A response-time promise is easy to compare until two providers start their clocks at different points. Before choosing the smaller number, find the event, timestamp and action behind it.
The idea in view · Planning diagram
Which interval does the promise measure?
- Event occurs
- System receives
- Review starts
- Decision recorded
- Contact attempted
- Ownership acknowledged
Make the call
Which delay does the commitment cover?
| Situation | Decision to make | What to ask for |
|---|---|---|
| The clock starts when the camera detects activity | Whether delivery delay is included | Detection and provider-receipt timestamps |
| The clock stops when a call is placed | Whether anyone must acknowledge | Separate attempt and acknowledgement times |
| The report shows an average | How slow exceptions remain visible | Eligible-event definition and exception list |
Ask what the clock measures
An alert may wait for a clip, enter a queue, reach a reviewer and then lead to a call. Request timestamps for the stages the provider controls. A target from queue receipt to first review cannot be compared directly with a target from camera detection to an answered call.
Define the denominator
Ask whether the commitment covers every eligible event, a percentile or an average. Require the reporting period, excluded outages and treatment of duplicate alerts. An average can conceal a small group of long delays; request an exception list as well.
Write the recovery process
Set a named owner for missed commitments, evidence access and corrective actions. Document maintenance notice and fault reporting separately. Do not assume a monitoring target binds a police service or an independent responder.
Read a sample event record before the SLA
Ask the provider to walk through an anonymized sample or a clearly labeled test record. Follow its timestamps from event receipt through review and contact. If the report has only an opened time and a closed time, ask how the proposed commitment will be calculated. The contract and the reporting system should be able to describe the same event.
Agree how missing data will be handled. An event without a usable timestamp should appear as an unresolved measurement exception, not quietly disappear from the denominator. Also separate scheduled maintenance from unexpected loss of service. The question is whether your team can reconstruct a breach and agree a correction; a dashboard percentage without that trail is hard to challenge.
Which response time are you comparing?
An SLA becomes meaningful when it identifies the measured event and the clock used to measure it. An incident can have a camera timestamp, an event-generation timestamp, a platform receipt time, a review start, a decision, a call attempt and an acknowledgement. Different intervals answer different questions. Comparing a receipt-to-review target with an event-to-contact target can make two unlike services appear directly comparable.
Write the start and finish in ordinary language alongside the metric name. Ask which system supplies each timestamp and how missing or disputed timestamps are handled. The agreement should identify whether figures describe a target, a contractual commitment or an observed report. A percentile, an average and a maximum are different measures. Do not convert one into another or interpret an advertised number as the likely duration of every incident at your site.
Separate service dependencies from silent exclusions
Some work depends on equipment and people outside the monitoring provider's control. A failed connection can prevent an event from reaching the reviewing system. A site contact may not answer. A local responder may have its own acceptance and attendance conditions. These dependencies should be stated before the target is assessed, together with the provider's duty to recognize and communicate the resulting gap.
A long exclusion list without an outage procedure leaves the buyer with a promise that can disappear at the exact moment it matters. Ask how a missing feed is recorded, who is notified and whether the incident remains open while a dependency is unavailable. The SLA cannot make an external dependency reliable, but it can make responsibility and reporting clear. Distinguish an agreed suspension of a duty from an unexplained absence of service.

What should the monthly SLA report contain?
A useful report shows the population behind each figure. Ask for the count of eligible events, excluded events, events with missing timestamps and events outside the target, with reasons recorded consistently. Include the reporting time zone and the period covered. If only a small number of events occurred, avoid drawing a broad conclusion from a single percentage. Read individual exceptions as well as the aggregate.
The review should produce an action, an owner and a checkable completion condition where a problem is found. A report stating that a camera was unreliable does not show whether the camera was repaired or the service resumed. Link the service exception to the technical work order or site decision without copying passwords, personal contact numbers or footage into an unrestricted spreadsheet. Decide how disputed classifications are reviewed and who can amend the final record.
Work through one timeline before comparing the promise
Use an explicitly fictional timeline to check definitions. Suppose an event occurs at 22:00, the receiving system records it at 22:02, review begins at 22:03 and the first call is attempted at 22:05. Receipt-to-review is one minute, occurrence-to-call is five minutes and receipt-to-call is three minutes, provided the time sources are genuinely aligned. None of these values establishes acknowledged ownership or attendance.
The example contains no performance claim. It demonstrates why a shared number can describe different duties. If the camera clock is uncertain, the occurrence-based interval should remain unmeasured until its relationship is supported. If the recipient never acknowledges the call, the report should not invent an end time for accepted response. Missing evidence is part of the result, not an invitation to choose the most favorable interval.
Ask the provider to map its own target and report onto this sequence using the same terminology. Preserve the stated clock starts, stops, exclusions and denominator. Once definitions agree, the business can decide which intervals matter and which records are practical to obtain. That is a stronger basis for service review than comparing a pair of headline response-time claims without their measurement rules.
A fictional comparison: two attractive five-minute promises
Consider two hypothetical proposals using the same five-minute phrase. The first starts its clock only when an event arrives in its platform and ends at the first call attempt. The second describes the time from an observed event to a human decision, but excludes communication to the site. Neither statement tells you when a person takes ownership of the response. The figures cannot be compared as if they measure attendance or resolution.
In the comparison sheet, preserve each original definition. Ask both providers to map the same staged incident onto their timeline and identify the records available at each point. If an interval is not measured, mark it unmeasured. If a responsibility is not included, mark it outside scope. The purpose is to expose differences before agreeing a service, not to produce an artificially precise league table from incompatible metrics.
Before you move on
- List each timed stage with start and stop evidence.
- Ask for the reporting rule and exclusions in writing.
- Agree the review, remedy and escalation process for a missed target.
A worksheet you can actually use
Start with the blank sheet. Add one row per item, assign an owner and mark anything unresolved as pending. The completed example shows the level of detail to aim for.
Keep completed security plans private. Use aliases; keep passwords, access codes, personal contacts and footage links in your approved systems.
How to fill the worksheet
- Stage
- Keep detection, receipt, review, notification and acknowledgement separate where they represent different work or timestamp sources.
- Clock start
- State the exact recorded event that starts measurement, including which system supplies the value and any uncertainty.
- Clock stop
- State the completion event for this metric. A first call attempt should not be described as acknowledged response.
- Included events
- Define the eligible population so the report's denominator can be reconstructed rather than inferred from a headline percentage.
- Report rule
- Record the reporting period, measurement type and treatment of missing values or approved exclusions in understandable terms.
- Exception owner
- Name the role that reviews disputed or excluded cases and assigns corrective work when the agreed target is missed.
A worked example
Fictional SLA review: a vendor offers “rapid response”. The buyer requests an explicit queue-receipt timestamp, first-review timestamp and separate contact log before accepting the promise.
| Stage | Clock start | Clock stop | Included events | Report rule | Exception owner |
|---|---|---|---|---|---|
| Human review | Provider queue receipt | Reviewer opens event | Qualifying gate alerts | Contract-defined | Service manager |
Questions readers bring to this task
What else should you know?
What should happen after a missed commitment?
Use the agreed review and remedy process. Request the event references, cause, responsible owner and retest evidence for the correction. Repeated problems may require a scope or staffing discussion. The appropriate contractual remedy depends on the signed terms; this guide does not prescribe credits or penalties.
Link to this answer ↗Does a monitoring SLA guarantee police attendance?
A monitoring provider's review or notification target does not establish an emergency service's attendance or timing. Any police contact must follow the agreed procedure and applicable local arrangements. Ask exactly what the provider is authorized to do and which parts of the response remain outside its control.
Link to this answer ↗Should an SLA use an average or a percentile?
Choose a measure that answers the operating question and can be produced from reliable records. An average can hide a small set of long delays; a percentile still needs a denominator and clear exclusions. Request the underlying exception review rather than relying on one headline number.
Link to this answer ↗What if the provider does not measure an important interval?
Record that limit explicitly and decide whether another system or party can supply the missing evidence. You may agree a narrower measurable duty, a pilot to test the reporting path or a different operating arrangement. Do not fill an evidence gap with an assumed response time.
Link to this answer ↗Notes & sources
No universal target is proposed here. Numerical commitments require a provider agreement and local response arrangements.
Reviewed October 27, 2026. The examples and worksheets are planning aids, not customer results or a statement of contracted service.
- MonitorCrew: service scope and pricing factors
Provider description of staffing, hours, handovers and scope. No comparative testing is claimed.
