Office Security vs Health and Safety: 5 Conflicts and How to Resolve Them
A security consultant walks your building and recommends sensible things. Lock down the stairwells. Put a turnstile in the lobby. Add cameras. Screen deliveries. Each recommendation reduces a security risk, and several of them increase a health and safety risk.
That is the part neither discipline owns. Security assessments are commissioned by facilities or risk, safety assessments by someone else, and the two documents are rarely read side by side. The conflicts between them sit in the gap until an evacuation goes wrong or a receptionist is assaulted on a shift nobody assessed.
There are five such conflicts in a typical office. All are resolvable, and none is resolved by choosing a side.
Why this is a health and safety question at all
Worth establishing, because "security" sounds like somebody else's budget line.
Section 2 of the Health and Safety at Work etc. Act 1974 makes an employer responsible for the health, safety and welfare of its employees, and section 3 extends that to people not in its employment who may be affected. Violence and aggression at work are health and safety risks, and the HSE treats them as such in its guidance on violence at work. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires them to be assessed like any other risk.
So the employer owns the risk to people. A security provider owns the measures. Those are different things, and a provider's survey is not an employer's risk assessment.
Conflict 1: Lock it down, and let people out
The sharpest conflict, and the one with the most serious consequences.
Security wants controlled doors: maglocks, badge readers on stairwells, access-controlled floors, turnstiles in the lobby. Fire safety requires that people can leave. Article 14 of the Regulatory Reform (Fire Safety) Order 2005 requires emergency routes and exits to be kept clear and to lead as directly as possible to a place of safety, with doors capable of being opened easily and immediately, and regulation 18 of the Workplace (Health, Safety and Welfare) Regulations 1992 governs how doors and gates are made and what safety devices they need.
The resolution is technical rather than philosophical. Fail-safe release on alarm activation, green break-glass units where required, turnstiles that drop or free-wheel, a tested interface between the access control system and the fire alarm panel, and evidence that the interface was tested after the last change to either system. The common failure is not a bad design. It is a good design that stopped working when the access control system was upgraded and nobody re-tested the fire interface.
Two further points get missed. Badge-controlled floors change your evacuation roll call, because the people on a floor are no longer the people assigned to it. And a locked stairwell above a certain height changes the firefighting strategy, which is a conversation with the fire and rescue service rather than with the security integrator.
Conflict 2: Guard the perimeter, and leave one person at the front desk
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
Security concentrates resource at the boundary. Health and safety looks at who is exposed, and in a professional office the most exposed person is almost always the one on reception.
Front-of-house staff meet every stranger who enters, handle refusals, manage deliveries and are frequently alone at the start and end of the day. They are also, in law firms and insurers particularly, the first person an angry client reaches. That is a foreseeable violence risk attaching to a named role, and it needs assessing on its own rather than inside a general office assessment.
The resolution is unglamorous. Assess the role rather than the building. Never leave the desk singly covered at opening and closing. Give the person a means of summoning help that works where they actually sit. Train for de-escalation rather than for confrontation, and make clear that withdrawing is permitted. And treat the security guard as a colleague rather than as the control: a contracted officer in the lobby is not a substitute for the receptionist's own lone working arrangement, which our note on the lone working policy covers in detail.
Conflict 3: Watch everything, and process it lawfully
Cameras, visitor logs, badge data and increasingly body-worn video all reduce security risk and all create personal data.
Surveillance of a workplace engages data protection law, and the ICO publishes guidance on both CCTV and video surveillance and monitoring workers. The tests are necessity and proportionality, with retention limits, access control and transparency to the people recorded.
The conflict shows up in two places. Camera coverage of rest areas, prayer rooms or treatment rooms is almost never proportionate however much the security case likes it. And footage requested after an incident sits in two systems at once, because the same recording is security evidence and potentially employee monitoring data. Decide in advance who may release it, to whom, and on what basis, because deciding in the hour after an assault produces the wrong answer.
Conflict 4: Screen the entrance, and do not create a crowd outside it
Screening, bag searches and single points of entry are standard security responses, and each of them moves people from inside the building to outside it.
That trade is now explicit in law. The Terrorism (Protection of Premises) Act 2025 creates public protection requirements for qualifying premises and qualifying events, with a named responsible person behind them, and ProtectUK is the practical reference for the measures themselves. The uncomfortable fact that sits alongside it is that a queue is a concentration of people in an uncontrolled space, and queue design is part of the security measure rather than a consequence of it.
The resolution is to assess the measure and its side effects together: where the queue forms, how long it gets at peak, whether it blocks a fire exit or a vehicle route, what happens in bad weather, and who can open a second lane. For organisations running conferences, open days or graduations, this lands squarely in the event assessment rather than the building one.
Conflict 5: Bring in a security contractor, and assess their work too
The final conflict is a scope one, and it catches organisations that believe they have outsourced the problem.
Security officers working on your premises are doing work you arranged, in a building you control, often alone and often at night. Their licensing is a matter for the Security Industry Authority and their employment is their employer's, but the conditions they work in are yours. Patrol routes through unlit areas, roof access, plant rooms, lone night shifts, and the expectation that they will intervene physically are all things somebody should have assessed, and the contract rarely says who.
The resolution is the same shared-duty discipline that applies to any contractor on site: agree in writing who assesses what, who inducts, who reports an incident and who is told about it. Then check that the officer's own reporting route reaches you, because a security incident log that never meets your accident records produces two partial pictures and no trend.
The five conflicts side by side
| Conflict | The security measure | The safety problem | The resolution |
|---|---|---|---|
| Lock down vs get out | Maglocks, badged stairwells, turnstiles | Escape routes must open easily and immediately | Fail-safe release, tested alarm interface, retest after any change |
| Perimeter vs front desk | Resource at the boundary | Reception is the most exposed role | Assess the role, double cover at open and close, means of summoning help |
| Watch vs process lawfully | Cameras, logs, body-worn video | Necessity, proportionality, retention, transparency | Coverage map reviewed, release protocol agreed in advance |
| Screen vs crowd | Single entry, searches | A queue is a concentration outside the protected line | Design the queue, not just the checkpoint |
| Outsource vs assess | Contracted officers | Their working conditions are yours | Written allocation of duties, joined-up incident reporting |
Take the table to whoever holds your security contract and ask which column they believe they own. In most organisations the answer is the second, nobody owns the third, and the fourth is where the work sits.
Reporting, and the detail people miss
One practical point that cuts across all five. An assault on an employee at work can be a reportable incident, and the reporting route built for slips and manual handling injuries frequently does not capture it, because the event is logged as a security matter in a different system.
Decide which incidents cross from the security log into the health and safety record, and make the crossing automatic rather than discretionary. That is where health and safety consultants and software matter together rather than separately: one register, one taxonomy, and a view in which an aggressive visitor, a near miss and a lost-time injury are all visible to the same person.
How this changes outside the UK
Groups that standardise security design across countries hit the safety side of these conflicts at different points, because escape and worker-protection rules differ even where the threat picture does not.
In the EEA the general duties come from the EU Framework Directive 89/391/EEC, with escape provision, door hardware and assembly rules set nationally and often locally. Germany is the clearest design constraint: state building ordinances govern escape routes and door releases, with periodic inspection by approved bodies rather than by the integrator who installed the system, so an access control design signed off in London may not be acceptable there. Several jurisdictions also place the surveillance question differently: where a works council exists, a camera or badge-data system touching employee monitoring is a co-determination matter to be agreed before deployment rather than announced after it.
The workable pattern is one security standard with a safety annex per country: the measure, the local escape and door requirement it must satisfy, the local consultation route, and who may certify the interface. Periodic health and safety audits should test the interface rather than the intention, because the gap between a design and an installation is where both disciplines lose.
Where Arinite fits
Arinite has spent 15+ years sitting between facilities, security and safety in buildings where nobody owned the overlap. We support 1,500+ businesses in 50+ countries and protect 100,000+ employees, with 95%+ client retention. Our health and safety consultants work extensively with legal, insurance, professional services and office clients, where reception exposure and the access control interface are the two findings that come up first. Where the premises question is in scope, it sits alongside your existing fire safety arrangements rather than separately from them.
For multi-country estates, our global health and safety consultants check a group security design against each country's escape and consultation requirements before it is rolled out, and our international health and safety consultants can tell you which sites will reject it.
Put your security survey and your fire risk assessment on the same desk and read them together. Then book a free gap analysis and we will tell you in one call which of the five conflicts is live in your building.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
