By Olalekan Idowu Jimoh
In Nigeria’s private security industry, one question often comes up during contract negotiations: “How many guards do you need?” A client may answer, “Four.” The security company may accept the figure, prepare its quotation and proceed with deployment. Everyone appears satisfied. The client believes the property is protected, while the security company has secured a contract. But there is a fundamental question both parties may have failed to ask: Are four guards actually enough to protect the property? This is where security risk assessment matters.
Security is not simply about placing uniformed personnel at gates, entrances and strategic points. It is about understanding the risks, identifying vulnerabilities and recommending measures to reduce them. When a security company accepts a client’s request without conducting a proper assessment, it risks providing a service that looks adequate on paper but fails when tested by a real threat.
A security company’s responsibility goes beyond supplying guards. It must help the client understand the security situation and recommend what is reasonably required to protect people, property, information and business operations. The client’s preferences and budget matter, but they should not replace professional judgement. The company must do its due diligence.
When the Client’s Request Becomes the Security Plan
Consider a fictional but realistic example. A company in Abuja engages a private security firm to protect its office, warehouse and vehicle park. During negotiations, the client requests four guards, believing this number is affordable and sufficient. The security company accepts the figure without inspecting the premises, examining the surrounding environment or assessing the likely threats. The guards are deployed. One mans the main gate, another patrols the premises, while the remaining two provide relief and cover other duties as arranged. At first, the arrangement appears to work.
However, a proper assessment might have revealed several weaknesses. The premises have two vehicle entrances, a poorly lit rear boundary, valuable goods in the warehouse and no CCTV coverage. The site also requires continuous access control, perimeter patrols and the monitoring of deliveries. Four guards may not be enough to cover these duties continuously, particularly when shift arrangements, rest periods, leave and other operational demands are considered. The company may need additional personnel, better lighting, an alarm system, CCTV, improved access control or a combination of these measures. It may even discover that some risks can be reduced through technology and better procedures rather than simply increasing the number of guards.
The point is simple: the client’s preferred number of guards is a request, not a professional security assessment. A responsible security company must establish what is required before recommending what should be supplied. Otherwise, it risks allowing the client’s budget to determine the level of protection, regardless of the actual exposure to risk.
Security Risk Assessment Must Come Before Deployment
Security Risk Assessment (SRA) is a structured process for identifying threats, examining vulnerabilities, considering the possible consequences of security incidents and deciding what measures are needed to reduce the risks to an acceptable level.
For a private security company, the process should begin before a contract is finalised or guards are deployed. It should involve a physical inspection of the site, an examination of its operating environment, discussions with the client and a review of existing security arrangements. These activities should be properly documented. The assessment should reflect the nature of the business, the value and sensitivity of its assets, the number of people using the premises, access points, operating hours, previous incidents where information is available, and the likely consequences of a security breach. The company must then determine the appropriate number of guards, deployment pattern, supervision arrangements, equipment and supporting security measures. Depending on the site, these may include radios, torches, CCTV, alarms, access control systems, perimeter lighting and emergency communication procedures. Four guards may be sufficient for one location and grossly inadequate for another. Ten guards may be justified at a high-risk facility, while a smaller team supported by appropriate technology may adequately protect a different site. The number must follow the assessment, not a general assumption.
An SRA should therefore produce more than a recommendation about personnel. It should provide a clear security plan that explains the identified risks, the proposed controls, the resources required and the responsibilities of both parties.
The Security Company Must Have the Courage to Advise
One problem that can arise in contract security is the desire to win business at almost any cost. A company may fear that recommending more guards or additional equipment will make its quotation unattractive. It may therefore accept the client’s proposed arrangement even when its assessment suggests that the arrangement is inadequate. This is poor professional practice, with potentially serious consequences.
A security company must be willing to tell a prospective client what the assessment supports, even when the recommendation costs more than the client expected. It must explain why additional guards are required, why a particular entrance needs better access control, why night patrols need to be strengthened or why an alarm system may be necessary.
The company should present its findings in writing, explain the risks associated with any proposed reduction in protection and offer reasonable options where possible. If the client cannot afford the full recommendation, the company can identify priorities, propose phased improvements and explain which risks will remain. It must not, however, present a reduced arrangement as equally effective when it is not.
There is also a duty to be honest about what guards can achieve. Guards cannot be everywhere at once, and they cannot guarantee that no crime will occur. Their effectiveness depends on proper deployment, training, supervision, equipment, information and the support of the client.
Where a client rejects a recommendation that the company considers essential, the company must decide whether it can responsibly undertake the contract under the revised conditions. In some circumstances, declining the contract may be the more professional decision. Winning business should never take precedence over providing honest advice and a service that the company can reasonably deliver.
The Client Must Understand That Security Has a Cost
Clients are entitled to ask questions about pricing, staffing and the value they will receive. They should compare quotations and demand accountability from their security providers. However, choosing the cheapest quotation without examining the security plan can be a costly mistake. The real question is not simply, “How much will four guards cost us?” It is, “What level of risk will remain if we deploy four guards, and what might it cost us if the arrangement fails?”
A client who requests fewer guards than the assessment recommends should understand the implications. The security company must explain the limitations of the proposed arrangement, identify any additional measures needed and document the agreed changes. Reducing personnel may affect patrol frequency, response arrangements, access control and the ability to cover multiple locations at the same time.
Where a client declines a recommendation, the decision should be documented, including the reasons, outstanding risks and agreed alternative controls. Both parties should retain the relevant assessment, correspondence and contract records.
This is not about frightening clients into spending more money. It is about enabling them to make informed decisions. A client may reasonably decide to accept some residual risk after considering the cost and available options. What is unacceptable is for the client to reject essential measures without understanding the consequences and then expect the original level of protection to remain unchanged.
Security expenditure should be judged against the risks it is intended to address. A higher quotation is not automatically better, just as a lower quotation is not necessarily poor. What matters is whether the proposed arrangements are appropriate, properly justified and capable of meeting the agreed security requirements.
The Cost of Ignoring Professional Advice
The financial consequences of inadequate security can extend far beyond the value of stolen goods. A security breach may result in damaged property, injury, interrupted operations, lost business, insurance disputes, legal claims and reputational harm. In some cases, the loss of records, equipment or essential supplies may disrupt an organisation for days or weeks.
Imagine a warehouse where a risk assessment identifies a poorly secured rear boundary and recommends improved lighting, stronger physical protection and additional patrol coverage. If those recommendations are rejected and a breach later occurs through that boundary, the resulting loss may be far greater than the cost of the proposed improvements. The incident may also raise questions about whether the security arrangements were appropriate and whether the risks had been properly communicated and managed.
There is another cost that receives less attention: the false sense of security created by an inadequate arrangement. Management may believe that the presence of guards means the facility is adequately protected. That belief can discourage investment in other necessary controls and leave weaknesses unaddressed.
A uniform is visible, but effective security depends on the quality of the arrangements behind it. The presence of guards alone does not establish that a site is secure.
Accountability Must Be Shared, but Not Confused
Security contracts should clearly state the duties of the security company and the obligations of the client. They should specify the number of guards, their deployment, supervision, working hours, reporting arrangements, equipment, escalation procedures and the standards against which performance will be assessed.
The security company must provide the agreed service, deploy suitable personnel, supervise operations, report incidents, follow established procedures and raise concerns when changing circumstances make the existing arrangement inadequate. It should also review the risk assessment when there are material changes in the site’s operations, threat environment or security requirements. The client, on the other hand, must provide accurate information about the premises and its operations, disclose known risks, support agreed security measures, maintain facilities under its control and respond to reasonable recommendations. Where additional resources are required, the client must decide whether to approve the proposed expenditure, accept clearly explained residual risks or pursue an alternative arrangement.
Both parties must understand the limits of their responsibilities. A signed SRA and Service Level Agreement (SLA) does not give a security company an excuse to perform poorly. Neither does a client’s refusal to fund a recommendation automatically remove the company’s liability for negligence, misconduct or failure to meet its contractual obligations. Equally, a security company should not be held automatically responsible for every incident simply because it was engaged to provide protection. Responsibility must be examined in light of the facts, the contract, the applicable law and each party’s conduct. The objective is not to create documents that either party can use to escape blame. It is to establish a sound security arrangement and a fair basis for accountability when things go wrong. Documentation is important, but it cannot replace competent service delivery or excuse a failure to meet professional and contractual duties.
Making Contract Security Work in Practice
Security companies must ensure that their sales and operations teams work together. A sales officer should not promise a level of protection that the operations team cannot deliver. Before a contract is signed, competent security personnel should review the proposed deployment to ensure that it meets the site’s requirements and can be implemented with the available resources.
Once deployment begins, incident reports, patrol records, access control logs, client feedback and supervisory inspections should inform periodic reviews. Where risks change or existing measures prove inadequate, the security plan should be revised. An assessment should not be treated as a one-off exercise completed only to secure a contract. It must remain relevant to the conditions under which the service is delivered.
Where budgets are limited, security companies should offer practical options, distinguish essential controls from desirable improvements and explain the risks associated with each option. Clients, in turn, should assess proposals on the strength of their reasoning, not price alone. Security companies must justify their charges through sound assessments, appropriate recommendations and accountable service delivery.
Professional bodies, regulators and security industry associations also have a role to play in promoting sound risk assessment practices, competent personnel and clear standards for service delivery. Better practice requires more than the deployment of guards. It requires professional advice, realistic contracts, competent supervision and a willingness by both parties to review arrangements when circumstances change.
Conclusion
The security company is the professional adviser. The client understands its own business, operations and financial limits. Both have important responsibilities, but neither should confuse preference with professional judgement. If a client requests four guards and a proper security risk assessment recommends ten, the company must explain why ten are required and what risks may remain if fewer are deployed. The client must then make an informed decision about the resources available and the level of risk it is prepared to accept. Any alternative arrangement must be understood, documented and managed. The security company must still ensure that it can meet its contractual obligations and must not misrepresent the protection the revised arrangement can provide.
The purpose of a security risk assessment is not to inflate a contract or increase a security company’s revenue. It is to ensure that the proposed security arrangements match the risks they are intended to address.
In contract security, the right question is not simply how many guards the client wants. It is what level of protection the risks demand, what resources are needed to provide it, and whether both parties are prepared to do their part. Until this principle becomes standard practice, organisations risk paying for security arrangements that satisfy their expectations on paper without adequately addressing the risks on the ground.
Author’s Note
This article expands on a subject the author addressed in 2024 during a monthly in-house security training presentation for security managers and supervisors at Festamos Security Services, where he served as Area Manager overseeing operations across the FCT and Lokoja.
About the Author
Olalekan Idowu Jimoh is a criminologist, security and strategic studies professional, researcher and consultant with experience in corporate security operations, risk management, threat assessment and security administration. He holds an MSc in Defence and Strategic Studies from the Nigerian Defence Academy and a BSc in Criminology and Security Studies from the National Open University of Nigeria. He also holds several professional certifications and maintains professional affiliations at national and international levels.
