How to Choose a Commercial Security Company in Johannesburg: The Property Manager’s Checklist

Choosing a commercial security company for your Johannesburg property isn’t about the glossiest brochure or lowest quote. It’s about verifying PSIRA compliance, understanding service level agreements, checking financial stability, and ensuring the provider understands Johannesburg’s unique challenges from Sandton office parks to Midrand warehouses. This checklist walks property managers through the vetting process that separates professional providers from expensive liabilities.

Summary

• PSIRA verification is step one, not an afterthought – Unregistered companies or those with lapsed credentials expose your property to legal liability and uninsured incidents. Verify registration before discussing anything else.
• Johannesburg demands local expertise – Security challenges in Rosebank office parks differ drastically from Germiston industrial zones. Companies operating across Gauteng should demonstrate node-specific knowledge.
• Service level agreements define what you’re actually buying – Without documented response times, reporting protocols, supervision structures, and escalation procedures, “security services” is an empty promise you can’t enforce.
• Financial stability protects your continuity – Security companies with cash flow problems cut corners on wages, training, and equipment. Vet their SARS compliance, insurance coverage, and operational track record.
• Red flags are often obvious if you’re looking – Reluctance to provide references, vague contract terms, pressure tactics, and missing insurance certificates all signal trouble before you sign.

Why Property Managers Get This Wrong (And What It Costs When They Do)

Here’s a scenario that plays out more often than anyone admits: a property manager inherits a commercial building in Bryanston or Rosebank, reviews the security contract they’ve inherited, and realizes they’re paying R35,000 per month for a service that’s delivering maybe R15,000 worth of actual value.

The guards are there, technically. They open the boom gate. They sign the occurrence book. But when a tenant reports a break-in attempt, there’s no documented escalation procedure. When the property manager asks for monthly incident reports, they get vague summaries written three weeks after the fact. When PSIRA inspectors visit, suddenly half the guards’ credentials are “being renewed.”

The problem isn’t that you hired a bad company. It’s that you didn’t vet them properly before signing, and now you’re contractually locked in for 12-24 months with a provider who knows you won’t go through the hassle of switching.

Choosing a security company is one of those decisions that looks straightforward until something goes wrong. Then you discover that “comprehensive security services” meant one under-equipped guard per shift, that “24/7 monitoring” meant someone checking a camera feed once an hour, and that “armed response integration” meant…well, nothing, because that was never actually set up.

This checklist exists to prevent that outcome. It’s built from the property management realities of Johannesburg’s commercial sector office parks in Sandton and Midrand, retail centres in Fourways and Rosebank, warehouses in Germiston and Jet Park, mixed-use developments across the northern and eastern suburbs.

Let’s walk through exactly what to verify, what to demand, and what red flags should stop negotiations immediately.

Step 1: PSIRA Compliance Verification (Do This First, Not Last)

The Private Security Industry Regulatory Authority (PSIRA) exists specifically to regulate South Africa’s security industry and weed out non-compliant operators. If a company isn’t PSIRA-registered, they’re operating illegally. If their guards aren’t PSIRA-accredited, you’re exposed to massive liability when incidents occur.

Company Registration

Every legitimate security business must be registered with PSIRA. This isn’t optional. Visit PSIRA’s Business Status Verification page and check the company’s registration status before your first meeting.

What you’re verifying:

• Active registration: The company appears in PSIRA’s database with “Active” status, not “Suspended,” “Deregistered,” or absent entirely.
• Registration number: Request the company’s PSIRA registration number and cross-check it yourself. Don’t just trust the certificate on their wall, those can be faked or outdated.
• Business address match: The registered address should align with their actual operating location. Mismatches suggest administrative disarray or deliberate obfuscation.

Why this matters: Unregistered security companies lack insurance, professional indemnity coverage, and legal standing. If their guards cause damage or fail to prevent an incident, your property owner’s liability increases because you contracted with an illegal operator.

Guard Accreditation

Individual guards must hold valid PSIRA registration in the appropriate grade. For most commercial property security, you need Grade C guards minimum, trained for access control, patrols, incident response, and reporting.

Request from the provider:

• Guard roster with PSIRA numbers: Every guard assigned to your site should have their registration number on file.
• Grade verification: Confirm guards hold the appropriate grade for their assigned duties (Grade C for standard guarding, Grade B for supervisory roles, Grade A for armed response).
• Expiry dates: PSIRA registration renews annually. Guards with expired credentials cannot legally work.

Build this into your post orders and vetting procedures. Make it standard practice to verify every new guard’s PSIRA card on their first day, and re-verify all guards’ credentials quarterly.

Red flag: If a company resists providing PSIRA numbers or says “we’ll get those to you later,” walk away. Professional providers have this documentation ready because it’s fundamental to legal operation.

Step 2: Financial and Operational Stability Checks

Security is a high-overhead business with tight margins. Companies struggling financially cut costs in predictable places: guard wages, training, equipment maintenance, and insurance. You don’t want to discover your provider is insolvent when their guards don’t show up because they haven’t been paid in three weeks.

SARS Tax Compliance

Request a current Tax Clearance Certificate from the South African Revenue Service. This confirms the company is up to date with PAYE, UIF, and VAT obligations, all indicators of financial health and operational legitimacy.

Why tax compliance matters:

• Guards are legally employed: Compliant companies register employees properly, pay statutory contributions, and issue payslips. Non-compliant companies often use “independent contractors” illegally or underpay staff.
• Insurance validity: Many insurers require SARS compliance as a condition of coverage. A company without tax clearance may have invalidated its own insurance without telling you.
• Operational stability: If a company can’t keep current with SARS, they likely have cash flow problems that will eventually affect service delivery.

Insurance Coverage

Security companies must carry multiple insurance policies to operate safely:

Public liability insurance: Covers damage caused by guards to third parties or property (minimum R5 million coverage is standard for commercial properties).

Professional indemnity: Covers negligence, errors, or omissions in service delivery (e.g., a guard fails to lock a gate, resulting in theft).

Employee injury/COIDA: Compensates guards injured on duty. Without this, your property becomes liable.

Armed response insurance (if applicable): If guards carry firearms, specific coverage for firearm-related incidents is mandatory.

Request certificates of insurance and verify them directly with the insurer. Don’t just accept a photocopy, call the underwriter and confirm the policy is active, the coverage amounts match what’s stated, and your property would be covered under the policy.

Red flag: Companies that delay or deflect insurance verification questions are either under-insured or uninsured. Both are unacceptable.

Operational Track Record

How long has the company operated in Johannesburg’s commercial sector? Longevity isn’t everything (new companies can be excellent), but it’s a useful data point.

Ask for:

• Client references: Minimum three current commercial clients in similar property types (office parks, retail centres, warehouses). Contact them directly—don’t rely on testimonial sheets.
• Tenant feedback: If the company already guards properties with active tenants, ask permission to speak with a few tenants. They’ll tell you what property managers won’t.
• Contract retention rate: What percentage of clients renew annually? High churn suggests service problems.

Questions to ask references:

• “How quickly do they respond to incidents?”
• “Have you ever had issues with guard no-shows or under-qualified replacements?”
• “Do their reports and documentation meet your standards?”
• “Would you renew with them again?”

Evasive or scripted answers suggest planted references. Genuine clients will give you specific, sometimes critical, feedback.

Step 3: Service Level Agreement (SLA) Essentials

A service level agreement is the operational contract beneath your legal contract. It defines exactly what “security services” means in measurable, enforceable terms.

Response Time Commitments

When an alarm activates, a tenant reports suspicious activity, or a guard calls for backup, how fast does help arrive?

SLAs should specify:

• Armed response arrival: If the company provides or coordinates with armed response, state maximum response times (e.g., “armed response on scene within 8 minutes of alarm activation during business hours”).
• Supervisor site visits: How often does a supervisor physically inspect the site and verify guard compliance? (Weekly minimum is standard; daily for high-risk properties.)
• Management escalation: When must incidents be escalated to property management? (Immediate for serious incidents; within 24 hours for minor issues.)

Red flag: Vague language like “prompt response” or “as soon as possible” is unenforceable. Demand specific timeframes.

Reporting and Documentation Standards

How will you know what’s happening on your property when you’re not there?

SLAs should mandate:

• Daily occurrence book entries: Guards must log shifts, patrols, vehicle entries, incidents, and maintenance observations daily.
• Incident reports: Detailed, written reports within 24 hours of any security incident, including photos where applicable.
• Monthly summary reports: Aggregated data on patrol compliance, incident types, access control patterns, and recommendations.
• Digital access: Can you view reports online, or are they paper-only? Modern providers offer cloud-based reporting with real-time incident notifications.

Red flag: If the company doesn’t proactively explain their reporting protocols, they likely don’t have robust systems in place. You’ll spend your time chasing information instead of receiving it automatically.

Guard Qualification and Training

What training do guards receive beyond basic PSIRA certification?

SLAs should specify:

• Site-specific induction: Every new guard assigned to your property receives a documented walkthrough covering patrol routes, emergency procedures, tenant protocols, and access control systems.
• Ongoing training: Annual refresher training on conflict de-escalation, first aid, fire safety, and updated PSIRA standards.
• Specialized skills (if needed): Training for specific systems (CCTV operation, access control software, biometric scanners).

Supervision and Quality Control

How does the company ensure guards are actually performing as specified?

SLAs should detail:

• Supervisor-to-guard ratio: One supervisor per 15-20 guards is reasonable for multi-site operations.
• Site visit frequency: Supervisors must visit your property weekly minimum, conduct patrols with guards, review occurrence books, and verify post order compliance.
• Performance audits: Quarterly audits measuring patrol compliance, reporting quality, appearance standards, and tenant interaction.

Red flag: If supervision isn’t part of the SLA, guards are essentially unsupervised. Performance will drift, shortcuts will become standard, and you’ll have no recourse.

Step 4: Understanding Johannesburg-Specific Security Challenges

Johannesburg isn’t homogenous. Security requirements for a Sandton CBD office tower differ dramatically from a Germiston warehouse or a Bryanston retail park. Your security company should demonstrate node-specific knowledge.

Office Parks and Business Complexes

Johannesburg’s northern and eastern suburbs are dense with multi-tenant office parks—Sandton, Rosebank, Bryanston, Midrand, Fourways, Bedfordview, Rivonia. Each has distinct characteristics.

Security priorities for office parks:

• Access control for multiple tenants: Managing varying hours, different access levels, and visitor procedures without creating bottlenecks.
• Parking lot security: Vehicle break-ins and smash-and-grabs are common in basement and open-air parking. Patrols must be frequent and visible.
• After-hours incidents: Most office parks are active 7am-6pm. Night security focuses on perimeter integrity, alarm response, and preventing copper theft or break-ins.
• Tenant confidence: Office workers notice security presence (or absence). Poor security affects tenant retention and lease renewals.

Ask potential providers: “How many office parks do you currently guard in [specific node]? What are the most common incidents you handle there?”

If they give generic answers about “theft prevention” without node-specific detail, they lack local expertise.

Retail Centres and Mixed-Use Developments

Retail security in Johannesburg deals with high foot traffic, delivery logistics, parking management, and public interaction. Rosebank’s The Zone, Fourways Mall, Nicolway Centre—these environments demand guards trained in customer service alongside security protocols.

Security priorities for retail:

• Shrinkage prevention: Guards monitor entrances, exit points, and delivery bays where stock loss occurs.
• Customer safety and conflict resolution: Guards must manage shoplifting incidents, tenant disputes, and disruptive behavior without escalating situations.
• Delivery and contractor access: Multiple deliveries daily require documented sign-in/sign-out, vehicle checks, and BOH (back-of-house) supervision.
• Event security: Retail centres host promotions, launches, and seasonal events requiring temporary security augmentation.

Your retail security provider should understand the difference between deterrence (customer-facing) and enforcement (incident response), and train guards accordingly.

Warehouses and Industrial Properties

Germiston, Jet Park, City Deep, Benrose, Heriotdale, Johannesburg’s industrial belt demands a different security approach than office or retail environments.

Security priorities for industrial properties:

• Perimeter control: Large properties with multiple access points require vehicle patrols, not just static gate guards.
• Stock protection: High-value inventory, copper, equipment, and materials are theft magnets. Guards need training in inventory checks and vehicle searches.
• Contractor management: Frequent third-party access (logistics, maintenance, suppliers) requires strict documentation and escort protocols.
• Load-shedding resilience: Warehouses operate 24/7. Security systems and guard operations must function during extended power outages.

Step 5: Contract Terms That Protect You (Not Just the Provider)

Security contracts are often written to protect the security company, not the client. Read carefully and negotiate terms that balance risk fairly.

Contract Duration and Termination Clauses

Standard contracts run 12-24 months with auto-renewal unless terminated with 30-60 days’ notice. This is reasonable, but watch for:

Early termination penalties: Some contracts impose hefty penalties if you cancel mid-term. Negotiate exceptions for non-performance, repeated SLA breaches, or PSIRA compliance failures.

Notice period fairness: If the company can terminate with 30 days’ notice, you should have the same right not 90 days.

Transition support: If you switch providers, the outgoing company must cooperate with handover (occurrence book transfer, site access, guard briefings). Make this contractual.

Liability and Indemnity Clauses

Who’s liable when things go wrong? Contracts often try to shift all liability to the client. Push back.

Fair liability split:

• Provider liability: Negligence, guard misconduct, failure to follow post orders, credential non-compliance, equipment failure.
• Client liability: Failure to provide access, withholding critical information, changes to site conditions not communicated.

Insurance requirements: The contract must specify minimum insurance coverage and require the provider to name your property as an additional insured party.

Force majeure limitations: “Act of God” clauses shouldn’t excuse persistent non-performance. Natural disasters are one thing; load-shedding isn’t force majeure, it’s predictable.

Pricing Structure and Escalation

How are costs structured, and when can they increase?

Transparent pricing:

• Base monthly rate: Clearly stated, including number of guards, hours covered, and services included.
• Additional services: Itemized rates for extra patrols, event security, armed response integration, CCTV monitoring.
• Excluded costs: What’s not included? (Uniforms? Equipment? Transport allowances? Make it explicit.)

Escalation clauses: Annual price increases are normal, but they should be capped and tied to objective indices (e.g., “increases capped at CPI + 2%”).

Avoid: Open-ended escalation clauses like “rates may be adjusted at provider’s discretion.”

Performance Penalties and SLA Enforcement

Your contract should include consequences for non-performance:

Penalty triggers:

• Repeated guard no-shows: If shifts are left uncovered more than X times per quarter, penalties apply.
• SLA breaches: Missed response times, late reports, or failed inspections result in service credits or fee reductions.
• PSIRA non-compliance: Deploying unregistered or under-qualified guards triggers immediate penalties and right to replace guards.

Escalation to termination: Persistent non-performance (defined as X breaches in Y months) allows termination without penalty.

Without these clauses, you have no leverage when service deteriorates.

Step 6: Red Flags That Should Stop Negotiations Immediately

Some warning signs are subtle. Others are glaring. Here’s what should make you walk away, no matter how attractive the price or pitch.

Credential Red Flags

• Reluctance to provide PSIRA registration numbers – Professional companies have nothing to hide and provide this information immediately.
• “We’re working on renewing our PSIRA registration” – If their registration has lapsed, they’re operating illegally right now. There’s no grey area.
• Guards who can’t produce valid PSIRA cards on day one – If they’re sent to your site without current credentials, reject them and demand compliant replacements.

Financial and Operational Red Flags

• Significantly lower pricing than competitors – Security is a cost-plus business with known wage floors (PSIRA rates, BCEA requirements). If someone’s 30% cheaper, they’re either cutting wages illegally, under-insuring, or planning to raise prices drastically after you’re locked in.
• Requests for upfront payment beyond first month – Standard practice is monthly billing in arrears or advance payment of one month. Requests for 3-6 months upfront signal cash flow problems.
• No references or only brand-new clients – Established companies have long-term clients happy to provide references. If they don’t, there’s a reason.

Contract and SLA Red Flags

• Vague service descriptions – “Comprehensive security solutions” without defining what that means operationally is a recipe for disputes.
• No documented SLA – If everything is in the contract but nothing is in an SLA, you have no enforceable performance standards.
• Refusal to negotiate terms – “This is our standard contract, take it or leave it” suggests the company prioritizes legal protection over client partnerships.

Behavioral Red Flags

• Pressure tactics – “This price is only valid if you sign today” or “other properties are interested, so decide now” are sales manipulation, not professional consultation.
• Evasive answers about insurance or SARS compliance – If they can’t produce documentation immediately, they don’t have it.
• Defensive responses to questions – Professional providers expect detailed questions and answer confidently. Defensiveness suggests they’re hiding something.

The Property Manager’s Final Checklist (Before You Sign)

Here’s your pre-signature verification list. Don’t skip steps.

Documentation verified:

• PSIRA business registration confirmed (checked online, not just certificate)
• Guard PSIRA numbers provided for all assigned personnel
• Tax Clearance Certificate (current, not expired)
• Insurance certificates (public liability, professional indemnity, COIDA, armed response if applicable)
• All certificates verified directly with issuers

References checked:

• Contacted minimum three current commercial clients
• Asked specific questions about performance, response times, and reporting
• References were genuine (not rehearsed or evasive)

SLA reviewed and agreed:

• Response times specified in minutes/hours, not vague terms
• Reporting protocols detailed (format, frequency, delivery method)
• Supervision structure defined (visits, audits, guard-to-supervisor ratio)
• Training requirements specified (initial, ongoing, specialized)

Contract terms negotiated:

• Termination clauses fair to both parties
• Liability appropriately split, not one-sided
• Pricing transparent with capped escalation
• Performance penalties and SLA enforcement included

Johannesburg-specific factors addressed:

• Provider demonstrates node-specific knowledge (your suburb/property type)
• Load-shedding contingency plans documented
• After-hours and incident response protocols suited to your property’s risk profile

Site visit completed:

• Provider conducted walkthrough, asked detailed questions about property layout, tenant needs, and risks
• You’ve seen example reports and documentation from other sites
• Post orders drafted collaboratively, not templated

Why This Level of Vetting Matters

You might be thinking this checklist is overkill for a security contract. It’s not. Here’s why.

Security is one of the few services where failure isn’t just inconvenient, it’s catastrophic. A botched cleaning contract means dirty carpets. A failed security contract means tenant losses, property damage, liability claims, and potentially violent incidents.

More practically: you’re signing a 12-24 month commitment worth R200,000-R500,000+ annually. Spending 10 hours vetting providers to protect that investment isn’t excessive, it’s prudent.

And here’s the uncomfortable truth: the security industry has a compliance problem. Not every company, but enough that PSIRA exists specifically to weed out operators who cut corners on wages, training, insurance, and registration. Your due diligence protects you from becoming that operator’s next victim.

The providers who welcome detailed vetting understand this. They’ve invested in compliance, training, systems, and documentation because they know professional property managers demand it. Those are the companies worth your business.

The ones who resist, deflect, or pressure you to skip steps? They’re counting on clients who don’t know better. Don’t be that client.

Finding the Right Partner for Your Property

Choosing a security company isn’t about finding the cheapest quote or the flashiest brochure. It’s about finding a provider who understands Johannesburg’s commercial property landscape, operates with full compliance and transparency, delivers documented results, and treats your property like it matters.

Professional companies will walk through this checklist with you gladly. They’ll provide PSIRA numbers upfront, insurance certificates without delay, client references you can actually verify, and SLAs that define performance clearly.

They’ll ask you detailed questions about your property, your tenants, your risk concerns, and your budget constraints. They’ll propose solutions tailored to your specific needs, not generic packages.

And when something goes wrong (because eventually something always does), they’ll have documented procedures for escalation, reporting, and resolution because they planned for contingencies, not just ideal scenarios.

That’s the standard your property deserves. This checklist helps you enforce it.

Need help vetting security proposals for your Johannesburg commercial property? Contact our team for a compliant, transparent assessment of your security needs, no pressure, just professional guidance from providers who understand what property managers actually require.

---

Key Facts: Commercial Security Vetting Essentials

• PSIRA verification is non-negotiable: Check business registration online before first meeting; verify all guard PSIRA numbers and grades match site requirements.
• Johannesburg’s security landscape varies dramatically: Sandton CBD office park requirements differ from Germiston warehouses or Rosebank retail centres—providers must demonstrate node-specific expertise.
• SLAs define enforceable performance standards: Without documented response times, reporting protocols, and supervision structures, contracts are unenforceable.
• Financial stability indicators: SARS Tax Clearance Certificate, active insurance policies, and 3+ commercial client references are minimum baseline checks.
• Typical office park security costs: R18,000-R35,000 per month for single 24/7 guard post in Gauteng Areas 1/2, depending on site size, access points, and service inclusions.
• Contract red flags: Below-market pricing (30%+ cheaper), vague service descriptions, refusal to provide PSIRA/insurance documentation, pressure tactics, no SLA.
• Load-shedding contingencies are mandatory: Backup power, manual gate operation procedures, increased patrols during outages, and communication redundancy must be documented.
• Performance penalties should be contractual: Guard no-shows, SLA breaches, and PSIRA non-compliance must trigger enforceable consequences, not just complaints.

FAQ (People Also Ask)

Q1: How do I verify a security company is registered with PSIRA?
Visit PSIRA’s Business Status Verification page and search by company name or registration number. Results show “Active,” “Suspended,” or “Deregistered” status. Only work with companies showing “Active” registration. Request the company’s PSIRA registration number upfront and verify it yourself don’t rely solely on certificates shown during meetings, as these can be outdated or faked. Verify individual guard credentials the same way using their PSIRA registration numbers.

Q2: What should a commercial security SLA include?
SLAs must specify: (1) response times for incidents (e.g., “supervisor on-site within 30 minutes of incident notification”), (2) reporting requirements (daily logs, incident reports within 24 hours, monthly summaries), (3) supervision structure (weekly site visits, quarterly audits), (4) guard training standards (site induction, ongoing refresher training), (5) escalation protocols (when and how incidents are reported to property management), and (6) performance metrics with enforcement mechanisms. Vague terms like “prompt response” are unenforceable.

Q3: How much should commercial security cost in Johannesburg?
A single 24/7 guard post in Gauteng’s Area 1/2 (Johannesburg, Pretoria, Midrand, Sandton) typically costs R18,000-R35,000 per month, depending on guard grade, site complexity, and service inclusions. Office parks with multiple access points, retail centres with high foot traffic, and warehouses requiring vehicle patrols cost more. Significantly lower pricing (30%+ below market) signals potential illegal wage practices, under-insurance, or planned price increases after contract lock-in. Always request itemized cost breakdowns.

Q4: What are red flags when choosing a security company?
Major red flags include: reluctance to provide PSIRA registration numbers or insurance certificates, pricing significantly below market rates, requests for 3-6 months upfront payment, no verifiable client references, vague contract terms without documented SLAs, pressure tactics (“sign today or lose this price”), defensive responses to compliance questions, and inability to demonstrate node-specific knowledge of your property type and location. Professional providers welcome detailed vetting and provide documentation immediately.

Q5: Do I need different security for office parks vs retail centres?
Yes. Office park security focuses on access control for multiple tenants, parking lot protection, and after-hours perimeter integrity. Retail security requires customer-facing guards trained in conflict resolution, shrinkage prevention, delivery management, and public interaction. Warehouse security emphasizes perimeter control, vehicle searches, and stock protection. Companies claiming “one-size-fits-all” security lack specialized expertise. Choose providers demonstrating understanding of your specific property type and Johannesburg node.

Q6: What insurance must security companies carry?
Minimum required: (1) public liability insurance (R5 million+ coverage for commercial properties), (2) professional indemnity (covers negligence and service failures), (3) COIDA/employee injury coverage (guards injured on duty), and (4) armed response insurance if guards carry firearms. Request current certificates and verify directly with insurers—don’t accept photocopies alone. Under-insured or uninsured companies shift liability to your property when incidents occur, creating massive exposure for property owners and managers.

Q7: How do load-shedding contingencies affect security?
Every Johannesburg security contract must address load-shedding: backup power for guardhouse, access control, and communication systems (4-hour minimum capacity); manual gate operation procedures when power fails; increased patrol frequency during outages (crime spikes when lighting and alarms are down); and communication redundancy (charged two-way radios, mobile devices). Companies without documented load-shedding protocols will leave your property vulnerable during extended outages. Ask: “What happened on your sites during Stage 6? How did guards adapt?”

Q8: Can I terminate a security contract for poor performance?
Depends on contract terms. Standard contracts allow termination with 30-90 days’ notice but may impose early termination penalties. Negotiate provisions allowing penalty-free termination for persistent non-performance: repeated SLA breaches (define as X incidents in Y months), PSIRA non-compliance, uninsured operations, or guard no-shows exceeding agreed thresholds. Without enforceable performance standards and termination rights, you’re locked into 12-24 months regardless of service quality. Make SLA breaches a contractual ground for penalty-free exit.

TL;DR (80 words)

Choose Johannesburg commercial security companies by verifying PSIRA registration online first, checking SARS tax compliance and insurance certificates directly with issuers, contacting 3+ current commercial clients for references, demanding SLAs with specific response times and reporting protocols, and ensuring providers demonstrate node-specific knowledge of your property type and suburb. Red flags: below-market pricing, reluctance to provide documentation, vague contracts, pressure tactics. Proper vetting takes 8-10 hours but protects 12-24 month commitments worth R200,000-R500,000+. Professional providers welcome detailed scrutiny.