In industrial environments, security is not a luxury, it is an operational necessity. Conducting a structured security risk assessment helps protect personnel, physical assets and operations from a wide range of threats, including unauthorised physical intrusion and operational disruption.
This guide outlines a practical approach to conducting an industrial security risk assessment aligned with ISO 31000, the international standard for risk management, and consistent with Australian regulatory and planning expectations.
Understanding the Purpose of an Industrial Security Assessment
An industrial security risk assessment is a systematic process used to identify, analyse and treat risks that may affect the safe and secure operation of a facility. It considers physical security, environmental design and operational practices, applying the risk management guidelines of ISO 31000.
Under ISO 31000, risk assessment comprises risk identification, risk analysis and risk evaluation, followed by risk treatment, and supported by ongoing monitoring, review, communication and consultation.
The objective is to reduce risk to a level that is acceptable to the organisation, using layered controls that deter, detect, delay and respond to potential threats.
CPTED principles are commonly integrated into industrial assessments to strengthen how the physical environment supports security outcomes.
Key outcomes of a well-executed assessment include:
- A prioritised risk register identifying threats and vulnerabilities
- Practical recommendations for physical and operational controls
- A clear plan for implementation, monitoring and review
- Documentation suitable for regulators, insurers and internal governance
Establishing the Context: Scope, Objectives and Criteria
The first step is to establish the context of the assessment. Clearly defining scope and criteria ensures the process remains focused and aligned with organisational objectives.
Key considerations include:
- Facility boundaries: perimeter fencing, access gates, loading docks and entry points
- Critical assets: control rooms, utility areas, hazardous material storage and high-value equipment
- Operational context: working hours, shift patterns and contractor access arrangements
- External interfaces: proximity to public areas, adjoining sites and transport corridors
- Regulatory environment: relevant Australian planning requirements, building codes and work health and safety obligations
Risk criteria must also be defined at this stage. This includes establishing how likelihood and consequence will be assessed, and determining the level of risk the organisation is willing to accept. These criteria should be measurable, consistently applied and agreed with senior management.
Communication and consultation with stakeholders should occur throughout the process to ensure the assessment reflects operational realities.
Risk Identification: What Could Happen and Why?
Risk identification involves recognising and describing events that could impact the security of the facility.
In industrial environments, common threat categories include:
- Unauthorised physical access or intrusion
- Theft of materials, equipment or products
- Vandalism or deliberate damage
- Insider threats involving staff or contractors
- Civil protest or targeted disruption
- Environmental or site-specific hazards
Applying CPTED principles strengthens this step by assessing how the physical environment influences behaviour. Consider:
- Visibility of entry points and critical assets
- Presence of blind spots or concealed areas
- Effectiveness of natural surveillance from active work zones
- Clarity of boundaries between public and restricted areas
- Movement patterns of personnel, visitors and vehicles
Each identified risk should be recorded with a clear description of the source, the affected asset and potential consequences. This forms the basis of the risk register.
Risk Analysis: Understanding Likelihood and Consequence
Risk analysis examines the nature of each identified risk and assesses its likelihood and potential impact.
This involves reviewing vulnerabilities that could allow a threat to occur, including:
- Perimeter conditions: fencing integrity, gate control and vehicle access points
- Access arrangements: visitor management, sign-in procedures and restricted area controls
- Visibility and lighting: poorly lit areas, glare or obstructions affecting sightlines
- Asset protection: storage security, locked enclosures and separation of sensitive areas
- Operational practices: incident reporting, supervision and contractor management
Existing controls should be assessed to determine how effectively they reduce risk. Information sources may include site inspections, staff consultation, maintenance records and incident history.
Risk Evaluation: Prioritising What Matters Most
Risk evaluation compares the results of the analysis against the established risk criteria to determine which risks require treatment.
Key steps include:
- Assigning a risk level based on likelihood and consequence
- Comparing results against the organisation’s risk appetite
- Identifying which risks are acceptable and which require further action
- Prioritising risks based on their potential impact on safety, operations and compliance
Consideration should also be given to how risks may interact or escalate, particularly where a single failure could affect multiple parts of the operation.
All outcomes should be clearly documented in a risk register to support decision-making and accountability.
Risk Treatment: Selecting Physical and Operational Controls
Risk treatment involves selecting and implementing measures to modify risk. In industrial security, this is typically achieved through a layered approach that combines physical, environmental and procedural controls.
Treatment strategies align with ISO 31000 and may include reducing likelihood, reducing consequence or retaining risk based on informed decisions.
Common control measures include:
- Perimeter security: fencing upgrades, secure gates, vehicle barriers and bollards
- Access management: controlled entry points, identification procedures and visitor management
- Lighting and visibility: adequate illumination and clear sightlines to support surveillance
- Environmental design: removal of concealment areas and landscaping that reinforces territorial boundaries
- Response capability: defined procedures for managing incidents and coordinating with local authorities
Controls should be practical, proportionate to the level of risk and compatible with operational requirements. Residual risk should be documented and accepted through appropriate governance processes.
Implementation Planning: Roadmap and Responsibilities
A security risk assessment is only as good as its implementation. Develop a practical plan that assigns responsibilities, timelines, and resources. An effective plan includes:
- Prioritised treatment actions with defined timeframes
- Allocation of responsibilities across relevant teams
- Budget considerations and justification for proposed measures
- Milestones for testing and reviewing controls
- Ongoing oversight by senior management
Where physical works are proposed, such as fencing, lighting or structural elements, any required development application should be lodged with the relevant local council or planning authority before works commence.
Monitoring, Review and Continuous Improvement
ISO 31000 emphasises that risk management is an ongoing process. Industrial environments are dynamic, and security risks evolve over time.
Ongoing activities should include:
- Regular inspections and security audits
- Review of incidents and near-miss events
- Testing of physical security measures and response procedures
- Periodic CPTED reassessments following site changes
- Continuous engagement with staff and contractors
Maintaining an active review process ensures controls remain effective and aligned with current risks.
Compliance and Documentation
Comprehensive documentation demonstrates due diligence and supports compliance with regulatory and insurance requirements.
Key records include:
- Risk assessment reports and risk registers
- Site plans showing security features and CPTED-informed layouts
- Maintenance and inspection records for physical security measures
- Incident logs and corrective actions
- Training and induction records
Where upgrades involve construction or external works, approvals must be obtained through applications lodged with the appropriate authority. Well-maintained documentation also supports audits, reporting and continuous improvement.
Final Thoughts
Conducting an industrial security risk assessment aligned with ISO 31000 provides a structured and defensible approach to protecting people, assets and operations.
By integrating physical security measures, CPTED principles and sound risk management practices, organisations can improve resilience, support compliance and make informed investment decisions that deliver long-term value.
Reach out today or call (02) 9191 9771 to schedule your consultation and take the next step toward a more secure and resilient site.
About the Author
Simon Pollak is the Principal Consultant at CPTED Australia. He is a Fellow of the Australian Security Industry Association (FASIAL), a Certified Information Systems Security Professional (CISSP), holds a Master of Cyber Security, and is a licensed security consultant. His practice covers CPTED assessments, security risk assessments and security strategy for developments and venues across Australia.