Security often reaches the board only when something has gone wrong. In between, it may appear as a line in a facilities report or not at all. That leaves directors unable to judge whether the organisation is adequately protected, or whether the money being spent is making a difference.
A short, regular security report fixes this. It does not need to be technical, and it should fit on one page.
1. Incidents and near misses
The number and type of security incidents in the period, compared with previous periods, with a sentence on anything significant. Near misses matter as much as incidents: they show where controls almost failed.
2. Open findings
Recommendations from risk assessments, surveys or audits that are still outstanding, with their age and owner. A finding that has been open for a year is a decision, whether or not anyone made it.
3. Status of key controls
A simple status for the controls that matter most — access control, alarms and monitoring, CCTV, guard coverage, screening — showing whether each is working, degraded or failed.
4. Training and compliance
The share of staff and security officers who have completed required training, and the status of obligations such as data protection registration.
5. Spending against risk
Security spending for the period, mapped to the main risks it addresses. This helps the board see whether resources follow priorities.
What this means in practice
- Agree a one-page security report format with the board or executive.
- Report quarterly, not only after incidents.
- Show trends over time, not just this period's numbers.
- Name an owner for every open finding.
Talk to us about security governance and board reporting. → Bespoke security management
