Guard companies tend to think of workplace safety regulation as somebody else’s problem. We do not run machinery. We do not handle chemicals. Our people stand at doors and walk properties. That instinct is why OSHA security company obligations get discovered late, usually the week an inspector arrives or the week after an officer is seriously hurt on a client’s property and everyone realizes nobody knows who was responsible for what.
The uncomfortable structural fact is this: your employees spend nearly all of their working hours on premises you do not own, control or inspect, exposed to hazards created by somebody else’s operation. That does not transfer your obligations to the property owner. It just makes them harder to meet.
This post is general orientation, not legal or safety-compliance advice. Federal and state occupational safety requirements — which employers are covered, what records must be kept, what must be reported and how quickly, what training and written programs are required, and how multi-employer worksites are treated — vary, and some states run their own approved programs with requirements that differ from the federal baseline. All of it changes over time. Verify current obligations with OSHA or your state plan, and with counsel or a qualified safety professional, before relying on anything here.
The general duty obligation, in plain terms
Underneath all the specific standards sits a broad obligation: employers are generally expected to provide a workplace free from recognized hazards likely to cause serious harm. That obligation does not have a carve-out for “the hazard was on the client’s site.”
For a security company, the practical translation is that you are expected to know what your officers are exposed to at the posts you sell, and to do something about the exposures you recognize. Not to fix the client’s building — you usually cannot — but to identify hazards, train officers for them, equip officers for them, and where necessary escalate them to the client in writing.
This is why the post survey is a safety document and not just a sales document. When you walk a property before quoting it, you are looking at billing hours and coverage design. You should also be looking at lighting on the patrol route, stairwell condition, whether the gatehouse has heat and shade, what chemicals sit along the route, whether dogs are on site, and what happens if the officer is injured alone at 3 a.m. on an empty property.
Hazard communication on somebody else’s property
The hazard communication requirement is the one most guard companies overlook entirely, because they assume it applies only to employers who use chemicals. The question is not who owns the chemicals; it is whether your employees may be exposed to them.
Consider what a patrol officer walks past on a typical industrial account: solvent drums, compressed gas cylinders, fuel storage, cleaning chemicals in a janitorial closet, whatever is in the tanks behind the plant. Now consider that the officer is often alone on the property overnight and is expected to investigate an alarm, an odor or a spill.
The shape of the obligation is that employees who may be exposed should know what they are exposed to, be able to read the labeling and safety data, and be trained on what to do. Practically, that means your officers should know where the safety data sheets are on each site, what the labeling means, what the site’s evacuation and shelter procedures are, and — this is the part that saves lives — that their job at a chemical release is to withdraw, isolate and call, not to investigate.
Getting this right requires client cooperation, which is why it belongs in the contract and in the site orientation rather than in a hopeful conversation with a facilities manager.
Multi-employer sites are a real category
Where multiple employers share a worksite, safety responsibility can be allocated across them in ways that depend on who created a hazard, who controlled it, who exposed employees to it and who could correct it. A security company is almost always the employer whose people are exposed to hazards someone else created and controls.
The defensible position is documentation. If your officer identifies a hazard — a broken handrail, a dead light on the loading dock, a blocked exit — and it is recorded in the shift report and communicated to the client, you have a record of recognition and escalation. If it is mentioned verbally to a shift lead and nothing is written, you have nothing. Worse, if the hazard is recorded repeatedly for months, escalated to nobody, and then injures somebody, the record works against you. Escalation has to actually escalate.
This is one of the underrated uses of the daily activity report. A DAR that includes a structured hazard observation — with location, photograph, time and a flag that routes it to the office — converts an officer’s passing observation into a document that protects both the officer and the company. It also gives the client something genuinely valuable, which tends to make the safety conversation easier.
Recordkeeping and the reporting clock
Covered employers are generally required to keep a log of work-related injuries and illnesses, maintain individual incident records, and post an annual summary during a defined period each year. Which employers are covered, which cases are recordable, how work-relatedness is determined and what the posting period is are all set by rule — verify the current requirements rather than working from memory or from a form someone downloaded years ago.
The part that catches operators is the separate, much faster reporting obligation for severe outcomes. Certain serious events — a work-related fatality, and certain serious injuries such as an in-patient hospitalization, amputation or loss of an eye — must be reported directly to the agency within short, strictly defined timeframes. Those windows are tight, they differ depending on the type of event, and missing them is its own violation independent of whatever caused the injury.
Now put that against how a guard company actually learns about a serious injury. It is 2 a.m. The officer is alone. A supervisor gets a call, or the client’s night manager does. The news reaches the account manager in the morning and the owner in the afternoon. By then a large share of a very short clock has run.
The control is not a policy document. It is a notification path that works at 2 a.m. — a way for the officer or supervisor to raise a serious event immediately, to a person who is actually reachable, with the event recorded as it is reported rather than reconstructed later. For officers working alone, a panic button in the app they already carry is the difference between an immediate alert and a phone call that goes to voicemail.
Equally important is that the office sees it. An incident that sits in a supervisor’s truck until his shift ends is an incident nobody can act on. When field reports land in a queue that someone is responsible for watching, the clock starts when the event happens rather than when the paperwork surfaces.
The programs worth having
You do not need a manufacturing plant’s safety program. You do need a small number of written procedures matched to what your officers actually do:
Workplace violence prevention. Guard work involves deliberate contact with hostile people. Training on de-escalation, disengagement criteria, what officers are and are not authorized to do, and how to summon help.
Vehicle safety. Anyone running patrol. Fatigue management, seatbelt policy, phone use, vehicle inspection, and a clear rule that reporting a hazard never requires driving while impaired by exhaustion.
Heat and cold. Outdoor and gatehouse posts. Water, shade, rotation, and the authority for an officer to take relief without asking permission from someone who is asleep.
Bloodborne pathogens. Officers who render aid or handle needles found on site.
Lone worker procedure. The most security-specific of all. If an officer is alone on a property overnight, what confirms they are still all right, and what happens when a check-in is missed?
Each of these should be trained, documented with dates and signatures, and refreshed. Training that exists only as a policy nobody was walked through is training you cannot evidence.
Where to start
Walk your three largest accounts specifically for hazards, not for coverage. Write down what you find, give the client the list, update the post orders, and train the officers assigned there. Then decide who owns the injury reporting clock and make sure that person is reachable at 3 a.m. That is a week of work, and it puts you ahead of most of the industry.
If you want to see how field reporting, hazard escalation and the office review queue fit together, explore CGuardPro or get in touch.