What "independent" should mean
An independent consultant earns nothing from what you buy afterward. No product, no install, no guard contract, no referral fee. That's the only way to know a recommendation is about your risk.
Ask whether they've built and run a program
Good security people come from many backgrounds, including law enforcement, the military, guard and patrol companies, and corporate security, and each brings real strengths. The background matters less than the experience. A security program has to be designed, funded, staffed, trained and kept running inside an organization, year after year. So ask any consultant whether they have built a program like that and been accountable for running it.
Handling incidents
Emergency response, investigations and working with police and fire. Every good program plans for the bad day.
Building the program
Risk assessment, written policies, access control, camera and alarm standards, guard post orders and an emergency plan that fits your site.
Running it every day
Training and drills, managing vendors and guard contracts, budgets, working with leadership, and measuring whether things are getting better. This is where most programs succeed or quietly fail.
Ten questions to ask
- Do you sell, install or take fees from any vendor?The answer should be a plain no.
- Have you built and run a security program inside an organization?Ask for an example of a program they designed and were accountable for day to day. Running one teaches what works on a Monday morning.
- Who will do the site visit and write the report?Watch for a senior seller and a junior doer.
- Have you worked with organizations like ours?An office, a substation and a jobsite have different risks.
- Can I see a redacted sample report?You should know what you're paying for.
- What exactly is in scope, and what isn't?Buildings, interviews, after-dark visits, a briefing.
- How will findings be prioritized?By risk and cost, not as one long list.
- Will every recommendation mean buying equipment?Many fixes are habits, training and procedures.
- How will you protect our report and information?Your report lists exactly where your site is vulnerable, so it should be handled like sensitive information. A good answer covers who gets copies, how it's stored and sent, whether they'll sign a confidentiality agreement, and what happens to their copies when the work is done.
- Do you carry professional liability insurance?Ask for a certificate.