Try calling the number listed in your contract as the out-of-hours contact for the operations manager, at eleven at night. We do it on every review, and no other single step opens a conversation about performance monitoring so quickly. Sometimes nobody answers. Sometimes the person who does cannot place the name of the building. And occasionally you reach somebody who stopped working for that contractor two years ago.
These are not slips. Where an agreed contact route goes untested for years, out-of-date numbers and unresolved responsibilities stay hidden, because nothing brings them to light. The check takes ten minutes, it is uncomfortable, and its outcome has no consequences as long as nothing happens.
Two things need to be in place before you pick up the phone: the test call should be provided for in the contract, and the number you dial must not be a line reserved exclusively for genuine emergencies.
Presence is necessary and not sufficient
What clients check is usually the same thing: is somebody at the gate. The question is legitimate, because an unstaffed shift is a serious finding and an immediate breach of contract. It has only one drawback, and it outweighs the advantage: it is answered quickly and says nothing thereafter.
Presence is equally satisfied where the individual on duty is not qualified for the task. Where they have never been briefed on the building. Where they are paid below the rate the tender was based on. Where they do not know whom to call in an incident. In every one of those cases the client sees the same picture, and in every case pays the same price.
Performance monitoring that deserves the name therefore examines seven other things. All of them are accessible without specialist knowledge, and none requires access to personnel files.
1. Qualification, and the trap in the specification
Guards require evidence of qualification under Section 34a of the Trade Regulation Act (Gewerbeordnung), and there is more than one route to it. The instruction course covers straightforward guarding duties, the competence examination is mandatory for certain activities, and alongside these the Guarding Ordinance (Bewachungsverordnung) recognises a range of vocational qualifications as equivalent.
For monitoring a live contract, one question counts: does the qualification held match the activity actually performed? Among the duties requiring the competence examination are patrol rounds in areas under domiciliary rights with actual public traffic, and the chambers expressly count school buildings, hospitals and publicly accessible courts among these. Where the specification required only the instruction course and patrols through publicly accessible areas take place in the building, the question arises whether the personnel are permitted to perform that task at all.
Why this distinction so often goes wrong, and how the requirements can be brought properly into the tender documents, we address in a separate article.
How qualification can be checked on site. Under Section 18 of the Guarding Ordinance, every guard must carry an identity card issued by their employer, showing among other things the guard register identification numbers of the individual and the company.
There is one limitation you need to know: the duty to produce the card under Section 18(2) BewachV applies to the enforcement authorities, that is, the public order office, the police and customs. The client is not among them.
That is precisely why the contract needs a provision, and a data-minimising one. For the purpose of monitoring it is usually enough to have a deployment list with a personnel code instead of the name, the type of qualification, the contractor's confirmation of the register position and the date of the building-specific briefing, together with a duty to notify changes and a right to inspect on a sample basis. Without such a provision, qualification in the building remains an assertion; with one drawn too widely, you acquire a data protection problem.
2. The operating instructions
Operating instructions are not a voluntary extra. Under Section 17 of the Guarding Ordinance, the security company must produce them and hand them to every guard before their first deployment against written acknowledgement. So it is already settled that they must exist and that receipt is documented.
Four questions cover the rest. Are they building-specific and current, with an identifiable version status? Have they been reconciled with the client's requirements, and is that reconciliation documented? Have all personnel deployed confirmed receipt and briefing? And are they kept where the work is done, that is, in the guard room rather than at the branch office?
It is usually the second question that stalls. Instructions exist, they were drafted by the contractor, and nobody on the client side has ever read them. Which means that the document governing conduct in an emergency records one party's understanding of what the other wants. A word of caution here: reconciling is not the same as approving. A client who formally approves a contractor's technical instructions may be taking part of that contractor's professional responsibility into its own house.
On content, two passages repay attention: the rules for conflict situations and assaults, and the description of the interface with the building's own emergency organisation. Both are frequently missing, and both are exactly the passages somebody looks up later.
3. Patrols and checkpoints
A patrol schedule sets out routes, frequency and checkpoints. The question is not whether it exists but whether the checkpoints are actually reached and whether that can be evidenced.
Where a guard tour system is in use, a data trail is created. The contract should say something about it, though not in the language of ownership. What needs settling is the client's access and analysis rights, the purpose of the analysis, the retention period and the question of which evaluations are permissible. This data shows when a particular individual was where, and it can be condensed into movement profiles. Purpose limitation and data minimisation apply here as everywhere, and staff are to be informed.
Set up properly, the analysis answers two questions: whether the frequency was maintained and whether the times vary. Completely random rounds are not the objective, since some checkpoints have to be reached within particular windows. What works is a mix of fixed mandatory windows and variable route elements. What you want to avoid is the round that passes the same point at the same minute for months, because to anyone watching the building that is a timetable.
The finding these analyses produce most often concerns shift handovers. Gaps of forty or sixty minutes regularly open up there, with nobody on the move. The patrol schedule says nothing about it, because the schedule describes the shift and not the transition between two.
4. The occurrence book
An occurrence book should make it possible to assess an incident after the event. Measured against that, a substantial share falls short of what it ought to deliver.
Often this is because two things are mixed together. A routine record may be brief; "round completed, nothing to report" will do, provided route, time and checkpoints are documented elsewhere. An incident report may not. Where both are kept in the same book in the same format, the level of detail drops to that of the more frequent case, and the more frequent case is the routine one.
Three things make the difference. The level of detail for incidents, that is, time, those involved, sequence of events, action taken, who it was passed to. Tamper resistance, that is, numbered pages and bound entry or an electronic system in which entries cannot be altered afterwards without a trace. And the analysis: an occurrence book that is kept and never read is an archive without a reader. A regular written security report with incident statistics changes more here than any additional rule on how to keep it.
5. Escalation and reporting routes
Back to the late-night call from the beginning. It tests only one link in a chain that has to be complete: who reports to whom, at which level, within what time, and who deputises when the first point of contact cannot be reached.
Two checks are quickly done. First, whether the contact details on file are current, which can be established by calling a sample of them. Second, alarm transmission. Where an alarm system is connected to an alarm receiving centre, the chain should be activated and recorded at regular intervals. At what interval follows from the applicable technical rules, the manufacturer's specifications, the maintenance contract, the insurance conditions and the building's risk assessment, not from a general annual rule. What matters is that type, interval, participants and recording are agreed in advance with the receiving centre, so that no unnecessary response is triggered. Where such an activation has never taken place, the chain is tested for the first time in an emergency.
For operators of critical infrastructure there is the additional point that reporting duties towards the supervisory authority exist and that the interface to it must be embedded in the operating instructions. Whether and to what extent your building is affected is a legal assessment and not our task. Checking whether the operational implementation matches it certainly is.
6. Cover for absences
The interesting case is not the planned deputy but the sickness notification at ten in the evening for the night shift. Ask how the process then works in practice, and ask to see the last three cases.
Where there is no record of them, nobody has attended to it. And where replacement staff without knowledge of the building are deployed, the client loses precisely what it is paying the contractor for. The answer to this is not the widest possible distribution list but a named reserve pool: a limited number of staff who have been briefed on the building, whose briefing is documented and refreshed at intervals. Briefing as many people as possible merely increases the number of those who know the building and its access points.
7. Staffing and pay
An error persists here that distorts calculations. There is no nationwide sector minimum wage for the guarding industry as a whole under the Posted Workers Act (Arbeitnehmer-Entsendegesetz). For the security sector, the federal labour ministry's overview currently lists only the regulation on mandatory working conditions for security staff at commercial airports.
What actually applies has several layers. The statutory minimum wage has stood at 13.90 euros since 1 January 2026 and is the absolute floor. Above it sit the regional collective agreements between the trade union ver.di and the employers' association BDSW, which differ from state to state and have been declared generally binding in some of them. Where that is the case, the agreement applies to every business within its scope regardless of membership, and the customs authority's undeclared work unit enforces it. For public clients, the procurement minimum wages and collective agreement compliance rules of the relevant state come on top.
For calculation purposes this means: anyone costing a security tender at the statutory minimum wage is costing something other than reality. What governs is the applicable collective agreement with its grading criteria, together with the premiums for night, Sunday and public holiday work, which vary considerably between states. Which agreement applies in your case, and whether it has been declared generally binding, can be clarified with the relevant state ministry or through the collective agreement register, and you want that answer before the tender goes out.
In monitoring, two things need keeping apart that are regularly conflated. The staffing check establishes which individual with which qualification was deployed, and whether that matches what was offered and owed. Where a position was costed with the competence examination and staffed with the instruction course, you have a finding. What was actually paid cannot be inferred from it. Checking pay requires its own evidence, its own contractual audit rights or the competent authority, and how far your audit rights reach is a legal question.
What you can check yourself in half an hour
Call the operations manager's number on file outside office hours and see who answers.
Ask to be shown the operating instructions in the building rather than sent them by email, and check whether there is a date on them.
Ask the person on duty whom they would call first if there were an assault on the ground floor. If the answer comes hesitantly or departs from the escalation chain, you have the finding that matters.