Operational Planning

Turning a Security Lesson into an Approved Procedure Update

Make controlled changes rather than adding another rule after every event. Connect evidence, rationale, approval, versioning and checks of actual use.

Titan SavunmaOriginal Article: Updated: Approximately 3 min read
A hand drawing a process on a glass board
In This Article

After an incident, the quickest response may be to add another sentence to the procedure. Over several months, those sentences can accumulate into rules that contradict older provisions or whose original purpose nobody remembers. Before asking “what should we add?”, the organisation should ask “which problem has actually been clarified?”

Experience must be processed into a change

Mayer and Argyres examined 11 contracts between two computer-industry firms over time, finding that experienced problems influenced later contractual arrangements. [1] This single-relationship case does not establish the effectiveness of private-security procedures. Our application is that experience is not automatically improvement: it needs to become an organisational change decision. HSE's incident-investigation guidance similarly connects analysis with implementing action. [2]

Narrow the reason for changing the procedure

Not every detail in an incident record needs to enter the revised instruction. Identify which part of the approved practice was missing, unclear or impractical. Describe the working relationship that needs reconsideration rather than importing names or unnecessary private details of the event.

Suppose a notification was sent but nobody could establish whether the responsible department had received it. The issue may not simply be that staff should communicate faster. Sending and receiving may have been treated as the same activity. Compare the records and participants' accounts first. If the evidence does not support that explanation, do not present it as a confirmed finding.

Review the old and proposed wording together

A short change note can show the existing provision, proposed wording and reason alongside one another. This helps the approver see the difference in the actual process rather than only the added words.

If the existing provision merely says “notify the relevant department”, a proposal could clarify the organisation-approved channel, how the outcome is confirmed and the responsible role when no response arrives. There is no need to prescribe one channel or deadline for every organisation; the decision should reflect the actual operation.

Check what else the new rule affects

Changing one provision may affect a form, task card, software field or service description shared with the client. Updating the main document's date does not remove obsolete practice from working locations.

Before approval, check these connections:

  • Does the proposal remain within existing authority and legal boundaries?
  • Can the person applying it access the necessary information and tools?
  • Does it conflict with another provision or introduce unnecessary duplication?
  • Are changes to training, forms or contractual arrangements required?
  • Have the affected departments had an opportunity to comment?

Publishing and putting into use are different stages

Establish the document owner's approval, version number and effective date. Plan where obsolete copies must be removed and which shifts need the new version explained. An archived document should not remain presented as current operational guidance, while applicable retention requirements are preserved.

Communication should explain the changed decision point rather than merely announcing that a procedure has been updated. Can the officer describe the relevant difference through an example? Does the client contact understand the same change?

After the initial period of use, review a selected example. Does the change address the identified issue, or has it introduced unnecessary waiting or a new disagreement over interpretation? Depending on the result, the provision can be retained, clarified or reconsidered. The lesson then becomes a change whose use is checked, rather than just another sentence added to a document.

Sources and Further Reading

← Back to Security BulletinBack to Top
For Your Organisation

Let’s Discuss Your Security Needs

Tell us about your operations and expectations so we can define the appropriate service scope together.

Contact

Request a Security Proposal for Your Organisation

Tell us your facility type, location and general requirements. Together, we can define a service scope that suits your organisation.

Tell Us What You Need

Fields marked * are required.

What Happens Next

  1. Initial DiscussionWe clarify your requirements and facility details together.
  2. Service ScopeWe assess staffing needs and the working arrangements.
  3. ProposalWe prepare our proposal for the agreed service scope.

Looking for a role? Visit our careers page