Due Diligence on Security Contractors: A Checklist for International Buyers

Why security contractors need deeper due diligence

A security contractor is not an ordinary supplier. Its staff work on your premises, interact with your employees and customers, may use force in self-defence situations and often hold keys, codes and sensitive information. When something goes wrong, the reputational damage lands on the client.

Several legal frameworks also make the buyer's diligence directly relevant. Under section 7 of the UK Bribery Act 2010, a commercial organisation commits an offence if a person associated with it bribes someone to obtain or retain business or an advantage for it, unless the organisation can show it had adequate procedures to prevent such conduct.

Internationally, the UN Guiding Principles on Business and Human Rights, endorsed by the Human Rights Council in 2011, expect companies to carry out human rights due diligence that covers impacts directly linked to their operations through business relationships, which includes contractors.

Licences and regulatory standing

Private security is a licensed activity in most countries, and the requirements differ. In the UK, contracted security operatives performing licensable activities such as security guarding, door supervision or public space surveillance (CCTV) need a Security Industry Authority licence, as do directors and managers of businesses supplying them. In France, a security company needs an authorisation to operate issued by the CNAPS, its managers need an approval, and agents need an individual professional card, renewable every five years subject to continuing training.

Ask for the company licence and its scope for each country, the list of licensed staff to be assigned, and evidence of any sanctions or warnings from the regulator. Verify independently where the regulator offers an online check.

Licensing rules also determine who can do what. In the UK, for example, in-house staff guarding their own employer's premises usually do not need an SIA licence, while contracted staff performing the same tasks do. When a group compares an in-house model with an outsourced one, or moves from one to the other, the licensing consequences should be checked country by country.

Wages, working time and labour practices

Low prices in guarding are often financed by unpaid overtime, excessive shifts or wages below the applicable collective agreement. Those practices create legal exposure and directly degrade vigilance on site.

Within the European Union, the Working Time Directive sets minimum standards that include an average of no more than 48 hours per week including overtime, at least 11 consecutive hours of daily rest and at least 24 hours of weekly rest in addition. National law and collective agreements add further rules. Ask for the collective agreement applied in each country, the hourly rate used in the price build-up, and anonymised rosters for a sample site.

Compare the hourly rate with the applicable minimum wage and collective agreement scale, adding employer social charges, paid leave, training and supervision. If the price cannot cover these elements plus a reasonable margin, ask the bidder to explain how it will deliver. A short interview with site supervisors during a reference visit often reveals more about real working conditions than any written answer.

Insurance, human rights, bribery, sanctions and subcontracting

Insurance should cover public and employer's liability at levels appropriate to your sites, with the client noted where possible. Request certificates and policy schedules, not only a broker letter.

Human rights commitments are increasingly tested in tenders: a written policy, a grievance mechanism open to workers and the public, and training on use of force and non-discrimination. Anti-bribery controls should include a policy, gifts and hospitality rules, and due diligence on intermediaries.

Sanctions screening must cover the company, its owners and directors, and key subcontractors against the lists relevant to your group. In the UK, the FCDO's UK Sanctions List has been the single source for all UK sanctions designations since the OFSI Consolidated List closed on 28 January 2026.

Finally, subcontracting is where accountability often breaks. Require full disclosure, prior written approval and flow-down of the same obligations.

Due diligence is not a one-off exercise. Licences expire, ownership changes and new subcontractors appear during the life of a contract. Build an annual refresh into the contract, with an obligation on the provider to notify material changes (loss of licence, change of control, regulatory sanctions, serious incidents) without delay.

Due diligence checklist

Use the following as a minimum request list for each country lot.

• Company licence or authorisation, scope and expiry date; managers' approvals where required.
• Staff licences or professional cards for assigned personnel, with a verification method.
• Collective agreement applied, hourly wage used in pricing, overtime and rest policy, sample rosters.
• Insurance certificates and policy schedules (public liability, employer's liability, professional indemnity).
• Human rights policy, grievance mechanism, use-of-force and vetting procedures.
• Anti-bribery policy, gifts and hospitality register, third-party due diligence process.
• Sanctions and adverse media screening of company, beneficial owners, directors and subcontractors.
• List of subcontractors, approval process and flow-down clauses.
• Certifications claimed (for example ISO 9001, ISO 18788, ICoCA membership), with certificate numbers and issuing bodies.

How IPN approaches this

IPN is building a common due diligence file that each national member is expected to complete and keep current, so that buyers can review every country on the same basis. As the alliance is in its founding phase, buyers should request and verify these documents directly for each member proposed on their contract.