Assessments generate findings. Findings only protect anyone once they become work that somebody does. The gap between those two things is where most preparedness programmes quietly fail.
Why findings die
Almost always for the same four reasons:
- No owner. "The team" will not do it. A named role will.
- No date. "As soon as possible" is not a date, and never arrives.
- No priority. If eighteen things are equally important, nothing is.
- Nothing chases it. A list nobody looks at is a list nobody does.
Fix those four and most of the problem goes away. None of them require software — but all of them are easier when something is keeping score.
What a good action looks like
Six fields, and all six matter:
- What. Specific enough that someone else could do it. "Improve lockdown" is not an action. "Fit a thumb-turn lock to the rear fire door so it can be secured from inside" is.
- Priority. Honest, and used sparingly. If everything is high priority, the dashboard stops meaning anything.
- Owner. A named role. One of them, not a committee.
- Target date. A real one, agreed with the owner rather than imposed on them.
- Status. Not started, in progress, done — visible without asking anyone.
- Evidence. A photograph of the fitted lock, the invoice, the briefing record. "Done" without evidence is a claim.
Prioritise by what it changes, not by how hard it is
The instinct is to do the easy things first. A better test: if something happened next week, which of these would have mattered? Briefing the duty managers on the lockdown signal costs nothing and changes the outcome. Replacing the glazing is expensive and slow. Do both — but do not let the second delay the first.
Overdue is information, not failure
Things slip. Suppliers are slow, budgets move, the person who owned it left. An overdue action is not a scandal — but an overdue action nobody has looked at in three months is.
What matters is that overdue items are visible, that someone sees them regularly, and that each one gets a decision: do it, re-date it with a reason, or close it with a reason. Silent drift is the failure mode, not the delay itself.
Reviews: the thing that keeps it true
Protective preparedness is not a one-off exercise. Circumstances change. Staff change. Buildings change. Events occur. Actions are completed and new actions arise.
Two kinds of review are worth running:
The scheduled review
A date in the diary, kept whether or not anything has obviously changed. Work through the assessment, the four procedures and the open actions. Ask: is any of this no longer true? Monthly is realistic for a busy venue; annually is the bare minimum for anywhere.
The triggered review
Something has changed, so the arrangements need checking now. Common triggers:
- A change of Responsible Person, or of duty management
- Building work — new layout, blocked route, changed entrance
- A change in capacity, opening hours or the kind of events you host
- The assembly point becoming unavailable
- A new neighbouring occupier, or a change in who else operates on site
- An incident or near miss, anywhere — including one you only read about
- New or updated statutory guidance
What "demonstrating ongoing management" means
There is a real difference between having documents and managing arrangements, and it shows up in what you can produce. An organisation that is actually managing this can show:
- When assessments were completed
- When arrangements were reviewed
- What actions were identified
- Who was responsible
- When actions were completed
- What remains outstanding
- What supporting information has been retained
Notice that most of those are dates and names. A folder of polished PDFs cannot produce them. A running record can — and it also happens to be far less work than reconstructing the story afterwards.
A rhythm that works
- Weekly, two minutes: glance at overdue and high-priority actions.
- Monthly, twenty minutes: work the open action list — chase, re-date or close each one.
- On any trigger: review the affected part, and record what you changed.
- Annually, half a day: the whole assessment, all four procedures, and the numbers behind your tier.
That is a manageable amount of work for a person with a day job — which is the only kind of person who is ever going to do it.
This article is general guidance, not legal advice, and it is not a substitute for the statutory guidance. For definitive information about whether your premises or event is within scope and what is required, refer to the current statutory guidance issued under the Terrorism (Protection of Premises) Act 2025.