Records to keep for an NSI, SSAIB or BAFE audit
A scheme audit is mostly a records exercise: the auditor samples jobs and asks to see the paperwork behind them. This guide lists the records a small or medium fire or security contractor is usually asked for, how to keep them findable, and the gaps that tend to get raised. It is general guidance; your own scheme document and the standards it cites are the authority.
General guidance only. Compliar is not affiliated with, approved by or endorsed by NSI, SSAIB, BAFE, NICEIC or any other scheme or certification body. Each scheme publishes its own scheme documents and audits against them and the standards they cite. Read yours; where this page and your scheme document differ, your scheme document wins. Last reviewed 3 November 2026.
What an audit actually looks at
Whichever scheme you are with, the pattern of an audit is similar. The auditor has your scope of certification in front of them: the disciplines you are certificated for, such as intruder and hold-up alarm systems to PD 6662 and BS EN 50131, CCTV to BS EN 62676, access control, or fire detection and alarm systems to BS 5839-1. They then pick a sample of jobs from the period since the last visit and follow each one from enquiry to invoice, asking for the record at each step. Alongside the job sample they look at the company: who does the work, whether they are competent and screened, what equipment they use and whether it is calibrated, how complaints and false alarms are handled, and whether last year's findings were closed.
So the question is not "do we have good paperwork" but "for any job the auditor picks, can we put the whole trail in front of them in a few minutes". That is a filing problem as much as a quality problem.
Records by stage of the job
| Stage | Records usually asked for | What the auditor is checking |
|---|---|---|
| Enquiry and survey | The enquiry, the site survey or risk assessment for a security system, the design proposal and the system grade or category. | That the design was based on a survey and the grade or category was chosen for a reason, not by default. |
| Quote and agreement | The quotation, the customer's acceptance, the specification and any agreed variations from the standard. | That what was sold matches what was designed, and that variations were agreed in writing. |
| Planning | RAMS for the job, the engineer assignment and the appointment confirmation. | That the work was planned by someone competent for it, with the risks assessed before the engineer arrived. |
| Installation and commissioning | Installation and commissioning records, test results, as-fitted drawings, zone plan, programming or cause and effect, standby battery calculation. | That the system was tested and works as designed, and that the records exist for the next engineer. |
| Handover | Acceptance or handover record signed by the customer, user instructions, log book handed over, ARC and keyholder details. | That the customer knows what they have and how to use it, and that monitoring was set up properly. |
| Maintenance | The maintenance contract, the visit schedule, each visit's service report and certificate, readings, defects raised and the follow-up. | That visits happen at the frequency the standard and the contract require, and that faults found were dealt with. |
| Reactive and false alarms | Call-out records, response times, false alarm investigations and what was changed as a result. | That false alarms are investigated and reduced, and that call-outs met the agreed response. |
| Invoice | The invoice and any remedial quotes raised from defects. | Mostly to tie the sample together: the job that was invoiced is the job that was recorded. |
Company records the auditor will ask for
People
Who works for you, what each person is competent to do, their training and qualification records, and for security work the screening records the scheme requires (BS 7858 is the usual reference). Subcontractors need the same trail.
Test equipment
A register of the instruments engineers use, with serial numbers and calibration dates where calibration applies, and which engineer holds each one. The auditor may pick an instrument and ask for the certificate.
Complaints and non-conformances
A log of customer complaints and of your own non-conformances, what was done about each, and evidence that last year's audit findings were closed.
Documents in use
The current versions of your certificate templates, RAMS templates and procedures, and a way of showing that engineers use the current one and not a copy from 2019.
Monitoring and keyholding
For monitored systems, the alarm receiving centre details, the unique reference number where police response applies, and keyholder details held and kept up to date.
Insurance and the basics
Public and employer's liability, professional indemnity where your scheme asks for it, and the company details the scheme holds on file matching reality.
The gaps that get raised
- The survey that was never written down. The engineer surveyed the site in their head and went straight to a quote. The grade or category then has no recorded basis.
- Variations agreed on the phone. The customer asked for fewer detectors in the stock room; nobody wrote it on the design record. The next engineer raises it as a defect and the auditor asks why.
- Visits late with no reason. A six-monthly service done at eight months with no note explaining why. Keep the planned date fixed and record the actual date and the reason.
- Defects with no outcome. A failed sounder on March's report that never became a quote, a job or a customer refusal in writing.
- Certificates nobody can find. They exist, in an engineer's email. If it takes twenty minutes to produce one certificate, the auditor's sample of ten jobs takes the afternoon.
- Old templates still in use. A certificate referencing a superseded edition of the standard, printed from a laptop that was never updated.
- Calibration out of date. A sound level meter or a multifunction tester past its calibration date, with readings recorded from it.
Keeping it findable: one job, one trail
The simplest structure is the one auditors follow: everything about a site is held against that site, and everything about a job is held against that job, in date order. Enquiry, survey, quote, RAMS, visits, certificates, defects, quotes raised from them and invoices all hang off the same record, so the whole sample can be opened from one screen rather than assembled from email, a shared drive and a filing cabinet.
That is how Compliar is arranged. Customers hold sites, sites hold assets, maintenance plans and the log book, and jobs hold the visit, the service report, the certificates, the defects and the documents that were sent. Certificates are laid out to the standard for the discipline, name the standard on the document, and once issued cannot be deleted; an edit needs a reason, which is logged against the job. Training and qualification records are held against each person. Defects are tracked from the visit that found them to the quote, the job and the resolution, so the outcome is never missing. Import and export of all data is on every plan, so moving in does not mean starting the trail again.
Compliar provides record-keeping and certificate workflows. It does not certify work, grant accreditation or stand in for your scheme. The competent engineer and your scheme remain responsible for the work and for what is certified.
Common questions
Will using Compliar get us through an audit?
No software can promise that. An audit judges your work, your people and your records against your scheme document and the standards. Compliar keeps the records in one place, laid out to the standards, so the trail is there to show; what is in them is down to your competent engineers.
Is Compliar approved by NSI, SSAIB or BAFE?
No. Compliar is not affiliated with, approved by or endorsed by any scheme or certification body. The templates reference the British Standards for each discipline; the engineer and the scheme remain responsible.
How many jobs does an auditor sample?
It varies by scheme, by the size of the company and by what was found last time. Assume any job since the last audit can be picked, and keep every job's trail complete rather than preparing a few.
What records do we need for subcontractors?
Usually the same as for your own staff: competence, training and, for security work, screening, plus evidence that the subcontracted work was checked. Check your scheme document for what it requires.
Do we need calibration certificates for every instrument?
For instruments whose readings go on certificates, such as multifunction testers and sound level meters, the usual expectation is a current calibration record. Keep a register with serial numbers, dates and who holds each instrument.
Can old certificates from our previous software be kept with the site?
Yes. Legacy certificates as PDFs or photos can be added against any site in Compliar, so the history is in one place.
What about electrical schemes such as NICEIC or NAPIT?
The job-trail principle is the same: survey, quote, RAMS, the certificate laid out to BS 7671, defects and invoice held together. Each scheme's assessment criteria are its own; check them.
What does it cost?
Certificates, RAMS and the records described here are included with every seat, from £35 + VAT per user per month on Lite. No per-certificate fees and no contract.
Keep the records where the auditor can find them
Book a demo and Keiran will show you how a sampled job looks in Compliar: survey, quote, RAMS, visit, certificate, defects and invoice on one screen.