The vast majority of security company HR managers lose sleep over the same issue: the ever more difficult quest to find reliable, SIA-licensed and professional officers who can genuinely do the job. It’s a security recruitment problem that starts long before the interview stage.

Since the start of this decade, demand for good security personnel has grown dramatically while the pool of suitably licensed people has contracted by a similar margin. Big events, the retail crime epidemic, hospital security contracts, the rise of Street Wardens, data centres popping up everywhere, and gargantuan distribution facilities are all draining what was already a shallow talent pool.

Add horrendous cost of living pressures, antisocial hours, and the abysmal public perception of private security, and you have a sector that could not be less appealing to good people.

Unfortunately, there’s an issue having an even bigger negative impact on the industry: the calibre and quality of the security personnel themselves. This problem starts with the mandatory SIA licence.

How Are Some People Getting SIA Licences?

The Security Industry Authority licence was designed as a baseline of competence and integrity. In practice, the system has weak points that bad actors have become highly adept at exploiting.

Site managers regularly inherit officers whose spoken English is minimal, who couldn’t write a coherent incident report, had no grasp of conflict management, and in some cases couldn’t give a coherent account of their own training when pressed. Yet they were still badged.

Three routes keep cropping up:

Training Malpractice

A minority of training providers still cut corners to push volume — “fast-track” courses where physical intervention may be demonstrated once, exam papers are coached, and attendance sheets are signed off despite no-shows. The SIA does audit providers, but rogue operators open, churn out candidates, and close before sanctions bite. The candidate leaves with a certificate, the provider banks the cash, and the employer takes on the risk.

Identity and Exam Fraud

Impersonation at exams isn’t new, and neither is the selling of answers. Organised groups target centres with lax ID checks. Once the certificate is issued, the SIA application process relies on that certificate being genuine — turning the licence into a passport into the industry for someone who was never properly assessed.

Organised Crime Adapts

The SIA’s criminality checks are robust, but they depend on declared identities and convictions. False documents, undisclosed overseas convictions, and the time lag between charge and conviction all create gaps. When an unsuitable individual gets a licence, every assignment they attend undermines public trust and puts clients, the public, and everyone around them at risk.

The result for employers is brutal: you spend on recruitment, vetting, uniform and onboarding, only to remove the officer within weeks. Your client loses confidence, your remaining team picks up the slack, insurance risk rises, and the good officers you do have get tarred with the same brush.

What Makes a Professional Security Officer

A professional security officer isn’t just anyone with an SIA licence. They demonstrate five key attributes before they ever step on site.

Attribute	What It Looks Like on the Ground	How Employers Verify It
Competence	Can handle conflict, write an MG11-ready statement, operate CCTV and access control	Practical assessment + documented CPD
Verified training history	Certificates from audited, reputable providers with dates and trainer names	Digital credentials, direct provider confirmation
Spotless compliance	No hidden sanctions, right to work confirmed, 5-year history checked	BS7858:2019 screening with digital audit trail
Character suitability	Punctuality, communication, adherence to assignment instructions, standard of dress, attitude	Reference data, attendance history, ratings
Digital literacy	Uses reporting and shift management apps, understands GDPR, is aware of cybersecurity	App usage data, short skills checks

If you’re hiring without evidence of those five, you’re hiring on hope. And hope isn’t a reliable vetting policy.

Raising the Bar Starts With Better Tools

The industry can’t wait for regulation to catch every loophole. It needs systems that make it harder for malpractice to enter the workforce and easier for genuine professionals to stand out. That’s where purpose-built technology changes the game.

For my money, GuardPass has become the practical answer for HR teams tired of sifting CVs and chasing paper.

Why GuardPass Shifts the Security Recruitment Dynamic

GuardPass isn’t a job board. It’s an end-to-end security recruitment system built around SIA licensing and the real workflows of UK security firms. It tackles two problems at once: keeping unqualified people out, and speeding up the hiring of the right people.

Licence-First Candidate Verification

Every candidate profile links directly to their SIA licence record. Expiry dates, sectors, conditions and suspensions update automatically — no more “I’ll bring my badge on day one” surprises. If the licence isn’t valid, the profile doesn’t reach your shortlist.

Training Provenance and CPD Tracking

GuardPass partners with audited training providers. Certificates are uploaded with provider, trainer, date and location metadata, and the system flags anomalies — like the same trainer running courses in Leeds and Plymouth on the same day. Officers also log CPD, from ACT Awareness to mental health first aid, so you see who invests in their own standards.

Digital Right to Work and BS7858:2019 Screening

The app guides candidates through compliant ID checks, share code capture, and 5-year history. HR gets a structured screening pack, not a zip file of photos, with gaps flagged before you spend time interviewing. That alone cuts screening admin by 60% for most teams.

Skills and Role Matching, Not Keyword Bingo

Roles on GuardPass are tagged by sector, site type, shifts and required competencies. Candidates complete short, scenario-based assessments for door supervision, CCTV, retail, corporate, construction and healthcare — so filtering for “conflict management + incident reporting + night shifts + Canary Wharf” surfaces people who actually match, not just people who typed those words.

Compliance-Ready Document Vault

Uniform sizes, bank details, insurance documents, licences and certificates are all stored with expiry alerts. When you onboard, you’re not chasing PDFs, and the audit trail is there if the SIA or your client asks.

Attendance and Performance Data

Once placed, officers clock in through the app, file digital incident reports, and receive site-specific assignment instructions. HR and ops see punctuality, report quality and client feedback over time, building a bench of proven officers you can redeploy first — ending the cycle of “new face, new risk” on every contract.

Fraud-Resistant Onboarding

Liveness checks and ID document NFC reads during app registration make impersonation harder. Combined with provider-verified certificates, it closes the door on the most common routes malpractice uses to get a licence into the wrong hands.

Direct Applicant Communication

In-app messaging and interview scheduling cut ghosting. Candidates pick slots, get reminders, and upload anything missing before the interview — and HR teams report show-up rates rising because the friction is gone.

Analytics for Workforce Planning

The dashboard shows licence expiries across your pool, training gaps by site, and time-to-hire by role. You can see, for example, that 14% of your door supervisors expire in September and that CCTV PSS competence is thin in Kent — letting you train or recruit before the client feels it.

Putting It Into Practice: A Better Hiring Flow

Here’s what security recruitment looks like when you use GuardPass properly.

1. Define the Real Requirement

Don’t just post “SIA DS” — tag the site type, systems used, report standards and physical requirements, so the matching engine respects it.

2. Auto-Filter for Compliance

The system hides anyone without a valid, appropriate licence, right to work, or core certificates, so you start from a clean pool.

3. Assess What Matters

Use the built-in scenario questions or upload your own — you’re testing decision making, not memory.

4. Interview With Context

You see training provenance, previous sites and performance data before the call, so the conversation starts two steps ahead.

5. One-Click Offer and Onboarding

Contracts, assignment instructions and uniform requests go out through the app. The officer accepts, completes remaining checks, and you have a start date with confidence.

The Wider Impact on Malpractice

When the major employers in a region all recruit through a system that verifies licences, checks training provenance and logs performance, the economics of malpractice collapse.

There’s no point paying a dodgy provider if the certificate won’t get you past the first filter. There’s no value in exam fraud if liveness checks catch you at onboarding. The bad actors move on, and the professionals get the work faster.

A Final Word to Hiring Managers

We won’t fix the UK’s officer shortage by lowering standards. We fix it by protecting the standards we have and making it easy to hire people who meet them. That means treating vetting as a process, not a paperwork pile. It means using data from the field to reward reliability. And it means backing tools built by the industry, for the industry.

GuardPass doesn’t replace human judgement — it gives that judgement better information, earlier. In a market where one bad hire can lose a contract, and one good hire can save it, that difference is everything.

If you’re reviewing your security recruitment process this quarter, start with two questions: Can you prove every officer’s licence and training before interview? And can you see how they actually perform once deployed? If the answer to either is no, you already know where your risk sits.

The professionals are out there. Your job is to make sure the system finds them first. Start hiring with GuardPass and build a workforce you can actually verify.

If you run a security business, BS7858 isn’t optional. It’s the standard your clients expect, the standard your ACS accreditation and NSI or SSAIB audits are measured against, and increasingly the standard written directly into contract tenders. Lose your grip on it, and you’re not just risking a failed audit. You’re risking the contracts that keep your business running.

Yet most security firms still handle vetting the most expensive way possible: in-house, on spreadsheets, with an office manager or HR person chasing references between a dozen other jobs.

Here’s what that actually costs you, and why the firms growing fastest right now have stopped doing it.

What BS7858:2019 Actually Demands

The BS7858:2019 standard is far more demanding than most operators realise. For every single hire, you need:

• Full identity verification against official documents
• Right to work checks in line with DBS identity requirements
• Five years of verified employment and activity history, with every gap over 31 days accounted for and evidenced
• A financial probity check, including credit history and insolvency records
• Global watchlist, sanctions and fraud database screening — a mandatory addition under the 2019 revision, not just the old HMG sanctions list
• A basic DBS check where the individual isn’t already SIA licensed
• Secure, GDPR-compliant record keeping: screening files retained for the full duration of employment, unsuccessful applicant files for 12 months, and specified records for up to seven years after employment ends

And critically, the standard is explicit on one point: responsibility sits with top management. If your screening process fails, the accountability is yours — whether you did the checks yourself or not. Which is exactly why who you trust with it matters so much.

The Hidden Cost Nobody Puts on a Spreadsheet

Ask most MDs what vetting costs them, and they’ll quote a DBS fee. The real number is much bigger.

Staff Time

A single BS7858 file done properly takes 8 to 12 hours of admin: chasing employers who don’t respond, verifying gaps, running credit and sanctions checks, compiling the file. At even a modest fully loaded staff cost, that’s £150 to £250 of hidden labour per candidate before you’ve paid for a single check.

Deployment Delays

Industry averages put a typical in-house BS7858 screen at 4 to 8 weeks. Every week a cleared candidate sits waiting is a week of unfilled shifts, overtime cover, or worse, a candidate who takes another offer. In this labour market, slow vetting is a recruitment problem, not just a compliance one.

Audit Exposure

Incomplete files, missing gap evidence, no documented risk assessment, inconsistent record retention. These are the findings that turn a routine ACS or NSI audit into a remediation plan — and in the worst cases, cost firms client contracts. Screening files done casually are a liability sitting in your filing cabinet.

Screening the Screeners

BS7858 requires that the people conducting vetting are themselves trained for the task. An untrained administrator doing vetting “on the side” is itself a compliance gap.

Add it up, and a “free” in-house process routinely costs £200 to £300 per hire in real terms, delivers slower clearance, and carries all of the audit risk with none of the specialist protection.

Why Outsourcing Has Become the Default for Well-Run Firms

Outsourced BS7858 screening used to be seen as a luxury. It’s now simply the cheaper, safer option — for four reasons:

• Fixed, predictable cost per check. You know exactly what each file costs. No hidden hours, no overtime, no chasing.
• Speed. Specialist providers using automated verification clear candidates in days, not weeks. Faster clearance means faster deployment and better candidate retention.
• Audit-ready files, every time. Consistent, complete, correctly retained screening files that stand up to ACS, NSI and SSAIB scrutiny without a scramble the week before your audit.
• Transferred expertise. The standard evolves — watchlist requirements, digital identity verification, right to work rules. A specialist provider keeps you current so you don’t have to.

Why GuardCheck Specifically

Plenty of providers do background checks. GuardCheck was built for the security industry, by the team behind GuardPass — the UK’s largest security recruitment platform. That matters in practice.

NSI Silver Approval

GuardCheck’s BS7858 screening methodology has been independently audited and approved by the National Security Inspectorate. For firms where ACS accreditation and client contract compliance are non-negotiable, that external mark of approval matters — it’s not a claim, it’s a verified standard.

AI-Powered Speed

GuardCheck automates document verification, gap analysis and candidate chasing — the part that eats most of your admin time. Candidates are prompted automatically, so files don’t stall waiting on paperwork.

Credits That Never Expire

Most providers push you into monthly minimums or credits that vanish if hiring slows. GuardCheck credits sit in your account until you need them. Buy for the year, use them at your pace — whether you hire two people in January or twenty in July.

GuardCheck Plus

Your own branded, bespoke onboarding form that feeds directly into vetting. Candidates complete one journey, your data is captured once, and screening starts the moment they apply. No duplicate forms, no drop-off between offer and clearance.

Security Sector Fluency

GuardCheck understands SIA licensing, ACS requirements and how TUPE transfers, subcontractor screening and rescreening actually work in this industry — because it’s the only industry it serves.

One Platform for Hiring and Vetting

Recruit through GuardPass, vet through GuardCheck, and close the gap between “candidate found” and “officer on site” to days rather than weeks.

A Quick, Honest Comparison

	In-house vetting	GuardCheck
True cost per file	£200–£300 in hidden staff time, plus check fees	One transparent fixed fee, from £49 + VAT
Typical turnaround	4–8 weeks	Days, with automated candidate chasing
Audit readiness	Depends on whoever did the file that week	Consistent, compliant files every time
Unused capacity	Staff time spent regardless of hiring volume	Credits never expire, pay only for what you use
Standard updates	You track them yourself	Built into the platform
Independent approval	None	NSI Silver approval

The Question Worth Asking

It isn’t “can we do BS7858 ourselves?” Most firms can — badly, expensively and slowly.

The question is: what is it costing you to keep doing it that way? In admin hours, in delayed deployments, in audit risk, and in the candidates who accepted another offer while their file sat in a tray.

If you’ve considered outsourcing your vetting before, the maths has only moved further in its favour. With GuardCheck, you can prove it on your own hires with a no-commitment trial: send us your next candidates, see the turnaround, see the file quality, and compare it to what you’re doing today.

Book a 15-minute walkthrough or start a trial

From 6 April 2026, changes are in force to the UK umbrella company sector that substantially alter how tax risk is allocated across labour supply chains.

Joint and Several Liability means that if an umbrella company fails to pay the correct PAYE or National Insurance Contributions, HMRC can go after recruitment agencies and end clients for the full unpaid amount. Every party in the labour supply chain becomes jointly and severally liable for tax obligations that stem from an umbrella company’s failure.

Two points are critical to understand from the outset. First, liability is joint and several, meaning HMRC can pursue any party in the chain for 100% of the unpaid amount, regardless of where the failure originated. Second, and perhaps most importantly, there is no reasonable care defence — even if an agency carried out thorough due diligence, it can still be held fully liable.

The new rules aim to combat tax non-compliance, protect workers, and level the playing field by eliminating rogue umbrella providers. The security sector is directly in scope.

How Does the Liability Chain Actually Work?

Understanding the mechanics matters because your position in the chain determines your direct exposure.

Umbrella companies remain employment intermediaries and the PAYE employer in the standard model, but they are no longer the only party potentially liable for payroll taxes where things go wrong. Where a worker is supplied via an umbrella company and there is a UK recruitment agency in the chain, the agency will generally be the party that HMRC can pursue for any PAYE and Class 1 NIC shortfall.

If the client contracts directly with the umbrella, or the agency is offshore or connected to the umbrella, the end client may instead be exposed.

Liability for the taxes occurs from the moment that a payment is due to HMRC. The liability falls on both the umbrella company and the other liable party at the same time — so technically the amount the umbrella has to pay is an amount the other liable party also owes, even though they are not the ones reporting to HMRC.

The practical implication: if your staffing agency uses an umbrella model and that umbrella fails — through insolvency, fraud, or simple non-compliance — HMRC can pursue the agency first, or you directly if the agency is offshore, connected to the umbrella, or otherwise unavailable. HMRC is under no obligation to warn you that a non-compliant umbrella is in your supply chain, and no one should rely on receiving a warning before enforcement begins.

Critically, insolvency does not extinguish the liability: HMRC can pursue you for unpaid taxes even after the umbrella company has collapsed or gone into administration. The most likely scenario in which security companies face a JSL demand is not an investigation into a live umbrella — it is post-insolvency pursuit once the umbrella itself cannot pay.

Does Joint and Several Liability Apply to Security Companies?

Yes, if umbrella companies are present in your labour supply chain — and in the security sector, they frequently are.

The reforms are primarily focused on arrangements involving umbrella companies. Where umbrella companies are used to employ and pay temporary workers, liability for unpaid PAYE and National Insurance may extend beyond the umbrella itself.

In practical terms, this applies to you if you:

• Use a staffing agency that places officers through an umbrella or third-party employment arrangement
• Use subcontractors whose payroll model you have not verified
• Have not mapped the employment structure behind every person currently filling your shifts

The security industry’s reliance on subcontracting to manage demand spikes, fill last-minute absences, and mobilise new contracts quickly makes this an active risk, not a theoretical one. The operational model that has served the industry for decades now carries a direct tax compliance dimension it did not have before April 2026.

It is worth being precise about scope: JSL applies specifically where an umbrella company is involved. Direct subcontracting between two security companies — where workers are direct employees of the subcontractor on a standard PAYE payroll — is a different arrangement. The critical question is not whether you use subcontractors, but how the people in your supply chain are actually employed and paid.

What Happens If You Are Found Liable?

The financial exposure is straightforward: HMRC can pursue any party in the chain for 100% of the unpaid amount, regardless of where the failure originated. There is no apportionment, no cap tied to your share of the relationship, and no good faith defence.

The reputational consequences in a regulated sector are arguably more damaging. If HMRC issues a recovery notice, the issue rarely remains private. It may appear in financial disclosures, auditor commentary, or media coverage. Stakeholders do not distinguish between deliberate avoidance and structural failure. Investors see unmanaged risk. Clients see instability.

For a security company, add the sector-specific consequences: ACS accreditation reviews, client contract compliance clauses triggered by tax enforcement action, and reputational damage in a relationship-driven market where your next contract win often depends on a reference from your last one.

One important misconception to address: HMRC publishes a list of known tax avoidance schemes and non-compliant umbrella operators, and some security companies assume that checking this list is sufficient protection. It is not.

JSL is a separate enforcement mechanism from the avoidance blacklist — it is a recovery tool that applies regardless of whether the umbrella in your supply chain appears on any published register. A non-compliant umbrella can generate a JSL liability without ever having been named by HMRC. Do not treat the absence of a name on the list as confirmation of compliance.

The Employment Rights Act 2025 received Royal Assent in December, and the Fair Work Agency launched on 7 April 2026 with a remit to enforce workers’ rights across the labour market. The Fair Work Agency is expected to take on direct regulation of umbrella companies from 2027, further consolidating supply chain oversight under a single enforcement body. The direction of travel is clear: the government intends to hold every party in the supply chain accountable. Security companies that treat this as a one-time compliance exercise rather than a standing operational discipline are misjudging the trajectory.

What Should Security Companies Do Now?

There is no published government checklist and no single accreditation that eliminates JSL exposure. HMRC has made clear that it expects agencies and end-clients to conduct regular, documented checks on their umbrella suppliers. Those that cannot demonstrate a reasonable process for verifying compliance may find themselves exposed.

For security companies, that translates into five concrete actions.

1. Map your supply chain in full. Identify every staffing agency and subcontractor you currently use. For each one, establish how their workers are employed — specifically, whether an umbrella company sits anywhere in the arrangement. If you cannot answer this today, that is your first priority.
   
2. Request documented PAYE compliance evidence. Ask your labour suppliers to confirm in writing that workers are employed on PAYE and that Income Tax and National Insurance are being correctly remitted to HMRC. Consider what processes are necessary to obtain comfort — potentially in real time — that PAYE and NIC have been calculated, reported through Real Time Information, disclosed on workers’ pay slips, and paid correctly and on time. Document everything you request and everything you receive.
   
3. Prefer FCSA-accredited suppliers where possible. FCSA accreditation provides independent assurance of payroll and tax compliance. Ensure umbrella partners are financially secure and consistently meeting PAYE and NIC obligations. Accreditation is not a complete defence under JSL, but it is evidence of a documented compliance process if HMRC investigates.
   
4. Review your BS7858 vetting exposure simultaneously. If you are using agency-supplied staff whose vetting status you cannot verify, you have a compliance problem that runs alongside — and compounds — your JSL exposure. An officer who is not properly vetted and whose employment arrangement is not clean creates regulatory and tax risk at the same time.
   
5. Rethink how you meet flexible demand. The operational pressure that drives subcontracting in security does not go away. What changes is the risk calculation. PAYE-employed flexible staffing, where the employment relationship is direct and the audit trail is complete, removes the JSL exposure that umbrella or agency arrangements create.

How Does JSL Interact With Other 2026 Compliance Pressures?

JSL does not sit in isolation. Security companies in 2026 are managing several concurrent compliance obligations, and they interact with each other.

BS7858 vetting remains the baseline for every security hire. The 2025 tightening of SIA criminality criteria means the standard your vetting process must meet has moved, and any agency-supplied worker whose vetting you have not verified independently represents a gap in your compliance posture.

Martyn’s Law, which received Royal Assent in April 2025 and enters enforcement no earlier than April 2027, subject to the Home Office’s implementation timeline, will require venues above 200-person capacity to demonstrate compliant security arrangements. Security companies supplying those venues will face increased scrutiny of their staffing documentation — including employment status.

The Fair Work Agency, launched on 7 April 2026, has a remit that overlaps with how security workers are employed and paid. Its enforcement focus on labour market compliance means the supply chain questions JSL raises are being examined from multiple regulatory angles simultaneously.

The companies that will navigate this period well are those that treat compliance as an integrated operational discipline — not a series of separate box-ticking exercises.

Frequently Asked Questions

How GuardPass Can Help

JSL exposure doesn’t start with a compliance failure — it starts with not knowing how the people filling your shifts are actually employed. The security companies most at risk are those operating with gaps in their supply chain visibility, relying on agency arrangements they haven’t audited, and treating staffing as an operational question rather than a compliance one.

If that’s where you are, GuardPass gives you the tools to close those gaps — from licence verification and vetting through to how you source and manage your security workforce.

The direction of travel from HMRC, the Fair Work Agency, and the SIA is consistent: every party in the labour supply chain will be held accountable. The security companies that come through this period without disruption won’t be the ones that got lucky — they’ll be the ones that made deliberate decisions about how they staff.

Disclaimer: This blog is for informational purposes only. Please verify details independently before making decisions.

There was a time when retail security in the United Kingdom could at least pretend to be a deterrent. Uniformed presence, store detectives, and the occasional well-judged apprehension created a fragile but functional ecosystem. Today, that ecosystem has fractured. The modern retail security officer stands not as an enforcer, but as a witness, often unwilling, frequently unsupported, and increasingly irrelevant.

Recent headlines paint a bleak picture. Across London and other major cities, shoplifting has surged, in some cases approaching what senior politicians have described as a “free-for-all.” Incidents have become both more frequent and more brazen, with organised groups sweeping through stores and individuals stealing in plain sight of staff and customers alike. The uncomfortable truth is that this is not merely a spike in crime; it is the predictable outcome of a system that has quietly abandoned enforcement.

The Optics Of Inaction

Security officers are now routinely criticised by the public for “doing nothing.” Social media is awash with footage of thieves calmly filling bags while uniformed guards stand by. Yet this apparent inaction is not negligence; it is policy.

Retailers, unions, and industry bodies have converged, whether intentionally or not, on a doctrine of non-intervention. Security staff are increasingly instructed to observe and report, not to intervene physically. The reasoning is simple: confrontation carries risk. Risk to staff safety, risk to corporate liability, and perhaps most significantly, risk to brand reputation in the age of trial by YouTube.

This has created an operational paradox. The very individuals employed to prevent loss are formally discouraged from preventing it. Instead, they are recast as evidence gatherers, human CCTV systems tasked with documenting crime rather than stopping it.

Zero Intervention: Valid Policy Or Admission Of Defeat?

Let’s be clear: zero intervention is not always written in policy manuals, but it is now widely embedded in practice. Reports indicate that many retail workers are effectively told not to challenge shoplifters, particularly where violence is a possibility.

The rationale is grounded in health and safety legislation. Employers have a duty of care to their staff, and rightly so. Confronting a potentially aggressive offender over low-value goods is difficult to justify in a risk assessment. However, this logic, when applied universally, results in a de facto decriminalisation of shoplifting at the point of sale.

Criminals, unsurprisingly, have noticed.

The Collapse Of Deterrence

Deterrence in retail has always been a delicate balance. CCTV, electronic stock tagging, and uniformed presence are designed not to eliminate theft entirely, but to raise the perceived risk. When that risk disappears, behaviour changes rapidly.

Data suggests that shoplifting has risen dramatically in recent years, with some areas experiencing increases of over 100% across a four-year period. In London alone, tens of thousands of cases are recorded annually, with significant year-on-year growth.

More concerning is the perception, widely shared among offenders, that consequences are unlikely. In some regions, a substantial proportion of shoplifting cases are closed with no further action, often within weeks. This creates a feedback loop: low enforcement leads to increased offending, which in turn overwhelms enforcement capacity.

The result is what frontline staff increasingly describe as ‘open season.’

When Intervention Becomes A Sackable Offence

Perhaps the most demoralising aspect of the current environment is the treatment of those who do choose to act. There have been high-profile cases of long-serving retail employees dismissed for challenging or detaining suspected shoplifters.

One such case, involving a supermarket worker intervening in a theft, drew national attention and political comment. The message to staff is unmistakable: intervene at your peril.

From a corporate perspective, the calculation is cold but rational. A wrongful detention claim, an injury, or a viral video depicting a confrontation can cost far more than the value of stolen goods. In this equation, stock loss is simply a cost of doing business.

For security professionals, however, this represents a fundamental erosion of purpose. If enforcement is penalised, and inaction is mandated, the role becomes untenable, and the image of the security industry in general takes an undeserved hammering.

Health And Safety: The Unanswerable Constraint

No serious practitioner would argue that staff should be placed at undue risk. The escalation of violence in retail environments is well documented. Incidents involving threats, weapons, and physical assault are increasingly common, often linked to organised crime gangs, repeat offenders or substance abuse.

Surveys indicate that a majority of retail workers have experienced abuse, with a significant proportion facing threats or violence. In such an environment, the imperative to prioritise staff safety is both ethical and legal.

Yet ‘health and safety’, while essential, has become a blunt instrument. It is applied uniformly, regardless of context, effectively removing discretion from trained security personnel. The experienced officer, trained in the ASCONE procedure, capable of assessing risk and acting proportionately, is treated no differently from an untrained employee.

This is not safety; it is risk avoidance at any cost, and a road to disaster.

Recommended Reading: Top 10 Characteristics Of A Good Security Officer

The YouTube Effect

Compounding these challenges is the role of social media. Platforms such as YouTube and TikTok have transformed shoplifting into a form of performance. Videos of thefts, often filmed by the perpetrators themselves, circulate widely, sometimes garnering millions of views.

For retailers, this presents a reputational nightmare. A poorly handled incident can become a viral scandal within hours. The fear of negative publicity often outweighs the financial impact of theft, reinforcing the preference for non-intervention.

From the offender’s perspective, the situation is inverted. The absence of consequences, combined with the prospect of notoriety, creates a powerful incentive. Crime becomes both low risk and high visibility.

Policing: The Missing Link

It is impossible to discuss retail security without addressing the role of law enforcement. Retailers do not operate in isolation; they are part of a broader criminal justice ecosystem. When that system falters, the effects are immediate and profound.

Criticism of police response to shoplifting is widespread. In some areas, the majority of cases are not pursued, often due to resource constraints or evidential thresholds. The historic reluctance to investigate lower-value thefts has further undermined confidence, although recent policy changes aim to address this.

Government initiatives, including increased funding and legislative reform, signal recognition of the problem. New measures seek to strengthen protections for retail workers and remove perceived loopholes that have benefited offenders.

These are welcome developments, but they remain, at present, aspirational. On the shop floor, little has changed. Unless and until there is substantial investment in Police Services, and a genuine increase in Officers on the ground, all the political aspirations and commitments are meaningless.

The Illusion Of Technological ‘Solutions’

Retailers have invested heavily in technology. CCTV, body-worn cameras, electronic tagging, and even forensic marking systems. These tools have their place, and in some cases have delivered measurable reductions in crime.

However, technology is not a substitute for enforcement. A camera may record a theft, but it does not prevent it. A tag may trigger an alarm, but without intervention, it is merely noise. Even advanced systems rely on a fundamental assumption: that there will be a response.

Without that human physical response, technology simply becomes theatre.

A No-Win Scenario

The phrase “no win” is not used lightly. Retail security in the UK is caught between competing imperatives:

• Protect staff from harm
• Protect the business from loss
• Protect the brand from reputational damage
• Operate within legal and regulatory constraints

These objectives are not always compatible. In the current climate, the balance has shifted decisively towards risk avoidance and reputational management. Loss prevention, ironically, has become secondary.

For security personnel, this creates a professional dead end. They are held accountable for losses they are not permitted to prevent, criticised for inaction they are instructed to maintain, and exposed to risk without meaningful authority.

The Only Viable Way Forward

There is no technological fix, no policy tweak, and no training programme that can resolve this imbalance in isolation. The fundamental issue is one of consequence.

Until shoplifting carries a credible risk of detection, arrest, and sanction, it will continue to grow. This requires a coordinated response:

• Consistent police engagement with retail crime
• Swift and visible consequences for offenders
• Clear, unified guidelines for intervention
• Legal protections for staff acting in good faith

Without these elements, the current trajectory will persist.

Retailers can continue to invest millions in prevention, but without enforcement, these efforts amount to little more than containment. As one industry figure put it, crime must have consequences.

Conclusion

Retail security in the UK has not failed; it has been systematically disarmed. The shift towards non-intervention, driven by legitimate concerns over safety and liability, has created an environment in which theft can flourish with minimal resistance.

Security officers have become spectators in their own domain, tasked with documenting a problem they are powerless to solve. It is a situation that satisfies no one: not the staff, not the retailers, and certainly not the public.

Until the balance between prevention and enforcement is restored, loss prevention will remain exactly what it has become, a no-win endeavour.

Raise The Standard Of Your Retail Security Team 

If the system has stripped officers of authority, the one thing employers still control is the calibre of the people they deploy. In an environment where every intervention is scrutinised, putting properly vetted, properly trained officers on the ground is no longer a nice-to-have — it is the difference between a defensible incident and a viral disaster.

GuardCheck delivers BS7858-compliant vetting in days rather than weeks, and GuardTrain gives your officers access to the UK’s largest training network, including conflict management modules that matter most when policy demands restraint. Professionalism is the only edge left worth investing in.

Find out how GuardPass supports retail security operations.

The UK private security industry stands on the edge of what may prove to be its most significant structural reform since the introduction of individual licensing under the Private Security Industry Act 2001. For over two decades, regulation has focused almost entirely on the individual operative. Now, attention is shifting, decisively, towards the businesses that employ them.

At the centre of this shift sits the proposed Business Approval Scheme (BAS), the successor to the long-standing Approved Contractor Scheme (ACS). To understand its significance, we must first understand why it exists at all.

How We Got Here

The current regulatory framework, overseen by the Security Industry Authority (SIA), was built on a simple principle: license the individual, and you regulate the industry. That approach has striven to deliver a baseline of competence. Today, hundreds of thousands of licensed operatives work across the UK under that system.

But there has always been a gap, one that seasoned professionals have known about for years. The SIA licenses people, not companies. There is no legal requirement for a security business itself to be approved, registered, or even inspected before trading.

The Approved Contractor Scheme was introduced to fill that gap. It is, and remains, a voluntary quality mark. Companies that opt in are assessed against standards of service delivery, management and compliance.

And therein lies the problem.

Voluntary schemes attract the willing, the better operators, the established firms, those already invested in compliance. Meanwhile, a significant proportion of the market operates entirely outside that framework. Currently, only around 750 businesses are approved, representing a small fraction of the total industry.

The result is a two-tier market: one regulated by choice, the other only by minimum legal obligations.

The Case for Change

The SIA has been candid in its assessment. The existing model is no longer sufficient to deliver consistent standards or robust public protection. The consultation launched in 2024 made that clear, seeking views on a new approach that would place “public protection at the heart” of business approval.

What followed was not a minor tweak, but a recognition that the ACS, in its current form, has reached the limits of what a voluntary scheme can achieve.

The proposed Business Approval Scheme represents a fundamental redesign. It is intended to shift the focus from process-driven audits to the outcomes that security companies actually deliver on the ground.

This is more than semantics. It signals a move away from annual, tick-box assessments towards a more intelligence-led, risk-based, model of oversight. Higher risk businesses will face greater scrutiny, and specialist providers will be expected to demonstrate sector-specific competence.

In short, the regulator is attempting to become more agile, more targeted, and more aligned with real-world risk.

How BAS Differs from the ACS

At first glance, BAS may appear to be a rebranded ACS. That would be a mistake.

The ACS was built as a quality assurance scheme, an optional badge of credibility. BAS is being designed as something closer to a regulatory framework in waiting.

Key differences are already emerging:

1. From Voluntary Badge to Strategic Lever

The ACS has always been optional. BAS, while initially likely to remain voluntary, is clearly being positioned as a stepping stone to something more formal. The language of “public protection” and “outcomes” reflects a regulatory mindset rather than a purely commercial one.

2. Risk-Based Assessment

Under the ACS, companies undergo periodic assessments, often three-yearly. BAS proposes a more dynamic model, focusing regulatory effort where the risk is greatest. This is a more modern approach, aligned with how other regulators operate.

3. Sector Specific Standards

The new scheme is expected to introduce enhanced requirements for specialist sectors, events, healthcare, and critical infrastructure, recognising that one-size-fits-all standards are no longer adequate.

4. Greater Emphasis on Service Delivery

There is a clear intention to shift assessment time towards how services are actually delivered, rather than purely how systems are documented.

Taken together, these changes represent a move from compliance on paper to performance in practice.

The Impact on Security Companies

For reputable operators, the direction of travel will feel familiar, perhaps even overdue. Many already operate to standards that exceed those currently required by the ACS.

However, BAS will raise the bar in several important ways.

First, it will demand greater transparency. Companies will need to demonstrate not just that they have policies, but that those policies are effective. That means better data, better reporting, and stronger governance.

Second, it will increase scrutiny on labour models. Issues such as subcontracting, use of labour providers, and employment practices will come under closer examination. For those operating on razor-thin margins, that scrutiny may prove uncomfortable.

Third, it will widen the gap between compliant and non-compliant businesses. Those already invested in quality will adapt. Those relying on minimal compliance, or worse, will find it increasingly difficult to compete in a market where clients are encouraged to look beyond price.

The Link to Mandatory Business Licensing

We cannot discuss BAS without addressing the larger question: is this a precursor to mandatory business licensing?

The honest answer is yes. At least in principle….

The SIA itself has acknowledged that any move to mandatory licensing would require government approval and legislative change. But the direction of travel is unmistakable. The development of BAS sits alongside wider consultation on business licensing, described by many as a “defining moment” for the industry.

Why does this matter?

Because mandatory licensing would fundamentally change the industry landscape. For the first time, every security business, not just individuals, would need to meet defined standards to operate legally.

That would address one of the sector’s most persistent weaknesses: the ability of poor or unethical operators to enter the market with minimal oversight.

BAS, in this context, can be seen as both a testing ground and a bridge. It allows the SIA to refine standards, develop assessment models, and build industry consensus before any legislative step is taken.

Risks and Realities

There are, of course, risks.

If BAS remains voluntary, it may struggle to achieve the scale required to drive meaningful change. The same structural limitation that affects the ACS could persist.

If it becomes mandatory, the challenge shifts to proportionality. Over-regulation could stifle smaller, legitimate businesses, particularly in a sector already under intense commercial pressure.

There is also the question of enforcement. Standards, however well designed, are only as effective as the resources and mechanisms used to enforce them.

What It Means for Clients

Clients, as ever, play a critical role.

A more robust business approval framework, whether voluntary or mandatory, will only deliver its intended benefits if buyers engage with it. Selecting providers based on verified standards rather than the lowest cost will be essential.

BAS offers the potential for a clearer, more meaningful benchmark of quality. But it will require clients to value that benchmark.

Recommended Reading: Why the Cheapest Bid Can Fund Organised Crime

Final Thoughts

The Business Approval Scheme is not just another industry initiative. It is a signal of intent, a recognition that the current model has limits, and that the future of security regulation must extend beyond the individual licence.

Whether BAS becomes a stepping stone to mandatory licensing or remains a strengthened voluntary framework, its impact will be significant.

For those who have long argued that the industry needs to move beyond minimum compliance, this is a moment of opportunity.

For those who have built their business on the margins of that compliance, it may be a moment of reckoning.

Either way, the message is clear: the days of light-touch oversight at the business level are numbered, and in a sector that exists to protect the public, that can only be a good thing.

Is Your Business Ready for What’s Coming?

Whether BAS remains voluntary or becomes mandatory, the direction is clear: standards are rising. GuardPass helps security companies stay ahead — connecting you with SIA-licensed professionals through the UK’s largest talent pool, with BS7858-compliant vetting through GuardCheck built in from the start.

See how GuardPass supports compliant security operations →