Crisis management for security guard companies

The phone goes at 2am. There has been a shooting at a client site and your officer was involved. The next four hours will decide whether you still have that contract, that insurance policy and that officer in six months.

What counts as a crisis?

Not every incident. Most of what your officers file is routine, and treating it as a crisis burns out the response you will need later.

A crisis is anything that can outlive the shift. Two families.

Incident-driven. A death or serious injury, whether it is your officer, a client employee or a member of the public. Active violence. A major breach, a fire, a natural disaster on your watch. And the one that does the most damage per occurrence: misconduct or a criminal act by one of your own guards.

Company-level. No single incident, but the same threat. A news story, accurate or not. A lawsuit with real exposure. A regulator opening a file. The abrupt loss of the account that carries your payroll.

The classification matters because it determines who wakes up. Write the criteria down. A supervisor at 3am should be able to read one page and know whether to call you.

What do you set up before anything happens?

Everything that will feel obvious afterward.

You need a crisis team, even if the whole company is you and one operations manager. Roles, not job titles:

• Who runs the response
• Who talks to the client
• Who talks to media, if anyone does
• Who calls counsel and the insurer
• Who has authority to decide when the owner is unreachable or on a plane

Name a backup for every one of those. Crises do not check availability. Then build the contact chain with numbers that work at 3am, which means mobile numbers, not the office line, and test it twice a year by actually calling.

Write the plan. Classification criteria, notification order, response steps by incident type, a holding statement you can adapt in ninety seconds, and a resource list: insurer, counsel, the client's after-hours contact, local emergency management. An incident response playbook gives you the format, and a security escalation matrix settles who gets called at which threshold.

Then rehearse it. A tabletop takes ninety minutes and finds the holes: a guard is accused of assault, a reporter is in your lobby, a client demands the officer's personnel file. The federal Ready.gov continuity planning guidance is free and includes a situation manual and an exercise facilitator handbook, which is more structure than most small companies will build themselves.

What do you do in the first hour?

The errors that cannot be undone all happen here: a scene disturbed, an admission made, a notification missed.

Cooperate fully with police and understand what you are cooperating with. Their investigation answers their questions, not yours. You still need your own record of what happened, built in parallel, which is why the incident report your officer writes matters as much as the police report does.

A note on the officer at the center of it. They have just been through something, and they are also the person whose account you need. Get them somewhere quiet, get the account while it is fresh, and get them looked after. Both things are your job.

Who do you tell, and in what order?

Fixed sequence, decided in advance, no improvising.

1. Emergency services, where anyone is hurt or a threat is live.
2. Your crisis lead, who takes it from there.
3. The client. Fast. A client who learns about an incident at their own building from a reporter or a tenant has learned something about you that no amount of later handling fixes.
4. Your insurer. Most policies carry notification requirements and late notice can put coverage at risk, which is worth reading up front in your general liability policy and the rest of your coverage stack.
5. Counsel, early, on anything with real exposure. An hour of advice at the start costs a fraction of the thing it prevents.

Employers also carry federal obligations to report a workplace death or severe injury to OSHA, and the deadlines are short. Look the current requirement up directly with OSHA now, put the actual deadline into your notification chain, and do not discover it during the incident.

What do you say, and to whom?

Three audiences, three different jobs.

Inside. Your team needs enough to act, and everyone who might get asked a question needs to know what to say and what not to. Silence internally does not contain a story. It just means your staff invent one.

The client. Fast, factual, no speculation. What you know, what you are doing, when you will update them next. Then actually update them when you said you would, even if the update is that nothing has changed. Log every contact. That log is what carries the relationship afterward, and it is the same discipline described in handling client complaints.

The public. One spokesperson. Only one. Verified facts only. Never speculate on cause, never assign blame, never admit liability. A short holding statement written in advance beats anything anyone improvises at a doorstep.

What has to be written down?

The record you build during the crisis is what your insurance claim, your legal defense and your client relationship all run on afterward.

Build a timeline from the first indication through resolution. Every action, with a name and a time attached. Observations of the scene. What witnesses said, in their words. Photos and video where it is appropriate to take them. Preserve the calls, emails and texts.

Then the discipline, which is the harder half:

Reports filed on a phone at the scene, carrying their own timestamp and GPS fix, are worth substantially more than a document typed up the following afternoon. That is the practical case for reporting that leaves paper behind.

What happens after it stabilizes?

The investigation does four jobs at once: establishes facts for any litigation, finds what failed, shows the client you take it seriously, and stops it recurring.

Pull the documentation together. Interview the people involved while it is still fresh. Read the actual post orders and procedures and establish whether they were followed, which is a different question from whether they were adequate. Then name the contributing factors: a training gap, a supervision lapse, equipment that did not work, a procedure that was never realistic on that site.

Findings that do not change anything are a filing exercise. Update the procedure. Run the training. Fix the equipment. Write down what you changed, because that record is what you show the client and, eventually, anyone assessing whether you learned.

Recovery is broader than the fix. People who witnessed violence or a serious injury may need real support, not a check-in text. Operations have to get back to normal without pretending nothing happened. And the client relationship needs deliberate repair, which usually means telling them plainly what went wrong and what you changed. Handled that way, a serious incident does not automatically cost the account, and keeping clients after one is mostly about how visible the correction was.

Larger events with multiple agencies on scene need a command structure rather than a phone tree. The Incident Command System is what fire and police will already be running, and knowing where you plug into it makes you useful instead of one more person on the perimeter. Keep the one-page version of your own response in every vehicle: an emergency response quick reference gets read when a binder does not.