Compliance & Regulation Security Industry

How to Prepare for an ACS Audit: A Practical Checklist for UK Security Companies

Practical checklist for UK security companies preparing for an ACS audit. Know what inspectors look for and how to ensure your documentation is always ready.

By Michael Bryce · 28 March 2026 · Updated 6 October 2026 · 7 min read

For ACS compliance, this is important. An ACS audit is not a surprise inspection. You know it is coming, you have a date, and you have time to prepare. The companies that struggle are not the ones who are blindsided. They are the ones who have not built and maintained the right systems in the months before the assessor arrives.

This guide gives you a practical checklist to work through as you prepare. It is organised by the records you will be asked for, not by the seven criteria in the ACS standard itself (strategy, service delivery, commercial relationship management, financial management, resource management, people, and leadership), and it covers where evidence tends to fall short and how to make sure yours is in order.

Understanding What Assessors Are Looking For

Before going through the checklist, it helps to understand how the assessment works. The assessor is there to decide, from the evidence, whether your company reaches the required achievement level against the ACS standard. They do that by sampling real activity, interviewing staff at every level, and contacting customers or suppliers to verify what you have told them, not by reading your policies line by line.

That is why evidence that reflects day-to-day operations holds up better than a paper trail assembled in the weeks before the visit: the people the assessor interviews describe how the work is actually done.

The goal is to walk into your assessment knowing that your compliance posture is real, current, and maintained year-round.

The ACS Audit Preparation Checklist

1. SIA Licence Management

[ ] Compile a complete list of all operatives and their SIA licence numbers
[ ] Verify every licence is currently in date via the SIA’s public licence checker
[ ] Confirm your monitoring system flags expiries at least 60, 30, and 7 days in advance
[ ] Ensure no operative is currently scheduled on site with an expired or unknown licence status
[ ] Confirm your records distinguish between licensable operatives and staff whose roles involve no licensable activity, such as office admin

2. BS 7858 Vetting

[ ] Confirm all current staff have a complete five-year employment and identity check on file
[ ] Check vetting records are stored securely and are accessible for review
[ ] Verify the format and depth of vetting meets the current BS 7858 standard
[ ] Confirm there is a process for reviewing vetting when staff are promoted, change roles, or when a specified period elapses
[ ] Check that any staff with gaps in their employment history have had those gaps addressed and documented

3. Training and Development

[ ] Produce a training matrix showing every operative’s qualifications and certificate expiry dates
[ ] Identify any operatives with expired qualifications and resolve before the audit
[ ] Confirm induction training is documented for all staff
[ ] Evidence any CPD or ongoing training that has taken place
[ ] Confirm management and supervisor training records are maintained too

4. Assignment Instructions

[ ] Confirm every active site has a current, site-specific assignment instruction document
[ ] Check the last review date on each document and update any that are out of date
[ ] Ensure guards have signed to confirm they have read and understood the instructions for their current site
[ ] Check that instructions include emergency procedures, escalation contacts, and site-specific risks
[ ] Remove any generic or templated instructions that have not been tailored to the specific site

5. Risk Assessments

[ ] Confirm every active site has a risk assessment on file
[ ] Check review dates and update any assessments that have not been reviewed within the required period
[ ] Ensure risk assessments are genuinely site-specific, not copies of a generic template
[ ] Check that any incidents or near misses since the last review have prompted a reassessment
[ ] Confirm risk assessments are accessible to the operatives working at each site

6. Key and Asset Management

[ ] Confirm a key register exists and is current for every site where you manage keys
[ ] Spot-check the register against physical key holdings to verify accuracy
[ ] Ensure there is a clear process for signing keys in and out, with timestamps and signatures
[ ] Confirm any other tracked assets (access cards, radios, vehicles) have equivalent records
[ ] Check the process for handling lost or unaccounted-for keys

7. Complaints and Quality

[ ] Retrieve the complaints log and confirm it is complete and up to date
[ ] Prepare a brief summary of how each complaint was handled and resolved
[ ] Confirm your complaints procedure is documented and accessible to staff
[ ] Evidence any internal audits or quality reviews conducted since the last assessment
[ ] Prepare KPI data if you track performance metrics across your contracts

Where Companies Usually Fall Short

These are the gaps worth checking for, and almost none of them come from bad management. They come from evidence that was never written down.

Generic assignment instructions. A template copied across sites with the name changed is not a site-specific instruction, and the SIA’s guidance treats instructions for a specific client or site as the minimum for documenting how you deliver the service.
Risk assessments nobody has reviewed. A two-year-old assessment that no longer matches the site suggests the document exists for the file, not the operation. Review it when the assignment changes, after an incident or near miss, when the site itself changes, and when the review period runs out.
A complaints procedure with no complaints log. A policy in the handbook isn't evidence. The standard asks for a complaints procedure that is implemented, and a live log is how you show it. A year with nothing recorded usually means complaints were handled informally and never written down.
Lapsed training. First aid and conflict management certificates expire. One lapsed certificate is a gap. Several suggest the tracking isn't working.
No internal audits. A documented review of your own records, with the actions you agreed, is enough. It has to be regular and acted on.
Last-minute preparation. ACS approval needs a successful assessment every year, so evidence has to keep up between visits, not just in the month before one.

Expired licences and incomplete BS 7858 vetting are worth checking first too, which is why they sit at the top of the checklist.

Before the Assessment: Final Steps

Book a mock audit. Walk through the evidence with someone who was not responsible for producing it. A fresh pair of eyes will find gaps you have become blind to.

Organise your documentation. Assessors sample records from across the business. Organised, clearly labelled evidence makes the process faster and creates a better impression.

Brief your team. Assessors interview people from every level, from directors to supervisors and staff on different shifts and remote sites. Make sure your key people understand the criteria and can speak confidently about how your business meets each one.

Check your digital systems. If you use compliance software, ensure all records are current, dashboards are accurate, and any pending items are resolved before the assessment date.

Maintaining Readiness Year-Round

Passing an ACS audit should be the natural outcome of running a well-managed operation, not a sprint before each annual assessment. The companies that score highest are the ones that maintain their compliance posture as a matter of daily routine.

If your current systems make that hard, the problem is not with your staff. It is with the tools. Spreadsheets, paper records, and disconnected filing systems make it difficult to keep every record the ACS standard asks for current at the same time. Purpose-built software designed for security company compliance changes this fundamentally.

TacDesk’s Compliance module scores your readiness against the ACS criteria, with a readiness dashboard, licence expiry alerts, and an evidence pack you can export the week of the audit. Included on every paid plan. See how it works.

Book a demo at tacdesk.co.uk. Start free, or see current pricing for paid plans. No contracts, no setup fees.

Explore all TacDesk features · Book a free demo · View pricing

Michael Bryce

Founder of TacDesk. Writes about SIA compliance, operations, and running a UK security company, from someone who actually works the shifts.

Connect on LinkedIn →

See TacDesk in action

Win contracts, pass SIA audits, and run your whole operation from one place. Book a free 30-minute demo.

Book a Free Demo