Security awareness is not complete when employees finish a presentation. The practical question is whether people know what to do during everyday work and have the conditions needed to do it. If visitor responsibilities are unclear, a lost-card reporting number cannot be found or managers routinely bypass access rules, training alone cannot close those gaps.
An awareness programme does not replace professional training for security officers or give other employees powers to intervene. Its purpose is to help people act safely within their own roles and reach the appropriate person with relevant information.
Define the behaviour you want to see
Rather than starting with a long catalogue of threats, choose a few behaviours that relate to the workplace. Examples include directing a visitor to the designated waiting area, reporting a missing access card or verifying an unusual information request through a known channel. Explain who should act, in which circumstances and what action is expected.
NPSA's 5E approach considers explanation, practical enablement, the working environment, encouragement and evaluation together. It is an implementation framework, not a guarantee that a particular training package will reduce incidents by a stated percentage.
Adapt the programme to different roles
Receptionists, dispatch teams, maintenance contractors and remote workers face different situations. A new starter's immediate information needs also differ from a shift supervisor's responsibility for approving exceptions. Use short scenarios drawn from actual workflows and make the language and format accessible to temporary workers and contractors.
Do not instruct employees to follow an unfamiliar person alone or intervene in a dangerous situation. Explain safe reporting, remaining within their assigned responsibilities and following the relevant instructions. People should understand when to contact security, management or the emergency organisation.
Make reporting accessible and provide feedback
Identify the main reporting channel and an alternative if it is unavailable. A report may need the location, time and observed circumstances; assumptions based on a person's background or appearance are not a substitute for factual information. Explain who can access the report and how it will be handled. Do not promise anonymity that the organisation cannot technically or operationally provide.
NPSA's company guidance supports making it straightforward to raise concerns and providing feedback to those who do so. An organisation can translate this into a process for acknowledging receipt, assigning responsibility and sharing an appropriate update. Staff should not have to investigate an issue themselves before making a reasonable report.
Align management behaviour with the working environment
If managers do not follow the badge rule, employees may find it harder to trust that rule. Equally, repeated reminders cannot repair a door that fails to close or an unusable visitor system. Feedback from training should reach the teams able to act on it, including facilities, human resources, IT and security.
There is no need to circulate every detail of a risk assessment to everyone. Give people the information required for their responsibilities, while separately controlling sensitive information about access arrangements, layouts and vulnerabilities.
Evaluate more than attendance
Attendance, understanding and application are different measures. Short scenario questions, staff feedback and checks of the relevant processes can be considered together. An increase in reports does not, on its own, show deteriorating security: it may reflect a more visible reporting channel or greater confidence in using it. A low number is not automatically evidence of success either.
When commissioning a programme, ask about the initial needs assessment, content for different roles, management participation and evaluation method. Agree which materials will be delivered and who will update them. A useful programme helps employees find an appropriate next step when something is unclear; its value does not depend on how alarming its examples are.
