Review your security risk assessment at least once a year, and again whenever something material changes. Higher-risk sites should look at it more often: the NSW Health policy sets three-monthly reviews for higher-risk matters, and Australian Government entities must formally review their security plans at least every two years. Which interval suits you depends on your risk level, how fast your site changes and what has happened lately. This guide sets out the benchmarks, the triggers and a practical schedule for construction sites, healthcare, offices, retail and events.

TL;DR

• Annual is the sensible baseline for most commercial sites. ASIC, for example, commits to a security risk assessment at least annually.
• Higher-risk matters need a shorter cycle. NSW Health requires a review every three months if nothing has triggered one earlier.
• Two to three years is the outer limit in government frameworks, and it applies to formal plan reviews, not to day-to-day monitoring.
• Incidents, site changes, new risk information and staff concerns should trigger a review straight away, whatever the calendar says.
• Fast-changing sites, such as construction and events, need a review cycle tied to project stages and to each event.

Table of Contents

• Why a fixed calendar alone is not enough
• Is there a legally required review frequency?
• What the benchmarks tell us about timing
• Events that should trigger an early review
• A practical schedule by site type
• What a review should check and document
• Our perspective
• How ABCO supports an ongoing review cycle
• Setting up a review calendar that holds
• FAQ
• Sources

Why a fixed calendar alone is not enough

A risk assessment describes a site on the day it was written. The fence line moves, a tenant changes, the after-hours cleaning contract is renegotiated, a new access door is cut into the building. Every one of those changes shifts your exposure, yet the document still says the old thing.

The Australian Government’s protective security policy framework treats a security plan as a living document, one that has to be adjusted so security goals and risk management keep pace with a changing environment and emerging threats (PSPF Release 2025). That is the right mindset for any organisation. The calendar sets the minimum. Events on the ground set the real timetable.

So think in two layers: a scheduled review that happens regardless, and trigger-based reviews that happen when conditions change.

Is there a legally required review frequency?

For most private-sector physical security, we are not aware of one national rule that sets a single review interval. What exists instead is a patchwork. Government entities and regulated bodies work to fixed intervals set in their own frameworks, while everyone else is guided by general duties to manage risk and by what their insurers, contracts and clients expect.

The fixed intervals you can point to look like this:

If your organisation is contracted to government, owns critical infrastructure or sits inside a regulated sector, check which framework applies to you and treat its interval as a ceiling. If you are a private operator with no such obligation, the tighter intervals above are still a sound guide. If a claim ever follows an incident, being able to show a current, documented review is far better than explaining why yours was five years old.

For legal questions about your specific obligations under work health and safety law or a lease, speak to your WHS adviser or a lawyer. If you want a primer on keeping risk documentation current from the legal side, these legal risk management basics cover the habit of maintaining your paperwork as the business changes.

What the benchmarks tell us about timing

Read across the frameworks and a pattern emerges.

Every three months is for the situations where the consequences are serious or the risk is moving. NSW Health’s policy states that review of risk assessments and controls should happen on an agreed basis depending on the level of risk, with higher-risk matters reviewed at three-monthly intervals if no earlier review has been triggered (Protecting People and Property, January 2026).

Every year is the common baseline for an organisation with a stable site and a moderate threat environment. ASIC’s commitment to assess at least annually is a typical example of what a mature corporate security program looks like.

Every two to three years appears where the asset is stable and heavily controlled. Even there, the frameworks pair the interval with trigger-based review, so it is not a licence to leave a plan untouched while conditions change.

None of these numbers is a magic figure. They are reasonable answers to the same question: how long can this site go before the document no longer matches reality?

Events that should trigger an early review

A review is due the moment something material changes. The NSW Health policy lists the circumstances well, and they translate to any commercial site (Protecting People and Property):

• After a security incident, even one where nobody was hurt. A near miss is free information about a weak control.
• When a change is proposed to the workplace, work systems, equipment, practices or procedures.
• When new risk information appears, such as a pattern of break-ins in the area, a fresh threat advisory or a new technology that makes an old control obsolete.
• When workers or other stakeholders raise concerns. The people on the ground often see gaps before management does.
• When injury or illness results from exposure to a hazard the assessment covers.

The ACT Protective Security Framework adds a similar rule: security plans must be reviewed if there is a significant incident or a change in the protective security environment (ACT Protective Security Framework, February 2025). For crowded places, audit guidance points to reviewing the plan when National Terrorism Threat Levels change or the security threat changes (Crowded places security audit).

In practice, add your own triggers to the list:

• A new tenant, a fit-out or a change of opening hours
• A change of security contractor or monitoring provider
• A move to or from remote operation of cameras and alarms
• Theft, vandalism or trespass trends in your area
• A change in what you store on site, such as high-value stock, medicines or plant

Write these triggers into the plan itself, with a named person responsible for noticing them. A trigger nobody owns will not fire.

A practical schedule by site type

The benchmarks above are not written for every industry, so here is how we would apply them. This is our own working guidance, built on the benchmarks, not a regulatory requirement.

Construction sites

A construction site changes shape every few weeks. Excavation turns into a slab, then a frame, then a sealed building with different entry points and different things worth stealing. A review done at project start will be wrong by the time fit-out begins. Tie your review to project stages and keep a monthly check on perimeter, lighting, access logs and storage. Our guides on building a construction site security plan and preventing construction site theft show what to look at each time.

Healthcare facilities

Healthcare combines open public access with vulnerable people, medicines and occasional aggression. That justifies the three-monthly cycle for higher-risk areas that NSW Health applies to higher-risk matters, with a full annual review across the facility. Any aggression incident should prompt an immediate look at the controls around it.

Corporate offices

Offices are the most stable of the group, so an annual review is usually enough, provided triggers are honoured. Fit-outs, new tenants and changes to after-hours access are the usual reasons to go early. If your risk is concentrated outside working hours, our guide to after-hours office security is a good place to start.

Retail

Retail risk follows the trading calendar and local conditions. We suggest reviewing before the busiest trading periods and again after them, using shrinkage figures and incident logs as your evidence.

Events

Every event is a new risk environment. Audit guidance for crowded places asks whether the risk management plan is reviewed for each event when several are held (Crowded places security audit). Councils set expectations too: Inner West Council requires organisers of events in its parks to inspect the site and remove or reduce hazards before the event starts, including during bump-in and bump-out (Events in Parks Guidelines). Reusing last year’s plan unchanged is the classic mistake. Our event risk assessment template and crowd control strategies guide help you rebuild it quickly.

What a review should check and document

A review is not just a date change on the front page. A useful one answers whether the assessment still describes the site, and whether the controls still work.

The NSW Health policy gives a solid checklist of what to examine: worker feedback, the workplace, equipment and work systems, existing assessments and controls, compliance records, compensation and incident records, procedures, safety equipment and incident responses. It also asks that each stage of risk management and each consultation is documented (Protecting People and Property).

For a commercial site, a workable review looks like this:

1. Walk the site. Compare what is there with what the assessment says is there.
2. Read the incident log. Include near misses, false alarms and guard reports.
3. Test the controls. Do cameras record and are they monitored? Do alarms reach someone? Do locks, gates and access cards work?
4. Ask the people. Staff, tenants, contractors and guards will tell you where the gaps are.
5. Re-rate the risks. Adjust likelihood and consequence, and move any control that no longer works.
6. Record the decisions. Note what changed, who approved it, what actions are open and the next review date.

If you need a starting document, our security risk assessment checklist and free risk assessment template cover the structure, and our risk assessment process guide explains how each step feeds the next.

Who should carry out the review

The PSPF leaves it to each entity to decide how the review is conducted, with internal security practitioners, external consultants or a security governance oversight committee as the options (PSPF Release 2025). The same logic works for private organisations. An internal review is quick and knows the site. An external one brings fresh eyes and benchmarks from other sites. Many organisations alternate: internal reviews through the year and an independent review every couple of years.

Our perspective

In our experience, the reviews that matter are rarely the ones in the diary. They are the ones triggered by a change nobody told the security team about: a new loading dock, a contractor with a key, a shift roster that left the back gate unwatched for two hours.

That is why we do not treat security as a response to incidents. We work to anticipate them, and that means keeping the risk picture current. With more than 15 years in the industry, and quality management under ISO 9001 and ISO 30000, we build review into the way a contract runs: guard and patrol reports feed back into the assessment, and monitoring data shows where controls are being tested.

Our advice is simple. Pick a scheduled interval you will actually keep, write your triggers into the plan, and give one person ownership of both. A modest review done on time beats an ambitious one that slips for two years.

— Abco

How ABCO supports an ongoing review cycle

A review is only as good as the information feeding it. Our licensed guards, mobile patrols and CCTV and alarm monitoring generate the incident records, patrol logs and alarm histories that a review needs, and they run around the clock across Australia. For sites that need after-hours cover, our Night Owl Service starts from $5.45 per day.

If you want a review of your current assessment, or a new one, talk to us about security guarding, construction site security or an integrated plan through our security management services. Our broader guide to risk security management explains how the pieces fit together.

Setting up a review calendar that holds

The schedule fails most often because of administration, not because people disagree with it. A few habits help:

• Set the next date at the end of every review, and put it in the diary of the person responsible and their manager.
• Keep a trigger register. A short log of changes and incidents that prompted a look, with the outcome, shows an auditor or insurer that the process is alive.
• Link reviews to existing rhythms. Tie them to budget cycles, project stage gates, lease renewals or pre-season planning so they are not an extra event.
• Keep reviews proportionate. A quarterly review of a high-risk area can be a one-hour walk and a log check. Save the full rebuild for the annual or biennial cycle.
• Track open actions. An assessment that lists ten gaps and closes two has not improved your security.

FAQ

How often should you review a security risk assessment?

At least annually for most commercial sites, and sooner when something changes. Higher-risk matters call for a review every three months in the NSW Health policy if nothing has triggered one earlier. Government entities working to the PSPF must formally review their security plan at least every two years.

Is a two-yearly review enough?

Only for stable, well-controlled assets, and only alongside trigger-based reviews. The two to three year intervals in government frameworks sit beside rules to review after significant incidents or changes. If your site changes quickly, such as a construction site or an events program, two years is far too long.

What should trigger a security review before the due date?

An incident, even one without injury, is the first trigger. Proposed changes to the workplace, equipment or procedures, new risk information and concerns raised by workers or stakeholders should also prompt a review. Changes to the threat level matter for crowded places.

Who should carry out the review?

Either internal security staff, an external consultant or an oversight committee, as the PSPF allows for government entities. Internal reviews are quicker and know the site. An independent review adds fresh eyes, so many organisations use both.

Do events need a new review every time?

Yes. Each event has its own crowd, venue, program and threat context, and audit guidance asks whether the risk management plan is reviewed for each event. Treat last year’s plan as a starting point, never as the finished document.

Sources

• Protecting People and Property, NSW Health (January 2026)
• Protective Security Policy Framework, Release 2025
• ASIC Security policy, July 2024
• SAPSF PHYSEC1 Physical security, Government of South Australia
• ACT Protective Security Framework, Core Practice Standards (February 2025)
• Crowded places security audit
• Events in Parks Guidelines, Inner West Council
• Legal risk management basics

Recommended

• Get Your Free Security Risk Assessment Template 2026
• Security risk assessment checklist for Australian facilities
• The Risk Assessment Process: A Practical Guide for 2026
• Avoid the Wrong Assessment: Threat vs Risk for Security Managers