credible response inside a defensible time, the honest conclusion is to double-crew that call type.

A worked lone working risk assessment example

Fill the HSE's own template columns one post at a time. The example below covers a night patrol of an empty office building.

Hazard Who might be harmed and how Controls in place Further action needed Who, and by when
Fall on stairs or from height on the internal round Patrolling officer: fracture or head injury, unable to call for help Lighting and handrails checked on the first round; work phone carried; checkpoint scan on each floor Timed check-in at a stated interval, plus an alarm that raises without action by the officer Operations manager, before the next roster
Assault by an intruder or an intoxicated member of the public Patrolling officer: physical injury and psychological harm Conflict management training; no cash held on site; doors secured behind the officer Review the incident history for this site and reroute the round where confrontation is foreseeable Contract manager, quarterly
Delay before help arrives Patrolling officer: a survivable injury becomes a serious one Control room holds site keys, gate codes and the emergency contact list Time the response drive at night with gate access included, and record the measured result Operations manager, within four weeks

Three rows are a starting point, and the HSE's warning against copying an example applies to this one too. The format earns its place by forcing a named owner and a date onto every gap.

From assessment to lone working policy and procedure

The assessment records why a post is acceptable. The lone working policy tells the officer what to do on it, and the procedure fixes who acts when a check-in does not arrive. Keeping them apart matters: auditors read the assessment, officers read the policy.

The HSE asks employers to set the limits on what can and cannot be done while working alone. In guarding that means writing down which call types are not attended single-crewed, which areas are not entered alone, and the point at which a round stops and the control room is called instead. A policy listing no limits has avoided a decision rather than recorded one.

Three elements then need to be specific. The check-in interval needs a number, because an interval with no stated frequency is not monitoring. The escalation needs a named role rather than a shift, so whoever notices a missed check-in knows it belongs to them. And the return-to-base confirmation, which the HSE calls a reliable system to ensure a lone worker has returned once the task is complete, has to close every shift, not only the eventful ones.

Two habits undermine sound procedures. The first is leaving the technology untested; the HSE asks for regular testing of the systems and all emergency procedures, meaning a scheduled test alarm through the full chain. The second is treating dynamic risk assessment as the whole answer: INDG73 calls it no substitute for a comprehensive risk assessment, and requires that an officer expected to make one is trained for it.

Making the controls provable

An assessment is worth whatever its controls can be shown to have done. If you set a 30 minute check-in and cannot demonstrate it was kept on the shift in question, the control existed on paper only. Proof is a documentation problem before it is a technology problem. From 1 October 2026 the employment tribunal claim window rises from three months to six, so those records have to survive two quarters instead of one.

Three of the HSE's monitoring measures generate evidence as a by-product once they run in software rather than on a clipboard: pre-agreed intervals of regular contact, devices that raise the alarm manually or automatically, and confirmation that the officer has returned to base. COREDINATE, a guard tour system, timestamps each checkpoint scan with its location, flags a patrol that misses the agreed interval, and files both into the Daily Occurrence Book, which exports as a PDF for a client audit. Where the officer cannot act for themselves, the man down function on the same handset answers the first question above, and our article on the dead man's switch covers where a smartphone-based alarm stops being sufficient.

One boundary belongs here, because UK buyers ask about it. BS 8484:2022, the code of practice for the provision of lone worker services, is what an accredited service is audited against, and accreditation plus a police-issued unique reference number is what secures a fast-tracked police response. COREDINATE is documentation and alarm software: we hold no BS 8484 accreditation, operate no alarm receiving centre and deliver no police response. If a post needs an accredited response service, buy one; a guard tour and patrol system evidences the controls around it, it does not replace it.

Frequently asked questions

Is lone working illegal?

No. Working alone is lawful in the UK, and the HSE states it will often be safe, provided you deal with the risks first. Only a short list of activities requires a second person present: confined spaces, work near exposed live electricity conductors, diving operations, vehicles carrying explosives and fumigation. Security work is not on that list.

Do I need a separate risk assessment for lone workers?

Not as a separate document. INDG73 states there is no legal requirement to conduct a specific, separate risk assessment for lone workers; the duty is to include those risks in your general assessment and control them. Most security companies still write one per site, because Regulation 3(6) requires an employer with five or more employees to record any group identified as especially at risk.

Is there an official lone working risk assessment template?

The HSE publishes a general risk assessment template in Word and OpenDocument format, with columns for who might be harmed and how, the controls in place, the further action needed, the person responsible and the deadline. There is no lone worker specific version and none for the security industry. Its six example assessments cover no security business, and it warns against copying one.

How often should a lone working risk assessment be reviewed?

The regulations set no fixed interval. Regulation 3(3) requires a review where there is reason to suspect the assessment is no longer valid, or where there has been a significant change in what it covers. The usual triggers in guarding are a new contract, a changed route or shift pattern, new equipment, an incident or near miss, and new client requirements.

Can a security officer work alone at night?

Yes, subject to what the assessment shows. Night work appears in the HSE guidance as a factor raising the risk of violence, and it usually lengthens the time before help arrives. Neither makes lone night work unlawful; both raise the standard the controls must meet. In practice that means a stated check-in frequency, an alarm the officer can raise without being able to act, and a response time you have measured rather than assumed.

Sources

Every duty, quotation and date above was checked against the primary source on 8 September 2026:

The evidence behind a lone working assessment is produced during the shift, not reconstructed after it: timestamped patrol records, check-ins at the frequency you set, and a report you can hand to a client auditor. Run one lone post on the 14 day test kit and look at what the Daily Occurrence Book holds at the end of it. To work through the posts you are least comfortable with, speak to our sales team.