Most security rotas are built backwards, names first, compliance checked afterwards. This guide walks through the order that actually works, from contracted hours to publication, and the checks that stop a rota falling apart mid-week.
Building a rota for a security operation is a different problem from building one for a shop or a restaurant. You are not staffing to demand curves. You are staffing to contractual obligations that specify exactly how many officers must be on a site at a given hour, and a gap is not a service inconvenience. It is a breach.
Most rotas in this industry are built in the wrong order. A manager opens last week's spreadsheet, copies it forward, changes the names that need changing, and sends it out. Compliance gets checked afterwards, if at all. That approach works until someone's licence expires, or a guard hits 48 hours, or two sites need the same person on Saturday night.
Here is the order that holds up.
Start With the Contract Not the People
Before any name goes into a rota, you need to know precisely what each site requires. Not roughly, precisely. How many officers, at what hours, on which days, with what qualifications.
A contract that says "24/7 manned guarding" needs translating into a coverage grid: 168 hours a week, one officer at all times, which is 4.2 full-time equivalents once you account for leave and absence. A contract specifying a dog handler on Friday and Saturday nights is a different staffing problem again.
Write the requirement down per site before you think about who fills it. This sounds obvious. In practice a surprising number of operations carry the requirement in one manager's head, which is a risk in itself.
Map Your Coverage Requirement
With the requirement written down, lay it out as a grid, sites down the side, days across the top, hours in the cells. What you are looking for is total demand, and where it clusters.
| Mon | Tue | Wed | Thu | Fri | Sat | Sun | |
|---|---|---|---|---|---|---|---|
J. Ahmed | 07–19 · Site A | 07–19 · Site A | 19–07 · Site C | 19–07 · Site C | |||
S. Okafor | 19–07 · Site B | 19–07 · Site B | 19–07 · Site B | 07–15 · Site A | 07–15 · Site A | ||
L. Kowalski WTR 48h | Leave | Leave | 08–20 · Site D | 08–20 · Site D | 08–20 · Site D | ||
M. Begum | 07–19 · Site C | 07–19 · Site C | 07–19 · Site C | 07–19 · Site A | 19–07 · Site A | ||
| Unallocated | Site A · 07–19 | Site B · 19–07 |
This is where most operations discover their real problem. Demand is rarely evenly distributed. Weekend nights are hard to fill. Christmas is harder. Two sites that each need one officer at 6am on a Monday need two different officers, and if you only have one who is trained for both, you have a gap you did not know about.
Do this before assigning anyone. It is far cheaper to discover a structural shortfall in planning than at 5am on the day.
Build the Compliance Layer Before You Assign Names
This is the step that gets skipped, and it is the one that costs money.
For each officer, you need current answers to a short list of questions. Is their SIA licence valid, and does it expire during the rota period? Do they hold the qualifications this specific site requires, first aid, CCTV, dog handling, a site-specific induction? Is their Right to Work documentation current, and if it is time-limited, does it expire before the shift? Are they banned from any site, whether by the client or by a previous incident?
Any officer failing any of these is not available for that shift. Not "available with a warning", unavailable. A warning a manager can dismiss at 6am under pressure is not a control.
The practical difficulty is that this information usually lives in four places: licences in one spreadsheet, training certificates in personnel files, Right to Work documents in a filing cabinet, site bans in a manager's memory. Consolidating it is the single highest-value thing most security operations can do to their scheduling process.
- SIA licence valid for the whole shift
- Site-required qualifications held
- Right to Work documentation current
- Not banned from this site
- Eleven hours since last shift endedOnly 9h 40m, assignment blocked
Assign People to Shifts
Now you can put names in cells. Work through the hardest shifts first, the ones with the fewest eligible officers, usually weekend nights and specialist roles. Filling easy shifts first and leaving the hard ones is how you end up with a rota that cannot be completed.
As you assign, watch three things: travel time between consecutive shifts at different sites, the running total of hours per person across the reference period, and consecutive days worked.
Leave deliberate slack. A rota with every officer at maximum hours has no capacity to absorb a single sickness, and in this industry you will have sickness.
Check the Rota Against Working Time Rules
Before publication, run the rota against the Working Time Regulations. The checks that matter most in security are the 48-hour average weekly limit, eleven consecutive hours of daily rest between shifts, twenty-four hours of uninterrupted weekly rest, and the separate limits that apply to night workers.
Security has some specific exemptions here, activities requiring a permanent presence can be treated as a special case, but exemptions come with compensatory rest obligations rather than removing the requirement. Getting this wrong is both a legal exposure and a fatigue risk on sites where alertness is the product.
Run the working time checks on the finished rota
Four checks catch almost everything: the 48-hour weekly average across the reference period, eleven consecutive hours between shifts, twenty-four hours of weekly rest, and the separate average for night workers. Run them against the whole rota, not shift by shift.
Publish With Enough Notice
Publish as far ahead as you can, and be consistent about it. A rota published on Friday for a week starting Monday generates avoidable churn: officers who have made other commitments, last-minute swaps, and the administrative overhead of managing both.
Notice periods also matter commercially. Officers leave employers who cannot tell them what they are working in ten days' time, and replacing a trained, site-inducted officer costs considerably more than publishing earlier would have.
Handle the Changes That Always Come
No rota survives contact with a full week. What separates a well-run operation from a chaotic one is not whether changes happen but whether they are controlled.
Changes need to be logged, communicated to the officer in a way you can prove, and re-checked against the same compliance rules as the original assignment. A replacement officer dropped into a shift at short notice is exactly the scenario where an expired licence slips through, because the checks that were run on Monday are not re-run on Thursday.
Coverage on the day is a different view of the same rota. What matters at 6am is not what you planned but who has actually arrived.
Common Mistakes That Cost Security Companies Money
One spreadsheet, one owner
When the person who understands it is on holiday, the operation is exposed.
Shifts over WhatsApp
No record of who was told what, which matters the moment a shift is missed.
Compliance as a monthly audit
Checking licences monthly means deploying on an expired one for up to 29 days.
Hours tracked per site
An officer working two branches breaches 48 hours while each branch looks fine.
A Note on Templates
Rota templates are useful for stable contracts, a site with a fixed 4-on-4-off pattern does not need rebuilding every cycle. They are actively harmful when applied to sites with variable requirements, because the template becomes the plan and the actual requirement gets forgotten.
Use templates for the stable core of your operation and build the variable portion deliberately each period.
Where Software Helps
The parts of this process that benefit most from automation are the ones that are tedious and easy to skip: checking every assignment against licence expiry, qualification, and Right to Work status; tracking cumulative hours across sites; detecting double-bookings and insufficient rest; and proving after the fact who was told what and when.
ProRota was built for this specific problem. Compliance data sits alongside the rota rather than in a separate system, so an officer whose licence has expired cannot be assigned to a shift. Conflicts, insufficient rest, and hours breaches surface as you build rather than after publication. Published shifts go to the officer's phone with a record of delivery.
If you want to see how that works against your own contracts, get in touch and we will walk through a live example.
