BS 7499 Static Guarding Audit Checklist (2026)

Last updated: 19 October 2026

A BS 7499 static guarding audit checklist is a structured evidence review that tests a security contractor's static guarding operation against BS 7499:2020, the British Standard code of practice covering assignment instructions, control room procedures, incident recording and officer welfare checks. It is used by SIA assessors, NSI and SSAIB auditors, and clients running their own contract due diligence.

Key Takeaways

• BS 7499:2020 is the current BSI code of practice for static guarding security services, published by the British Standards Institution and referenced directly in gov.uk guidance on British standards for private security.
• Under BS 7499, security officers must receive a welfare check at least once a month from a supervisor or manager, by phone or site visit, logged in writing — per NSI Technical Bulletin No. 0025.
• BS 7499 requires incident records to be kept for a minimum of 12 months from the date of the event, numbered sequentially with time, date and controller's name — per BSI Standards Publication BS 7499:2020.
• The SIA's Approved Contractor Scheme workbook scores businesses against 78 individual achievement indicators across seven criteria, according to Peregrine Risk Management.
• NSI Gold approved companies are inspected twice a year, covering both site visits and head office management, according to NSI Gold Installer data published by Clarion UK.
• 96.2% of checkpoints across live client operations carried a watermarked photo over a trailing 90-day period, as of July 2026 (see the Pulse Operations benchmark).

What is BS 7499 and what does it cover for static guarding?

BS 7499 is a British Standard code of practice, published by the British Standards Institution (BSI), that sets out how static guarding — fixed-location security officer deployment, as opposed to mobile patrolling — should be managed, documented and controlled. The current edition, BS 7499:2020, replaced BS 7499:2013 and tightened requirements around control room record-keeping and officer welfare.

The standard covers assignment instructions (the written brief defining a site's duties, which BS 7499 treats as a mandatory control document), control room operating procedures, check-call protocols, incident reporting formats, key and access control, and supervisor welfare checks. Gov.uk's guidance on British standards for private security lists BS 7499 alongside BS 7858 (screening) as a core reference standard the SIA expects Approved Contractors to apply.

BS 7499 is not itself a certification scheme. A contractor cannot be "BS 7499 certified" in isolation — compliance is normally assessed either through the SIA Approved Contractor Scheme (ACS) self-assessment and audit, or through third-party certification bodies such as the National Security Inspectorate (NSI) or SSAIB, both of which use it as a benchmark within their Gold and Silver guarding schemes.

Who is responsible for carrying out a BS 7499 audit?

Responsibility for a BS 7499 audit sits in one of three places, depending on the arrangement: the client commissioning the contract, the security provider's own quality function, or an independent certification body auditor. There is no single legal duty-holder named in the standard itself.

Where a security company holds SIA ACS status, the audit is formally carried out by an SIA-licensed assessment body — either NSI or SSAIB act as the certification bodies conducting the on-site assessment against the SIA Approved Contractor Scheme Assessor Guide. The contractor's own compliance manager prepares the evidence pack beforehand but does not sign off the result.

Where no formal ACS audit is contracted, many clients — particularly local authorities, shopping centres and large estates — commission their own BS 7499 compliance review as part of contract due diligence or tender evaluation. In practice, Pulse Operations sees this most often with multi-building residential estates and mixed-use developments, where the client wants documentary proof the standard is being followed building by building, not just at head-office level.

A third model is a paid third-party audit from an independent security consultancy, used when a provider wants pre-assessment assurance before an ACS reassessment, or when a client lacks the internal expertise to judge compliance themselves.

Pulse Operations on what a BS 7499 audit checklist should cover, clause by clause

Pulse Operations advises that a BS 7499 audit checklist should map directly against the standard's operational sections rather than being a generic security review. The checklist exists to test documented evidence against each clause, not just observe the site on the day.

A practical structure covers these areas:

Each row should produce a pass, minor non-conformity, or major non-conformity rating — mirroring how NSI and SSAIB structure their own ACS reports.

Pulse Operations on what documentation should be checked during a BS 7499 static guarding audit

Documentation is the core of a BS 7499 audit — an auditor working from paperwork alone can usually judge most of a site's compliance before setting foot on it. The following documents form the minimum evidence pack:

• Current assignment instructions, signed and dated, with a review history showing when duties were last updated.
• SIA licence records for every deployed officer, cross-checked against the SIA's public register.
• BS 7858 screening files — the British Standard covering pre-employment vetting for security personnel, including identity, employment history and criminal record checks where applicable.
• Training records, including induction, site-specific briefings and any refresher training.
• Incident logs or occurrence books, numbered sequentially and retained for a minimum of 12 months from the event date, per BS 7499:2020.
• Welfare check records, showing at least monthly supervisor contact per NSI Technical Bulletin No. 0025.
• Key registers and access control logs showing issue, return and authorised holders.
• Control room check-call logs evidencing the agreed call frequency was followed.

This is also precisely where paper-based operations struggle during an audit. Occurrence books get lost between shifts, welfare calls get logged in a supervisor's personal notebook rather than centrally, and assignment instructions exist as a PDF nobody has reviewed in two years. A tamper-evident digital record removes the argument entirely — Pulse Operations's own daily occurrence book is hash-chained using SHA-256 with a built-in integrity check that walks the whole chain, so an auditor can verify the log has not been edited after the fact, rather than taking a paper signature on trust.

"The burden of proof moved. Ten years ago 'we were there' closed the conversation; now clients have their own auditors, their own boards, their own doubts. The operators who thrive are the ones who treat every shift as something they can show, not just something they can say." — Mo Hassan, Founder, Pulse

Pulse Operations on how often a BS 7499 compliance audit should run on an ongoing contract

Pulse Operations advises that a BS 7499 compliance audit should run at a minimum annually for ACS-approved contractors, with more frequent internal spot checks recommended for larger or higher-risk static guarding contracts. The SIA's own ACS framework sets the baseline frequency that most of the industry follows.

Approved contractors are reassessed annually after their initial ACS assessment, and where an assessor identifies improvement needs, these must be addressed within the timeframe the assessor sets, per Pulse Operations's guide to the ACS self-assessment. Where a contractor holds NSI Gold status specifically, the frequency is higher still: NSI Gold approved companies are required to be inspected twice a year by NSI auditors, covering both site visits and head office management and administration, according to NSI Gold Installer data from Clarion UK.

On top of formal external audits, Pulse Operations recommends static guarding contractors run internal checklist reviews quarterly — checking welfare call logs, incident numbering and assignment instruction currency between the big annual events, so nothing drifts unnoticed for twelve months.

Annual audit vs continuous monitoring

The trade-off here is real. An annual or twice-yearly external audit gives a formal, third-party-verified compliance snapshot — useful for tender submissions and client assurance letters. But it is a snapshot: a site can drift out of compliance in month two and stay that way until month twelve.

Continuous monitoring — where check calls, welfare checks and incident logs are captured digitally as they happen — catches drift in real time instead of at the next scheduled audit. Pulse Operations's control room view gives operations managers exactly this: a live map, welfare check call tracking, and an Ops Health morning brief that flags gaps before an auditor ever needs to ask for them.

What are the common non-conformities found in BS 7499 audits?

The most common non-conformity in BS 7499 audits is an out-of-date or generic assignment instruction that does not reflect the site's actual current duties, risks or client requirements. Auditors treat this as a fundamental failure because the assignment instruction is meant to govern everything else an officer does.

Other recurring failures include:

• Missed or unlogged welfare checks — the monthly supervisor contact required under BS 7499 either didn't happen or wasn't recorded.
• Gaps in incident log numbering — sequential entries required by BS 7499:2020 broken by missing pages, undated entries, or handwriting that doesn't match the controller on shift.
• Incident records retained for less than the 12-month minimum, often because paper logs were archived off-site and lost.
• SIA licences expired or lapsed without the contractor noticing before an officer was rostered.
• No evidence of the required BS 7858 screening file for an officer, or a screening file missing employment history verification.
• Key registers with gaps — keys signed out but never signed back in, with no record of who held them overnight.

Most of these share a root cause: records living in disconnected places — a paper occurrence book at the site, a spreadsheet in HR, a supervisor's phone for welfare calls. Pulse Operations's compliance runway puts SIA licence expiries, BS 7858 screening, DBS checks, right-to-work documents and training records on one expiries dashboard, so a lapsed licence shows up as a flagged gap weeks before an audit, not during one.

Case in point: a 16-building estate proving every patrol

A prestige central-London residential estate running one nightly round across 16 buildings faced exactly this exposure before working with Pulse Operations (built inside the founding team's own London security and FM operation, Priority First, before being offered to other operators). Multi-building rounds are where patrols quietly go missing, and the estate had no way to see delivered-versus-contracted patrols without phoning the office. Each building was set up as its own site in Pulse, with its own checkpoints and evidence trail, and recurring faults now surface automatically as recurring findings in the client portal. Since going live in March 2026, the estate has recorded over 4,100 patrols — roughly 250 to 280 per building — with 100% of checkpoint completions photo-verified, up from a system that relied on one vague "round complete" message.

How does BS 7499 differ from BS 7858, BS 7984 and ISO 18788?

BS 7499 covers static guarding operations specifically — the procedures, documentation and control room standards for officers deployed at a fixed site. It is frequently confused with adjacent standards covering different parts of the security lifecycle.

A static guarding contractor will typically need to evidence BS 7499 and BS 7858 together — the ACS self-assessment workbook checks how well a contractor applies BS 7858 for screening as part of its "People" criterion, alongside BS 7499 for the operational guarding standard itself, per Pulse Operations's guide to the ACS self-assessment. A keyholding and alarm response provider would instead be assessed primarily against BS 7984.

What steps prepare a static guarding site for a BS 7499 audit?

Preparing a site for a BS 7499 audit means assembling and reconciling documentary evidence before the auditor arrives, not scrambling to find it on the day. A realistic preparation timeline runs two to four weeks for a single site, longer for a multi-site estate.

Practical preparation steps:

1. Pull the current assignment instruction and confirm its last review date matches site reality.
2. Cross-check every rostered officer's SIA licence against the public SIA register.
3. Audit welfare check logs for gaps in the required monthly supervisor contact.
4. Reconcile the incident log numbering — check no entries are missing, undated, or unsigned.
5. Check BS 7858 screening files are complete and up to date for each officer on site.
6. Verify key registers balance — every key issued has a corresponding return or current holder recorded.
7. Confirm training records are current, including site-specific induction for any recently deployed officer.
8. Brief the site team on what the auditor will ask and where records are kept.

This is exactly the exercise Pulse Operations ran when onboarding three London buildings for Priority First in a single July fortnight: checkpoints, site notes, prior incidents and officer inductions were live in the platform before officers arrived, so site history existed from day one rather than sitting in someone's head. What would traditionally take weeks of bedding in was compressed into a fortnight precisely because the compliance evidence didn't need chasing after the fact.

What qualifications should a BS 7499 auditor hold?

A credible BS 7499 auditor should hold formal assessor accreditation through a recognised certification body — typically NSI or SSAIB — or operate as a qualified security consultant with demonstrable audit experience against British Standards. There is no single statutory qualification mandated for independent third-party BS 7499 auditors outside the formal ACS scheme.

For SIA ACS purposes, assessments are carried out by assessors operating under NSI's or SSAIB's certification body status, following the SIA Approved Contractor Scheme Assessor Guide. These assessors review staff files and payroll records, contracts and duty rotas, policies and procedures, and site documentation; they also interview staff and customers and visit operational sites, per Pulse Operations's guide to the ACS self-assessment. An auditor without this grounding risks missing clause-level detail that a generalist health and safety consultant would not know to check.

Your BS 7499 static guarding audit checklist

• Confirm current assignment instructions are signed, dated and reflect actual site duties.
• Check every officer's SIA licence against the public SIA register before the audit date.
• Verify BS 7858 screening files are complete for all deployed personnel.
• Review welfare check logs for at least monthly supervisor contact, properly recorded.
• Audit the incident log for sequential numbering, full dates, times and controller names, retained 12 months minimum.
• Reconcile key registers so every issued key has a return or current holder on record.
• Check training and induction records are current, especially for recently deployed officers.
• Schedule the next audit — annually at minimum, twice yearly if targeting NSI Gold.

FAQ

What is BS 7499 and why does it matter for static guarding companies?

BS 7499 is the British Standard code of practice for static guarding security services, published by the BSI. It matters because SIA ACS assessors, NSI and SSAIB auditors all use it as the benchmark for judging a static guarding operation's documentation and control procedures.

What is the difference between BS 7499:2013 and BS 7499:2020?

BS 7499:2020 is the current edition and replaced the 2013 version, with updated requirements around control room records and welfare check logging detailed in NSI's technical bulletin on the standard. Contractors still referencing the 2013 edition in their policies should update documentation to reflect the current standard.

Is BS 7499 certification mandatory for SIA ACS approval?

BS 7499 compliance is not a standalone certification but is assessed as part of the SIA's Approved Contractor Scheme, which scores businesses against 78 individual achievement indicators, according to Peregrine Risk Management. ACS approval is voluntary but commercially expected by most large clients and public sector tenders.

How long must incident records be kept under BS 7499?

BS 7499 requires incident records to be retained for a minimum of 12 months from the date of the event, with entries numbered sequentially and including time, date and the controller's name, per BS 7499:2020. Many contractors retain records longer to support insurance claims or contract disputes.

How often must security officers receive welfare checks under BS 7499?

Security officers must receive a welfare check at least once a month from a supervisor or manager, conducted by phone or site visit and logged, per NSI Technical Bulletin No. 0025. This is a minimum frequency — higher-risk lone-working sites typically require more frequent contact.

How many companies hold SIA Approved Contractor status in the UK?

There are 6,297 Private Security Services businesses in the UK, with only 838 holding SIA Approved Contractor status as of March 2022, according to Advantage One Security citing IBIS World. That gap illustrates how few contractors clear the ACS bar that BS 7499 compliance feeds into.

Where can a static guarding company get a practical audit checklist template?

A clause-by-clause checklist can be built directly from the structure in this article, mapping assignment instructions, control room procedures, incident recording and welfare checks against documentary evidence. Pulse Operations's guide to evidencing the ACS self-assessment sets out the ten pieces of evidence assessors expect to see ready before any formal assessment visit.

Proving BS 7499 compliance with Pulse Operations

A BS 7499 audit checklist is only as strong as the records behind it, and most contractors lose points not because the guarding is poor but because the paperwork can't prove it was done. Pulse Operations's compliance runway puts SIA licences, BS 7858 screening, DBS checks, right-to-work documents and training records on one expiries timeline, while the hash-chained daily occurrence book gives auditors a tamper-evident incident log they can verify rather than trust.

Every checkpoint on Pulse Operations is completed by a mandatory watermarked photograph — officer, site, GPS and time — rather than a tag scan, which means the assignment instruction's duties and the patrol record sit in the same system an auditor can open directly. Pulse Operations's control room also logs welfare check calls centrally, closing the single most common BS 7499 non-conformity before an assessor ever asks for the log.

If a BS 7499 or ACS reassessment is approaching, book a conversation with Pulse Operations to see how the compliance runway and client portal would present your evidence pack — most operators move across within a fortnight using the guided setup and parallel-run process.

Related Reading

• ACS Audit Checklist 2026: SIA Assessment Guide (UK)
• SIA ACS Self-Assessment Workbook: 2026 UK Guide
• How to Get SIA Approved Contractor Status (2026 Guide)

★ Add pulse-operations.co.uk as a preferred source on Google