Managing Cleaning and Security Vendors: SLAs and Proof of Work

Cleaning and security are the two services businesses buy that are hardest to verify, for the same reason: the work happens when you are not there, and its absence looks identical to its presence until something goes wrong. A floor that was not mopped looks fine on Monday morning. A guard who was not at his post looks fine until there is an incident. So the discipline is not vendor selection. It is writing a contract you can actually check, and receiving evidence you did not have to chase.

Step 1 — Write the scope as observable tasks

"Keep the premises clean" is not a scope. It is a disagreement waiting to happen. A scope that works is a table of area × task × frequency × standard:

Every row is checkable by someone who was not there when it happened. That is the entire test. The same applies to security: number of guards, posts, patrol frequency and route, log-keeping, incident-reporting time, and what they are and are not permitted to do.

Step 2 — Check the statutory position before you sign

Two checks that are routinely skipped and both are worth doing.

Private security agencies are licensed in Malaysia. Security services are regulated under a licensing regime administered by the Ministry of Home Affairs (KDN) under the Private Agencies Act 1971. Ask to see the licence, check it is current, and confirm it covers the service you are buying. Confirm the current requirements with KDN — this is a regulated area and specifics change.

Verify your contractor's statutory compliance for their own workers. A contractor who is not paying EPF, SOCSO and EIS for the people working on your site is a risk to you as well as to them — practically, reputationally, and in some circumstances legally. Ask for evidence of registration and current contributions as a condition of the contract, and repeat the check annually rather than at onboarding only. Our EPF, SOCSO and EIS guide sets out what those obligations are.

Also confirm: workers' insurance coverage, public liability cover, and — for foreign workers — that permits are valid for the work being performed.

Step 3 — Build an SLA with consequences

An SLA without a consequence is a wish. Four components:

1. Response times by severity. A security incident is minutes; a cleaning shortfall is the next scheduled service.
2. Rectification times. Separate from response — arriving is not fixing.
3. Attendance requirements. Minimum headcount and hours, and what happens when a shift is short.
4. The consequence. Usually a pro-rata deduction for unperformed work, escalating for repeats, with termination rights after a defined pattern.

Keep the consequence proportionate and administratively simple. A deduction you have to argue about every month costs more in management time than it recovers. A deduction that is mechanical — hours not worked, deducted — settles itself.

Step 4 — Evidence you receive without asking

This is where most contracts fail. The vendor is not withholding evidence out of bad faith; nobody asked for it in a form that survives.

Require, as part of the service and not as an extra:

• Attendance evidence per shift — who, when in, when out. Names, not headcount.
• Photo evidence for defined checkpoints, timestamped and location-stamped, at set times. Not "some photos" — a fixed list, so a missing one is visible.
• A daily or shift log for security, including incidents and nil returns. "Nothing happened" recorded is information; nothing recorded is not.
• Monthly summary against the scope table, showing scheduled versus completed.

The reason to insist on timestamped and location-stamped photos specifically is that undated photos prove nothing — a picture of a clean toilet taken last Tuesday looks exactly like one taken this morning. If your vendor's evidence arrives in a WhatsApp group, understand what that does and does not give you: see running your business on WhatsApp without losing the records.

Step 5 — Compare quotations on the right basis

Vendor quotations are hard to compare because they are structured differently on purpose. Normalise them before deciding:

• Convert everything to cost per man-hour at the stated headcount and hours. A cheaper monthly price with fewer hours is not cheaper.
• Ask what the price assumes about supplies and equipment — chemicals, consumables, machinery. A quote that excludes consumables is not a like-for-like quote.
• Ask what happens on public holidays, and whether replacement cover for absence is included or charged.
• Ask about supervision. A supervisor who visits weekly is a different service from one who never comes.
• Check whether the price assumes statutory-minimum wages for the workers. A quote materially below the others often means the shortfall is being taken out of somebody's pay — which is both a compliance risk you inherit and a reliable predictor of turnover on your site.

Step 6 — Review on a fixed rhythm

Monthly, against four things and nothing more: scheduled versus completed tasks, SLA breaches and deductions applied, incidents and their resolution, and complaints from staff or customers. Meet the vendor quarterly with that data in front of both parties. A vendor who sees the same numbers you see behaves differently from one who receives a complaint every few months.

For chain operators, this fits inside the wider maintenance system in the multi-outlet maintenance SOP; for strata committees, appointing and supervising these contractors is a core committee duty covered in the JMB and MC guide.

Frequently asked questions

Should I hire cleaners directly instead of using a contractor?
Direct employment gives control and continuity and makes you the employer for wages, statutory contributions, leave cover and replacement when someone is sick. Contracting shifts that burden and costs a margin for it. The honest comparison is total employer cost — use the payroll calculator — against the contract price, not wage against contract price.

What is a reasonable contract length?
Long enough for the vendor to invest in knowing your site, short enough that poor performance has consequences. One year with a defined termination-for-cause right is a common shape. Avoid multi-year terms with no performance exit.

The vendor says photo evidence is extra. Is that reasonable?
It is a negotiating position, not a technical constraint — their staff already have phones. Put evidence requirements in the tender rather than adding them afterwards, so every quotation is priced with them included and you can compare fairly.

How do I handle a guard or cleaner I am unhappy with personally?
Through the vendor, in writing, against the contract — never directly. They are the vendor's employee, and instructing them yourself blurs the employment relationship in ways that can create liability for you.

What if the vendor's worker is injured on my premises?
That is exactly why the insurance and statutory-compliance checks in step 2 are not paperwork. Confirm before signing that the vendor carries appropriate cover for its own workers and public liability for third parties, and keep a copy of the current certificates on file.

Sources: private security agencies in Malaysia operate under a licensing regime administered by the Ministry of Home Affairs (KDN) under the Private Agencies Act 1971 — confirm current licensing requirements with KDN, as this is a regulated area and details change. Employer statutory contribution obligations (EPF, SOCSO, EIS) as covered in our EPF/SOCSO/EIS guide, pinned against the EPF Act 1991 Third Schedule and PERKESO contribution schedules; these apply to the contractor in respect of its own workers. The scope, SLA and evidence practices in this guide are commercial recommendations rather than legal requirements.