Security KPIs for International Groups: What to Measure and How to Harmonise Reporting

Why cross-country security reporting is so hard

Most international groups receive security reports from every country, yet struggle to answer simple questions: which sites are under-protected, which provider performs best, and is the overall picture improving?

The problem is rarely a lack of data. It is that each country defines things differently. One provider counts a patrol as completed when the guard starts the round, another when every checkpoint is scanned. One measures response time from alarm to dispatch, another from alarm to arrival. Without common definitions, a group dashboard compares numbers that are not comparable.

Different technologies add another layer. Some sites use electronic guard tour systems, others paper logs; some alarms are monitored by the guarding provider, others by a separate remote monitoring centre. Each source produces data in its own format, and someone has to reconcile them before any comparison is possible.

The core KPI set

A short, stable set of indicators is more useful than a long list nobody reads. The list below is a practical starting point, grouped into service delivery, quality and people. Where you buy remote monitoring as well as guarding, add the same response time logic to alarm verification, from signal receipt to the operator's decision.

• Patrol completion rate: checkpoints scanned within the scheduled window divided by checkpoints scheduled.
• Post coverage: hours actually delivered divided by hours contracted, per site and per month.
• Alarm response time: minutes from alarm receipt to arrival on site, reported as median and as share within target.
• Incident closure time: days from incident report to closure with root cause recorded.
• Audit score: result of site audits against a common checklist, with open actions tracked.
• Staff turnover: leavers in the period divided by average headcount assigned to the contract.
• Training hours: hours of training delivered per guard, split between mandatory and client-specific.

Defining each KPI so it travels across borders

For every KPI, write a one-page definition: the formula, data source, start and stop events, exclusions, reporting frequency and target. Agree it with each provider before the contract starts, not after the first disputed report.

Some indicators need local context. Training requirements, for example, are partly set by law: in France, agents' professional cards are valid for five years and renewal requires continuing training. A harmonised KPI should therefore separate legally mandatory training from additional client training, so that countries are compared fairly.

Public sector practice is a useful reference for discipline. In the UK, section 52 of the Procurement Act 2023 requires contracting authorities to set at least three KPIs for public contracts estimated above 5 million pounds and to publish them. The principle of a defined, published, small set of KPIs is a good one for private groups too.

Harmonising the reporting process

Once definitions are fixed, standardise the format. Use one template (or one data feed into your own tool) with the same fields, units and time periods in every country. Ask providers to submit raw data alongside calculated KPIs, so that your team can check the calculation. Where electronic systems exist (guard tour scanners, alarm receiving centre logs, incident management software), prefer system extracts to manually typed figures.

Set a reporting rhythm that matches the governance model: monthly country reviews, quarterly group reviews and an annual review of targets. Management system standards help here: ISO 18788 frames security operations management as a cycle of establishing, monitoring, reviewing and improving, and ISO 9001:2026 places renewed emphasis on leadership and on risks and opportunities.

Finally, connect KPIs to consequences. Agree in the contract what happens when a target is missed for consecutive periods: an improvement plan, a review meeting at executive level, service credits where appropriate, and ultimately the right to re-tender a country lot.

Pitfalls to avoid

Avoid indicators that are easy to game. Counting incidents reported, for instance, can reward under-reporting. Pair it with audit findings and client feedback. In the same way, a very short incident closure time can mean incidents are closed without a real investigation, so sample closed files during audits.

Avoid averaging across countries without showing the spread. A group average can hide one country in serious difficulty. Show results by country and by site, with the worst performers highlighted.

Avoid KPIs that measure activity without outcome. A high number of patrols means little if incidents keep recurring at the same site.

Avoid changing definitions too often. Trends are only meaningful if the KPI stays stable. If a definition must change, record the date, restate the previous periods where possible, and explain the change in the next report so that nobody mistakes a methodology change for a real improvement or decline.

How IPN approaches this

IPN's model relies on national members reporting in one common format, with shared KPI definitions agreed with each client. We are in our founding phase and will work with clients to adapt the KPI set to their sites rather than impose a fixed scorecard.