By: Phil O'Toole
Managing Partner
Councillors are among the most visible representatives of local government. Their role requires regular interaction with residents, community groups, businesses and other stakeholders, often in public settings and sometimes around contentious issues.
That accessibility is fundamental to local democracy, but it also means councils need to think carefully about how security risks are identified and managed.
Importantly, councillor safety and security should not be considered in isolation. Customer-facing employees, executives and other staff who regularly engage with the public may encounter many of the same risks. Council chambers, customer service centres, public meetings, community events, site visits and online interactions can all form part of a council's broader security environment.
Security risks can arise wherever councillors and council employees interact with members of the public.
While the council chamber may be one of the more obvious environments to consider, risks can also arise in customer service areas, reception spaces, car parks, community facilities, public forums, and site visits.
Digital communication adds another dimension. Email, social media and other online channels have made councillors and executive staff increasingly accessible to their communities, meaning councils need to consider security risks across both physical and online environments.
For this reason, local government security is best approached as an organisation-wide risk issue. Governance, work health and safety (WHS), risk, facilities, communications, IT and operational teams can all have a role to play.
A security governance review examines how council identifies security risks, assigns responsibility, oversees controls and follows up incidents and improvements. It is not a substitute for specialist assessment of physical security vulnerabilities or the technical adequacy of security systems. While council retains responsibility for managing security, the review provides independent findings and recommendations for improvement within an agreed scope.
Clearly defining those responsibilities can help ensure that emerging concerns are identified and acted upon rather than falling between organisational functions.
Before introducing new security measures, councils should understand the risks they are trying to manage.
A security risk assessment can help identify where councillors and employees may be exposed, assess the controls already in place and determine whether additional safeguards are required.
The assessment should consider both the physical settings and the arrangements for managing risk. Relevant settings include council chambers and meeting areas, reception and customer service locations, community meetings and public forums, car parks, entrances and exits, and site visits and external engagement. The governance questions addressed include who is accountable, how concerns are escalated and how agreed actions are monitored.
The objective is not to assume that every environment presents the same level of risk. Rather, it is to identify where vulnerabilities exist and ensure controls are proportionate to the assessed risk.
A security risk assessment should also reflect current circumstances. Previous incidents, changes to facilities or meeting arrangements, emerging community issues and changes in the way services are delivered may all warrant reviewing existing arrangements.
One of the most useful questions councils can ask is not:
"Do we have security controls in place?"
but:
"Do we know they work?"
A council may have duress systems, CCTV, access controls, emergency procedures and incident reporting processes in place. From a governance perspective, the questions are who is responsible for those controls, what evidence supports their suitability and operation, and how identified failures are escalated and addressed. Technical assessment of whether security systems are appropriate and function as intended is a separate question requiring the relevant expertise.
Regular testing and review can help identify gaps before they become significant issues.
For example, councils can ask who arranges and records duress-system testing, who receives urgent escalations, and how changes to facilities or operating arrangements trigger a review of potential vulnerabilities. A governance review can examine these responsibilities and the supporting records; it does not replace specialist testing of the systems themselves.
A practical security health check can provide a high-level overview of these arrangements and help identify where more detailed assessment may be required.
Councillor and employee security should not exist separately from a council's wider governance and risk framework.
Responsibilities for security, WHS, facilities, incident response and communications should be clearly understood. Significant issues and outstanding actions should also be visible to the appropriate levels of management and governance.
This approach helps move security from being primarily reactive to becoming part of an ongoing risk management process.
It also provides councils with greater assurance that identified issues are assigned, monitored and addressed rather than simply documented.
Not every council will require the same level of security review.
For some councils, a Security Health Check may be a useful first step to identify obvious gaps, review current governance arrangements and establish practical improvement priorities. Its findings depend on the agreed scope and evidence reviewed; they do not establish that all security risks or vulnerabilities have been identified.
Where the operating environment is more complex, significant vulnerabilities have been identified or previous incidents warrant further examination, a more comprehensive Physical Security Risk Assessment may be appropriate. This is distinct from a governance review: the scope and specialist expertise needed to assess physical vulnerabilities and technical security measures must be established separately.
The purpose is not to enhance security for security's sake. It is to determine whether existing arrangements are appropriate for the council's particular environment and risks. An independent security governance review can examine how security arrangements are overseen, identify gaps in accountability and evidence, and support a prioritised approach to improvement. Centium's security readiness material identifies Security Health Checks and Physical Security Risk Assessments as possible review options; the appropriate pathway depends on the risk, complexity, previous incidents and expertise required. A security governance review does not itself provide a specialist assessment of physical vulnerabilities.
Centium has developed a practical Councillor and Public-Facing Staff Security Readiness Checklist for Australian local councils, covering areas including governance and risk, council facilities, public-facing environments, incident management and continuous improvement.
Use the checklist to review your council's current arrangements and identify areas that may require further attention.
https://centium.com.au/councillor-public-facing-security-readiness/
If the checklist identifies gaps or areas requiring further assessment, talk to Centium about scoping a Security Governance Review or Security Health Check. The review can focus on how your council oversees risks affecting councillors and public-facing employees, assigns responsibility for facilities and incident response, and tracks improvement priorities. Where a more detailed Physical Security Risk Assessment is needed, its specialist scope and delivery requirements can be considered and delivered by Centium’s certified experts in this area.
Phil O’Toole is a respected strategist, advisor, and thought leader in legislative compliance, business improvement, risk management, probity, assurance, and ethical conduct across the public, private and not for profit sectors.
With over 40 years of experience—including more than 25 years in the NSW Public Sector and several years as a Director in the NSW Attorney General’s Department—Phil has developed deep subject matter expertise in investigations, conduct reviews and fact-findings, probity and governance, ethical conduct, risk management, and strategic planning.
He is a former NSW Chapter Chair of the Institute of Internal Auditors Australia (IIA) and is frequently invited to chair and speak at professional conferences and seminars. He has also served as an expert witness in ICAC and judicial hearings.
As Managing Partner and Founder of Centium, Phil has built an organisation widely regarded as a trusted advisor, delivering strategic advisory, governance, and business improvement services with a strong emphasis on ethical conduct and value for money. Under his leadership, Centium maintains a strong reputation for integrity and professionalism—earning repeat engagements not through hard-selling, but through the consistent quality of its work, practical recommendations, and commitment to fostering long-term client relationships.
Phil believes that in consulting, especially in confidential or high-stakes matters, trust and respect are foundational. His approach reflects this ethos—combining technical expertise with genuine partnership. Executives seeking to enhance ethical conduct, transparency, accountability, and organisational effectiveness are encouraged to connect with Phil via LinkedIn or at phil.otoole@centium.com.au.
