The Compliance Stack That Wins Contracts (ISO + Screening + Accreditations)

In security tenders, you’re not only being judged on price. You’re being judged on risk.

Buyers want to know:

• can you supply competent, vetted people?
• will you manage incidents properly?
• can you prove control with evidence, not promises?

That’s why the security companies that win consistently usually have the same compliance stack in place. Here’s what it looks like in plain English.

What buyers are really buying: reduced risk

A buyer doesn’t want a supplier who says they’re compliant. They want a supplier who can prove:

• staff are suitable and competent
• processes are controlled
• incidents are managed
• records exist and can be produced quickly

The security compliance stack

1. Screening and vetting — non-negotiable

This is where bids often fall down. Have ready:

• your screening process, step by step
• evidence of checks completed, per employee
• your re-screening and periodic review approach
• right to work checks

If you’re working to BS 7858, make sure you can evidence it cleanly — dates, outcomes, who checked, and what was verified. If you’d rather not run it in-house, Screen My Staff handles it end to end.

2. Training and competence, with proof

Buyers don’t want “we train our staff”. They want evidence. Have ready:

• a training matrix by role
• induction records
• site and assignment briefings
• a refresher schedule
• supervision and spot-check records

3. Assignment instructions and control

In security, the plan matters. Have ready your assignment instructions template, escalation route and contact list, incident reporting process, and handover process.

4. Incident management

Buyers want confidence that when something happens, you respond properly. Have ready:

• an incident report template
• your investigation approach
• a corrective action process
• trend review — what you do with repeat issues

5. Accreditations and client-required schemes

Only include what you actually hold and can evidence. Common requests vary by client, but usually include CHAS or SafeContractor if you operate on construction sites, Constructionline where relevant, and sector-specific approvals such as SIA Approved Contractor status.

6. ISO standards — the trust layer

ISO isn’t magic, but it’s a recognised way to prove control. The common ones are ISO 9001 for quality, ISO 14001 for environment, ISO 45001 for health and safety, and ISO 27001 for information security on higher-risk contracts.

The key is not the certificate — it’s the evidence behind it: internal audits, management reviews, corrective actions, and controlled documents and records.

7. Supplier and subcontractor control

If you use subcontractors, buyers will ask how you control them. Have ready an approved supplier list, onboarding checks, and monitoring and performance review.

8. The tender evidence folder

The fastest way to look professional is to make evidence easy to navigate. Create one folder with subfolders for insurance, policies, training, screening, RAMS if relevant, accreditations, and records covering audits, incidents and corrective actions.

Rule: if a buyer asks for evidence, you should be able to find it in 60 seconds.

Common reasons security bids lose, even when the service is good

• screening process unclear or inconsistent
• training claimed but not evidenced
• incident process exists but no records
• documents out of date, or wrong versions in use
• evidence scattered across emails and desktops

How CAW Consultancy helps

We help security companies build an audit-ready, tender-ready compliance stack — fast, practical and jargon-free. If the bid itself is the bottleneck, we also do tender and bid writing.

Need help with this?

CAW Consultancy has helped UK businesses achieve ISO certification and industry accreditation for over 20 years, with a 100% pass rate. See what we do, or send us an enquiry — we’ll tell you what you need, what you don’t, and what it will cost. Ask and we’ll send over our security tender evidence checklist and folder structure.