Secure contracting

Organisations often have contractors and agency staff working on site ranging from part-time cleaners to management consultants. They may have the same access to premises, systems, material and information as permanents staff but may not have undergone the same degree of checking.

One option for managing this risk is to ensure that contractors or agency staff are never left to work unsupervised. This is resource intensive, but may be essential if the risk is high. An alternative is to write into any contract for services a requirement that the same checks made for permanent staff are applied to contractors and temporary staff. As well as asking the contracting company to demonstrate that the checks have been carried out satisfactorily, the organisation can reserve the right to audit their processes.

The personnel security risk presented by contracting services can be reduced by following these measures:

• establish whether each contractor or agency is part of a recognised professional organisation responsible for accrediting standards in that industry
• confirm that the individual sent by the contractor or agency is the person who actually turns up. For instance, ask the contractor or agency to provide an authenticated photograph of the individual, together with their full name, in advance of their arrival. Then ask the person to provide photo ID that can be checked on entry, such as a passport.
• provide photo passes to contract and agency staff, once you are satisfied that the person who turns up on the day is genuine. The pass must be worn at all times. Ideally, the employer should retain the pass between visits and hand it over only after the photo has been checked.
• agree a procedure for substituting contract or agency staff with temporary replacements when the usual contract staff are away or ill; consider whether the replacement's duties or access need to be restricted.
• where possible, supervise contract or agency staff when they are on the premises and particularly if they have access to sensitive areas.
• if an individual's role requires them to access privileged information or control large financial transactions, consider a staged approach to that access.
• nominate a permanent member of staff to be responsible in personnel terms for contract and agency staff (i.e. not merely for overseeing delivery of the contract), so that potential security problems may be identified and addressed early.