A security risk management report usually gets opened when the event is close, the venue is busy, and someone asks whether the controls will stand up to scrutiny. That's the wrong time to discover that the contractor list is incomplete, the emergency access route is blocked, or a payment-system outage would also disable queue control and CCTV. A useful report gives operators a defensible way to make those decisions before people arrive.
For Australian festivals, venues, retail centres and construction sites, the document must do more than list guards, cameras and hazards. It should connect physical security, cyber-physical dependencies, supplier exposure, compliance duties and residual risk into one operational record.
What a Security Risk Management Report Actually Does
A security risk management report is a decision document, not a compliance artefact. It tells the organiser, venue manager or project director which risks matter, what controls will be applied, who owns each action, and whether the remaining exposure is acceptable.
The Australian National Audit Office describes a broad security risk management process aligned with AS/NZS ISO 31000 and HB 167, covering context, risk identification, analysis, evaluation, treatment, and ongoing monitoring and review. The ANAO security risk management report provides the foundation for this sequence.
The seven stages that make the report useful
- Establish context: Define the site, activity, operating environment, assets, stakeholders and dependencies.
- Set scope: State what the report covers, what it excludes, the assessment period and the assumptions being used.
- Identify risks: Record threats affecting people, places, information, systems, suppliers and operations.
- Analyse risks: Assess likelihood and consequence using terms that operational staff can apply consistently.
- Evaluate risks: Compare the rating with the organisation's risk appetite and decide which risks require treatment.
- Treat risks: Assign controls, owners, target dates, verification methods and residual ratings.
- Monitor, review and communicate: Track performance, record changes and present decisions to people who can act.
The report should leave an auditable trail from a risk source to a control and then to evidence that the control worked. A tick-box register might say “CCTV in place”. A stronger entry identifies the camera zone, the responsible supervisor, the inspection record, the outage escalation path and the residual risk after the control is tested.
Practical rule: If nobody can identify the owner, deadline and verification evidence for a control, it isn't an operational control yet.
The distinction becomes obvious after an incident. If a festival report is written after a crowd surge, it may describe what happened, but it won't prove why the entry layout, barrier design, contractor briefings or radio plan were selected beforehand. A pre-event report gives the duty manager something to run, not merely something to file.
Operators building an event-specific assessment can also use this football risk assessment guide as a practical reference for translating crowd, venue and match-day issues into structured planning questions.
Setting the Context and Scope for Your Site or Event
Two operations in the same city can require completely different security risk management reports. A 15,000-person music festival has concentrated arrival and departure periods, temporary infrastructure, crowd movement, alcohol service, artist protection and transport pressure. A 240-person late-night venue may have a smaller footprint but faces tighter conditions around intoxication, ejection, staff fatigue, neighbouring premises and closing-time dispersal.
Start with the operating context, not the preferred control. Record the location, opening and closing times, patron or worker profile, adjacent land use, seasonal conditions, public transport, emergency access, lighting, communications and the people responsible for decisions. Then identify dependencies such as power, internet connectivity, point-of-sale systems, CCTV storage, access control, ticketing, cleaning, traffic management and security providers.
A one-page context template
| Field | Example, Festival | Example, Late-Night Venue |
|---|---|---|
| Site and location | Temporary outdoor grounds near transport routes | Licensed premises in a mixed-use entertainment area |
| Operating hours | Load-in, gates, performances, egress and pack-down | Trading, last entry, closing and dispersal |
| People profile | Large mixed-age audience, artists, contractors and volunteers | Adult patrons, venue staff, performers and delivery workers |
| Adjacent land use | Roads, residences, car parks and public pathways | Neighbours, taxi rank, adjoining venues and public footpaths |
| Critical dependencies | Power, ticketing, radios, CCTV, barriers and traffic contractor | POS, access control, CCTV, RSA processes and communications |
| Asset register columns | Asset, location, owner, dependency, threat, control, evidence | Asset, location, owner, dependency, threat, control, evidence |
| Assumptions log | Weather, attendance, performer schedule and supplier availability | Patron numbers, staffing, licensing conditions and trading pattern |
| Exclusions | Uncontrolled public roads unless separately assessed | Police response outside the premises boundary |
Define exclusions as carefully as inclusions. “The event site” is too vague if it doesn't state whether queues, car parks, artist accommodation, delivery routes, neighbouring land and digital ticketing are included. Auditors and investigators need to know where the assessment boundary sits.
A good context page also names the risk appetite or approval authority. If management accepts a residual risk, record who made that decision and what conditions apply. The output becomes the input for identification, because assessors can now test risks against a clearly described environment rather than a generic site label.
Identifying Risks Across People, Places and Partners
Risk identification works best when the assessor combines documents with observation. Start with a desktop review of relevant police information, ASIO advisories, previous incident records, licensing conditions, site plans, contractor scopes and emergency arrangements. Those sources show what people expect to happen. A walk-through shows what happens when queues form, lighting changes, deliveries arrive or staff become tired.
Use the festival and late-night venue as parallel tests. At the festival, inspect gates before opening, during peak arrival, after dark and during egress. Look for crossflows, pinch points, fence movement, unauthorised access, inadequate separation between vehicles and pedestrians, and radio dead zones. At the venue, examine the entry line, bar, toilets, smoking area, dance floor, stairways and street frontage during normal trading and close-down. The concern may be intoxication-driven aggression, but the trigger could be a refused entry, a delayed ejection or a CCTV blind spot.
Build the risk list from four evidence streams
- Desktop review: Check police and ASIO advisories, previous incidents, permits, licence conditions and site documentation.
- On-site observation: Walk the environment at different operating hours and test sightlines, lighting, access routes and communications.
- Supplier mapping: Identify every contractor with access to people, systems, keys, vehicles, credentials, data or critical equipment.
- Staff interviews: Ask duty managers, door staff, cleaners, technicians, traffic controllers and delivery teams what fails under pressure.
Every entry needs a unique ID, a clear source, the affected stakeholder and a trigger condition. “Aggression” is too broad. “Patron becomes aggressive after refused entry, with door team unable to summon a supervisor because the radio channel is congested” can be assessed and treated.
Cyber-physical dependencies belong in the same register. A POS outage can slow entry or service and create a queue. A CCTV network failure can remove verification during an ejection. Access-control downtime can force doors into manual operation, while a compromised contractor account can expose systems that operators assumed were isolated.
Safe Work Australia reports that 8 million Australians, or 41% of people aged 15 and over, have experienced at least one incident of violence, and more than 1 million incidents were work-related. Its data also records 176,100 workplace violence incidents over a 10-year period, with only about 46%, or 80,900, formally reported. Safe Work Australia's work-related violence data supports a practical conclusion: frontline reporting and supervision must be treated as core risk evidence.
Scoring Likelihood and Consequence the Australian Way
A matrix only helps when staff understand the words behind it. Use a 5×5 likelihood-by-consequence model with plain descriptors, then assess the total consequence across people, continuity, reputation and regulatory exposure. Don't create one column for cyber impact and another for physical impact. A payment outage that stops ticket validation can become a crowd-control problem, so the consequence belongs in the same decision.
Worked matrix
| Likelihood | Insignificant | Minor | Moderate | Major | Catastrophic |
|---|---|---|---|---|---|
| Rare | Low | Low | Low | Medium | High |
| Unlikely | Low | Low | Medium | High | High |
| Possible | Low | Medium | High | High | Extreme |
| Likely | Medium | High | High | Extreme | Extreme |
| Almost certain | High | High | Extreme | Extreme | Extreme |
Use Rare for an event requiring unusual conditions, Unlikely where the trigger is credible but not expected, Possible where the scenario could occur during normal operations, Likely where current conditions make occurrence reasonably expected, and Almost certain where the trigger is already present or recurring. A patrol gap, unauthorised drone, fatigue pattern or contractor onboarding delay can move a scenario between those levels.
For consequence, Insignificant means limited disruption and no meaningful injury or regulatory effect. Minor involves manageable harm or short disruption. Moderate may require medical intervention, operational adjustment or formal review. Major can involve serious harm, significant closure, substantial reputational damage or regulatory attention. Catastrophic describes multiple serious injuries, loss of life, prolonged interruption or consequences beyond the organisation's normal response capability.
Three field examples
- Festival mosh pit crowd crush: Likely / Catastrophic = Extreme.
- Late-night venue intoxicated patron ejection: Possible / Moderate = High.
- Construction site unverified subcontractor: Possible / Major = High.
After controls, re-score the likelihood and consequence independently. A redesigned barrier may reduce the likelihood of dangerous compression, but it won't make a severe consequence less serious. That distinction prevents operators from downgrading a risk merely because they've added staff.
For a broader discussion of practical control selection and risk reduction, Technovation LLC risk reduction offers useful background. The report itself still needs Australian operating context, documented evidence and an approval decision.
Building Treatment Plans That Hold Up On the Night
Treatment should follow the hierarchy of controls, not the easiest procurement decision. Adding guards is sometimes necessary, but it's often the least effective response when the layout, process or supplier behaviour creates the exposure.
For the festival crowd risk, eliminate the hazard by removing an unsafe high-density viewing position or closing a problematic entry point. Substitute a risky queue arrangement with a lower-pressure ticket validation process. Engineer the environment with a properly designed front barrier, controlled release points, monitoring positions and physical separation. Administer through staged set times, re-entry restrictions, crowd briefings and an escalation protocol. PPE has a limited role for workers, but it won't solve crowd compression.
For the late-night ejection risk, substitution could include lower-ABV service after 11pm where appropriate to the venue's operating model and licence conditions. Administrative controls include RSA-trained door staff, a supervisor decision point, two-person ejection procedures, welfare checks and an incident-log handover between shifts. The control should protect staff and patrons without turning every difficult interaction into a confrontation.
For the unverified construction subcontractor, eliminate the exposure by refusing mobilisation until identity, licence and engagement details are confirmed. Substitute uncontrolled access with escorted access where verification remains incomplete. Engineer the site with controlled gates and credential readers, administer through induction, access rules and daily swipe-card reconciliation, and use PPE only as the final worker-protection layer.
The treatment record
Each action should contain:
- Owner: The person with authority and resources to complete it.
- Target date: Before mobilisation, before gates open or before the next review.
- Residual rating: The expected risk after the control is operating.
- Verification: An inspection, test, drill, register check, CCTV review or supervisor sign-off.
A control that exists only in a plan is an intention. The verification step turns it into evidence for the after-action review.
Meeting RSA, PSPF and SOCI Compliance Head-On
Compliance belongs inside the report, not in a disconnected appendix that nobody consults during operations. Map each obligation to the risk, control, owner and evidence record. Licensing conditions in NSW, VIC and QLD should appear against the relevant entry, alcohol service, crowd management and incident response controls. ACT work health and safety duties should connect to hazard identification, worker consultation and treatment actions.
Responsible service of alcohol controls need more than a training certificate. Record how staff identify intoxication, refuse service, manage escalation, preserve incident details and hand over information at shift change. Link those measures to the venue's risk scenarios and test them during briefings.
The Protective Security Policy Framework applies where an entity handles relevant Australian Government information or assets. The PSPF requires each entity to submit a security report every financial year through the PSPF online reporting portal for information classified PROTECTED and below, or through an offline template for information above PROTECTED, with the annual report sent to the Attorney-General's Department and the entity's portfolio minister. The PSPF reporting policy sets out that reporting pathway.
The Security of Critical Infrastructure Act 2018 creates a separate obligation for responsible entities to adopt and maintain a critical infrastructure risk management program. Subsection 30AG(2) requires an annual report as evidence of compliance, generally submitted to the Department or another relevant Commonwealth regulator, such as the Reserve Bank of Australia for payment systems operators. The RMP guidance for stakeholders should be used when deciding whether a separate SOCI annexure is required.
Compliance cross-reference checklist
- Licence conditions linked to specific risk-register rows.
- RSA procedures linked to treatment actions and training evidence.
- ACT WHS duties linked to hazards, consultation and controls.
- PSPF reporting route, classification and annual recipient confirmed.
- SOCI asset class, hazard, risk and consequence material attached where relevant.
- NSW Police Force event notification requirements checked for high-risk gatherings.
- SafeWork notification pathway checked for notifiable incidents.
- Responsible approver and review date recorded.
NSW event guidance requires risks to be analysed and rated by likelihood and impact, with controls documented for legal review and future improvement. The NSW event risk assessment guidance is useful for aligning the event plan with the security report.
Monitoring, KPIs and Supplier Due Diligence That Close the Loop
A finished report sits in a drawer unless someone owns the review cycle. I use a 24-hour hot-wash, a 7-day incident review, a 30-day formal review, and a reassessment before the next comparable event or mobilisation. Each review should ask whether controls operated, whether assumptions changed and whether residual ratings still reflect reality.
A KPI is useful only when it has a source, threshold and escalation action. A dashboard might track time-to-detect from incident logs, time-to-respond from radio or dispatch records, guard-to-attendee ratio variance from rosters, CCTV uptime from system logs, access-control breach count from access reports, contractor compliance hit rate from onboarding records and near-miss reporting frequency from the incident platform. The exact threshold belongs to the operation's risk appetite, but the report must state what happens when the threshold is missed.
Supplier exposure needs its own evidence trail
Australian operators often assess their own staff carefully and then accept supplier claims without equivalent verification. McGrathNicol's Australian Risk and Security Report records that 82% of business leaders believe they have a holistic security risk management plan, while 70% fail to conduct due diligence on key suppliers. The gap is material for security providers, CCTV vendors, IT integrators, traffic contractors and crowd-management firms.
The due diligence file should check:
- Licensing: Verify the NSW Security licence, VIC Private Security registration, QLD Security Provider licence or ACT Private Agents status through the relevant state or territory register.
- Insurance: Obtain current $10M public liability and professional indemnity certificates, then verify policy dates and scope.
- Work health and safety: Review relevant WorkSafe history, enforcement information and safety systems.
- Personnel screening: Check whether ISO 18788 or AS/NZS 4421 screening expectations apply to the provider and contract.
- Cyber exposure: Request SOC 2 or equivalent assurance from vendors touching CCTV, access control, ticketing, POS or client data.
- Modern slavery: Review the supplier's modern-slavery statement for larger contracts and document any identified supply-chain concerns.
The cyber environment reinforces the need to include suppliers in the same risk picture. The ACSC recorded more than 1,200 cyber security incidents and 84,700 cybercrime reports in 2024–25, while the OAIC received 1,205 data breach notifications in 2025. The ACSC annual cyber threat report provides the cyber context, and the OAIC data breach reporting information supports the privacy reporting context.
Document who reviews the KPI dashboard, who approves supplier renewals and who accepts residual risk. For operators needing an external assessment and deployment partner, GM GROUP Services provides site-specific security risk assessments and operational security services across events, venues, retail and construction environments.
GM GROUP Services can help turn a security risk management report into practical controls, supplier checks, site supervision and event-ready procedures across NSW, VIC, QLD and the ACT. Visit GM GROUP Services to discuss an assessment for your next event, venue, retail centre or construction project.