Perth Risk Management Policies: Business & Strata 2026

You're usually forced into writing a risk policy at the worst time.

A tenant in a Subiaco complex complains that someone keeps slipping into the car park behind residents. A workshop in Canning Vale has a break-in and the CCTV footage exists, but nobody's sure who should access it, how long it should be kept, or what the alarm response procedure was supposed to be. Or an insurer asks sharper questions at renewal, and suddenly “we've got cameras and an alarm” doesn't sound like much of an answer.

That's where most Perth businesses and strata committees get caught. They've bought security hardware, but they haven't built the thinking around it. The cameras are there. The policy isn't. And without that policy, the system often works as a recorder of problems instead of a manager of risk.

Why Your Perth Business Needs More Than Just a Security System

A security system on its own is only equipment. It can detect movement, record video, lock a door, or trigger a siren. It can't decide who is authorised to review footage, when a lost fob should be cancelled, what counts as an incident, or whether your current controls are still fit for a mixed-use site with changing tenants.

That decision-making layer is what risk management policies provide.

Hardware without policy creates blind spots

Take a common WA scenario. A small commercial tenancy has decent cameras covering the front entry, roller door, and car park. The owner assumes that's enough. Then an after-hours incident happens. Footage exists, but the cameras don't cover the side path where intruders entered. The staff member who knows the recorder password is on leave. The alarm has been giving nuisance alerts for weeks, so nobody treated the activation as urgent.

None of those failures came from the camera brand or the alarm panel. They came from the absence of a working policy.

A useful policy tells you:

• What risks matter most to your site, not just what products are fashionable
• Which controls apply to each risk, such as CCTV, perimeter alarms, intercoms, lighting, locks, and access permissions
• Who does what when an incident occurs
• How records are handled so footage, logs, keys, and access credentials are controlled properly

For many operators, the bigger issue isn't the first incident. It's the second one, after nothing changed.

Liability sits in the gaps between systems

In strata and small business environments, the weak point is often procedure. A committee installs intercoms but never defines visitor access rules. A warehouse has access control on the main door but leaves shared side gates unmanaged. A retail site adds cameras but doesn't create a process for checking blind spots, image quality, or whether the system is still recording.

That's why I tell clients to stop thinking in terms of “Do we have security?” and start asking “Can we defend our decisions?”

Practical rule: If you can't explain why a camera is there, who uses the footage, and what action follows an alert, you don't have a managed control. You have a device.

In Perth, that matters across commercial units, small offices, medical suites, schools, warehouses, and apartment complexes. Local conditions vary, but the pattern is the same. A real policy turns disconnected devices into an organised response. If you need a broader view of the threats that shape those decisions, this overview of security risks Perth businesses face is a useful starting point.

The Core Components of a WA Security Policy

Policies are often assumed to be paperwork written for auditors, insurers, or committees. That's only true when the document is vague. A good policy is operational. Staff can use it. Managers can enforce it. Contractors can work under it. If an incident lands on your desk tomorrow, the policy tells you what happens next.

Western Australia's government framework gives a solid model. The WA Government formally established its risk management guidelines in 2007, requiring state agencies to follow a structured five-step process aligned with AS ISO 31000:2018, including identifying risks, choosing management approaches, treating risks with controls such as security alarms, and monitoring the process regularly, according to the WA risk management policies for essential public assets. Private businesses and strata schemes aren't the same as state agencies, but the logic transfers well.

What belongs in the document

A working policy usually needs seven parts.

Component	What it does in practice	WA example
Policy statement	Sets the organisation's commitment to security and risk control	A strata council states that resident safety, controlled access, and incident reporting are formal priorities
Scope and applicability	Defines which sites, users, and systems are covered	A Belmont business includes office, warehouse, car park, and delivery gates
Roles and responsibilities	Allocates decision-making and day-to-day tasks	Reception manages visitor access, managers approve credentials, contractors work under permit
Risk assessment framework	Explains how risks are identified and rated	Break-in risk, tailgating, vandalism, internal theft, and after-hours access are assessed consistently
Security controls	Lists the actual measures in place	CCTV, alarms, keypad entry, card access, intercoms, locks, lighting, patrols
Incident response plan	Tells people what to do when something happens	Alarm activation, footage review, police contact, tenant notification, system isolation
Review and audit process	Keeps the policy current	Access lists checked, alarm events reviewed, footage quality tested, contractor permissions removed

The two parts most businesses get wrong

The first is the risk register. Too many operators write one once and never touch it again. It should be a live record of your actual exposures. In a Joondalup warehouse, that might include stock theft, after-hours entry, loading dock intrusion, unauthorised staff access, and recorder failure.

The second is control selection. People tend to buy what they know. Cameras for everything. Or alarms for everything. Real risk work is more selective. If the main issue is uncontrolled entry through common doors, access control may matter more than another camera. If the problem is disputes after deliveries, coverage at gates and loading points may matter more than extra internal detectors.

A policy should help you spend money in the right place, not just justify money already spent.

Good policy links security with contracts and obligations

This matters when trades, cleaners, maintenance crews, and other outside parties enter your site. Your policy should spell out how contractor access is approved, supervised, and revoked. If you're reviewing those obligations more broadly, these practical notes on contractor insurance requirements are relevant because physical access, liability, and site rules often overlap.

For organisations that need help turning those components into day-to-day processes, formal security management services can provide the structure that many SMEs and strata schemes are missing.

Building Your Risk Management Policy Step by Step

A risk policy usually goes wrong before the first line is written. In Perth, I see the same pattern with small businesses and strata schemes. Someone downloads a template, lists a few generic threats, then approves camera or alarm upgrades that do not match how the site operates. Six months later, a door is still being propped open, fobs are still shared, and nobody can pull usable footage after an incident.

Start on site. Walk it at opening time, after hours, and during deliveries if you can. Watch who enters, where visitors wait, which gates are left unsecured, who has access to the recorder or alarm app, and where procedure has been replaced by habit. That is the difference between a policy written for compliance and one that helps a manager in Welshpool, a retailer in Belmont, or a strata council in South Perth make sensible decisions with a limited budget.

Start with context, not equipment

Define the operating context first. That means the type of premises, occupancy patterns, key users, valuable assets, and the business consequences if something goes wrong.

A Belmont café and an Osborne Park warehouse can both need CCTV, alarms, and access control, but the policy settings should be different. The café may be worried about early-morning staff opening alone, rear-lane access, cash handling, and aggressive behaviour. The warehouse may be more exposed to perimeter breaches, contractor movement, roller-door blind spots, and stock leaving through the wrong gate.

Write down what needs protection under a few clear headings:

• People. Staff, residents, visitors, contractors
• Property. Stock, tools, plant, vehicles, common areas
• Operations. Trading hours, deliveries, access continuity, after-hours response
• Records and evidence. Footage, access logs, incident reports, key registers

That short exercise stops the policy from turning into a shopping list for equipment.

Identify the actual risks on site

Use plain language. If the issue is a rear gate regularly left open, write that. If former staff still have active credentials, write that. If delivery drivers can walk past the reception point and into a workshop unsupervised, write that.

This part matters because Perth SMEs and strata managers are often given high-level risk guidance but little help translating it into day-to-day controls. On site, the question is rarely abstract. It is usually practical. Do we need another camera, or do we need to stop shared tags, change the intercom procedure, and lock down the comms cabinet?

A useful risk register for a smaller site might include:

• After-hours break-in through rear entry. Current control is a deadlock only
• Unauthorised access to office or plant room. Current control is a shared key
• Poor night footage at loading area. Current control is ageing analogue cameras
• False alarm complacency. Current control is user reset with no supervisor review
• Non-residents entering through shared strata doors. Current control is intercom use with no resident protocol

Keep each entry specific enough that someone can act on it.

Analyse and prioritise before you buy

The Department of Finance Risk Management Process guide sets out a structured process for identifying, analysing, evaluating, and treating risk. For a Perth SME or strata scheme, the practical point is simple. Rank problems before spending money.

Use a basic likelihood and consequence discussion. A spreadsheet is enough for many sites. Consistency matters more than software.

Ask:

1. How likely is this risk at this location?
2. What is the operational, financial, or safety impact if it happens?
3. What controls already exist, and do they work in practice?
4. Is the remaining exposure acceptable, or does it need treatment now?

Experience in risk management offers significant cost savings. If side-gate access is the regular failure point, fix that before adding more cameras to corridors that already have coverage. If the underlying weakness is uncontrolled credential sharing, spend on access control discipline and audit trails before upgrading your alarm panel. If incidents keep turning into disputes because the images are unusable, improve camera placement, lighting, and retention before adding extra detectors.

For businesses whose physical and digital risks overlap, a cybersecurity risk assessment checklist can be useful alongside your site review, especially where network video recorders, remote app access, and shared admin passwords are in play.

A short explainer can help if you want to see a general risk cycle in action:

Match controls to the risk

Policies become useful when the treatment matches the problem.

If unauthorised entry is the issue, set rules around credential issue, door schedules, lost-tag deactivation, and visitor access. If the recurring problem is disputed incidents, improve CCTV coverage at entries, loading points, lifts, and car park approaches, then define who can review and export footage. If nuisance alarms are wasting everyone's time, review detector placement, user training, arming routines, and escalation steps.

Control choices usually fall into four groups:

• Reduce likelihood. Better locking, access control, intercom verification, lighting
• Reduce consequences. Clear footage, duress response, incident isolation procedures
• Transfer risk. Insurance and contractor obligations
• Avoid risk. Change access arrangements, hours, layout, or site practices

A control should change behaviour, improve visibility, or speed up response. If it does none of those things, it probably does not belong in the budget.

Write the policy in language people will follow

Keep the core document short enough that a manager, committee member, or site supervisor will readily use it. For many WA SMEs and strata schemes, the best format is a brief policy supported by working documents such as the risk register, site map, access authority list, alarm response instructions, and CCTV handling procedure.

The wording should answer operational questions clearly:

• Who approves access credentials
• Who can review footage and under what circumstances
• How incidents are recorded and escalated
• How often permissions, logs, alarms, and devices are checked
• What triggers contact with police, the insurer, or the strata council

That is how policy moves from theory to site practice. It gives Perth operators a workable answer to the question they have been asking all along. How do we do this properly here, with this property, these people, and this budget?

Sample Policy Language for Perth Scenarios

At 6:10 pm on a Thursday in Belmont, a staff member leaves through the rear door, props it open for a delivery, and forgets about it. The alarm sets later that night. The CCTV records the lane clearly. Nobody has written down who is allowed to review footage, who checks rear-door habits, or what happens after a repeat breach. That is how a site ends up with equipment but no real policy.

Good policy language fixes that problem. It gives owners, strata managers, and site supervisors wording they can use on Monday morning, with the systems they already have and the budget they control. If you need a broader framework before drafting clauses, this practical guide to risk and security management for Perth sites is a useful starting point.

CCTV clause for a Belmont retail tenancy

For a small retail site, keep the clause plain and enforceable:

CCTV is installed to deter theft, support incident investigation, and assist staff safety. Camera coverage will include entry points, point-of-sale areas, cash handling zones, and external approaches where practical. Access to live and recorded footage is restricted to authorised management personnel and approved investigators. Footage review, export, and release must be recorded in the incident log.

That wording works because it answers the questions that usually cause trouble in retail. Why are the cameras there. Where should they point. Who gets access. What record must be kept if footage is pulled for police, an insurer, or an internal investigation.

In Perth retail, I would usually add one more line about retention periods and camera checks. A camera that stopped recording three weeks ago is not a control. It is a false sense of security.

Visitor access clause for a Subiaco strata complex

In strata, the weak point is often informal access through common doors, gates, and intercoms. Residents want convenience. The council wants safety. The policy has to handle both.

A workable clause is:

Visitor access to the building must occur through the approved intercom, entry panel, or resident-issued credential process. Residents must not admit unknown persons into common areas without verification. Lost, stolen, or unreturned access devices must be reported to the strata manager as soon as practicable so credentials can be cancelled. The strata manager or delegated representative will maintain a current register of active access devices, contractor permissions, and cancelled credentials.

That clause is stronger if the building also has a simple operating rule behind it. For example, the building manager checks the access list every quarter and removes old fobs for former tenants, cleaners, and contractors. In medium-density complexes around Subiaco and West Perth, that single housekeeping task often closes a bigger gap than adding another camera.

Contractor and cleaner access for an Osborne Park commercial property

Shared commercial sites live or die on access discipline. After-hours cleaners, refrigeration contractors, and maintenance trades all need entry. They do not all need full-site access, master keys, or alarm codes that never change.

Use policy language like this:

• Approval before access. Contractors and cleaners must be approved before receiving keys, alarm codes, swipe cards, or mobile credentials.
• Restricted scope. Access will be limited to the areas, dates, and times required for the work order.
• Supervision where needed. High-risk areas such as server rooms, cash offices, and plant rooms require escort or separate authorisation.
• Credential removal. Temporary credentials must be cancelled when the job ends, the contractor changes, or the access window expires.
• Record keeping. The site contact must keep a record of who was given access, what level of access was approved, and when that access was removed.

For many Perth SMEs, that is enough. You do not need legal theatre. You need wording that matches how the alarm is opened in Osborne Park at 4:30 am, how the gate is used in Malaga, or how a cleaner gets into a mixed-use building in Victoria Park without getting into places they should never see.

If approvals are handled by email or committee resolutions, get them signed and stored properly. Tools such as BoloSign for risk professionals can help keep approval records in one place, especially where strata councils or multi-site operators need a clear audit trail.

Bringing Your Policy to Life Through Review and Auditing

A risk policy earns its keep during review, not when it's first signed. Sites change. Tenants change. Staff come and go. Cameras drift out of alignment. Intercom directories become outdated. Alarm users develop shortcuts. If the policy doesn't keep pace, it becomes fiction.

In WA, risk management activities are expected to be systematic, with continuous monitoring, review, recording, and reporting. Tourism WA's guidance also requires event holders to calculate a specific risk rating using criteria tables so risk management stays operational rather than one-off, as described in the WA risk management guidance for incorporated associations and event contexts.

What to review in the real world

An annual review is sensible for many sites. So is an immediate review after a break-in, access breach, aggressive incident, or major change in occupancy. The point isn't paperwork frequency. The point is whether the controls still match the risk.

A practical internal audit should check:

• Access permissions. Are former staff, tenants, or contractors still active in the system?
• CCTV usability. Do cameras still capture faces, number plates, and key approaches clearly enough to be useful?
• Alarm response. Do users know who gets called, who attends, and what happens after activation?
• Incident records. Are events being logged consistently, with actions and follow-up noted?
• Physical conditions. Have new obstructions, lighting changes, or building works created blind spots or weak points?

Reviews fail when nobody owns them

Many committees often drift. Everyone agrees the policy should be reviewed. Nobody is assigned to do it, and nobody chases the evidence. If you want the policy to function, assign named responsibility for each part. One person reviews access lists. Another checks incident logs. A manager or committee member signs off corrective actions.

Digital sign-off tools can help when multiple stakeholders need to approve updates, training acknowledgements, or review records across sites. For that administrative side, BoloSign for risk professionals is one example of a workflow tool that can make version control and approvals easier.

A policy only becomes real when someone tests it against the site and records what changed.

For businesses and strata schemes that want a stronger operating framework, this guide to risk and security management is useful because it ties review activity back to day-to-day site control.

Frequently Asked Questions About WA Risk Policies

Do small Perth businesses really need formal risk management policies

A Malaga workshop with one roller door, a back gate and six staff does not need a policy written like a government department. It still needs one.

If people share keys, use an alarm, open up in the dark, let couriers through a side entrance, or rely on CCTV after hours, there should be written rules for how that is managed. Otherwise the business is relying on habit, and habit falls apart when a staff member leaves, a contractor fills in, or an incident happens on a Friday night.

For a sole trader working from home, the policy may only cover keys, device security, visitor access and incident recording. For a clinic, warehouse, small retailer or strata complex, it usually needs more detail because there are more people, more access points and more ways for simple mistakes to turn into loss.

Will a policy change my insurance outcome

It can help. Insurers and brokers often want to see that security is being managed as a system, not treated as a shopping list of devices.

A key benefit is defensibility. After a break-in, internal theft issue, or access dispute, you can show who held access, how alarms were assigned, where CCTV coverage applied, how footage was handled, and whether reviews were completed. That puts the business in a stronger position than saying the cameras were installed but nobody owned the process.

It also helps during renewal discussions. A broker can explain a managed approach far more easily than an ad hoc setup with no records behind it.

How detailed should the document be

Detailed enough that a site supervisor, strata manager, or office admin can use it on a normal day.

For most Perth SMEs and strata committees, the better approach is a short core policy supported by working documents. Keep the main policy focused on scope, roles, site risks, control measures, incident response, and review dates. Put the items that change more often into schedules such as access permissions, key registers, patrol response contacts, camera locations, and test logs.

That balance matters. If the whole thing is two pages, it will be too vague to guide action. If it runs to 40 pages, nobody will open it after the board meeting.

How do I know whether my security provider understands WA risk requirements

Ask them to explain how they would handle your actual site in Perth, not just what brand they sell.

A provider who understands risk policy should be able to walk through practical questions. What are the likely entry points after hours. Which areas need recorded coverage and which do not. Who should have swipe access, and at what times. How are alarm call lists maintained. What changes if the tenancy mix shifts, if a gate is left open to trades, or if the site backs onto a laneway with regular anti-social behaviour.

The gap for many WA businesses is translation. Government and industry frameworks tell you to assign risk owners, document controls, review treatment measures and keep records. They rarely tell a small business in Osborne Park or a strata council in Rivervale how to turn that into camera placement, user permissions, intercom settings, and a review routine that fits the budget. The Risk Policy and Management Process material from Philanthropy Australia notes that risk owners are often unclear about their responsibilities. That same confusion shows up on sites where nobody can say who approves access changes or who checks whether the installer's recommendations are still being followed.

A capable provider should be able to explain, in plain language:

• Why each control is recommended for your site
• What risk it addresses
• What the system will not solve
• Who needs training
• How the setup should be checked and updated over time

What usually goes wrong after installation

The handover is treated as the finish line.

Then staff change. PINs are shared. Old fobs stay active. A new fence creates a blind spot. Deliveries start using a side door that was never meant to be public. Six months later, the site is operating differently but the policy, permissions and camera views still reflect the old setup.

That is where good policies earn their keep. They give managers and committees a simple operating rulebook for inductions, contractor access, alarm responses, footage requests and incident follow-up. If the document does not shape what people do on site, it is just filing.

If you want help turning a generic document into a practical site policy, Securitec Security can help you assess your premises, match CCTV, alarms, access control, and intercoms to your real risks, and build a security approach that works in day-to-day WA conditions.