Alarm System Testing: The 90-Day Rhythm

The alarm that was armed, monitored, and quietly broken.

Earlier articles in this library described a church whose motion alarm tripped on a Tuesday night and whose monitoring call chain failed because the contact on file had retired two years earlier. That kind of silent failure is precisely what alarm system testing is designed to catch.

A fully-armed alarm system on an unmonitored watch is not actually an alarm system. It is a decoration. The difference between the two is documented, tested capability. Quarterly testing is the discipline that verifies the capability is real, not just assumed.

What a full alarm test covers.

A proper quarterly test exercises every link in the alarm chain.

1. Sensor testing

Each sensor in the system is tested individually. Motion sensors by walking through their coverage area. Door contacts by opening each door. Glass break sensors by the appropriate trigger (most systems have a test function for glass break).

The test verifies the sensor is operational and communicating with the panel. Sensors that fail to report should be flagged for immediate service.

2. Panel testing

The alarm panel itself should be verified. Does it register sensor triggers correctly? Does it produce the expected output (local siren, panel display, communication to monitoring)? Are all zones reporting as expected?

Panels sometimes accumulate configuration drift over time. Testing surfaces the drift.

3. Communication path testing

The panel communicates with the monitoring service through one or more paths: cellular, IP (internet), landline. Each communication path should be tested.

• Does the primary path function? Confirm with the monitoring service.
• Do backup paths function? This requires actively disabling the primary and testing the backup.
• How long does communication take? The latency should be consistent with service specifications.

4. Monitoring service testing

The monitoring service receives the signal and initiates the call chain. Testing verifies:

• The signal is received at the monitoring center
• The call chain begins per the contracted protocol
• The correct numbers are called in the correct sequence
• The required verification is performed before any dispatch
• Response times are consistent with contract

5. Call chain testing

The people on the call list should be contacted per the protocol during the test (with advance notice to them). The test verifies that:

• Phone numbers are current
• Contacts are reachable at the times specified
• The escalation proceeds correctly if earlier contacts are not reached

This is where many systems fail. The contact list has drifted from current. The numbers go to voicemail. The escalation ends without ever reaching a live person. Only testing surfaces this.

6. Restoration verification

After testing, confirm the system is restored to normal armed state. Sensors re-engaged. Panel armed. Communication paths active. Monitoring service acknowledging normal status.

This step is occasionally missed. A system left in test mode is essentially unarmed until the state is corrected.

The 90-day rhythm in practice.

For most small and mid-size organizations, the 90-day test rhythm works like this.

Month 0: Initial scheduling

Book the test with the monitoring service at least a week in advance. Confirm the date, time, and scope. Identify the staff member who will conduct the on-site portion.

Month 0, test day

Conduct the test. Document results in writing. Note any anomalies, slow response, or failures. Confirm restoration.

Month 0, post-test

Submit documentation to a central file. Note any follow-up actions required. Schedule any needed service visits.

Month 1-2: Monitor status

Between tests, monitor any alarm events that occur in normal operation. Note response patterns. Look for drift from expected behavior.

Month 3: Next scheduled test

Repeat the cycle. Compare results to prior tests. Identify any emerging patterns.

What the documentation captures.

Each test should produce a written record that includes:

• Date and time of test
• Personnel present
• Monitoring service contact for the test
• Each sensor tested and result
• Communication path(s) tested and result
• Monitoring service response time
• Call chain results (who was reached, in what order, how long it took)
• Any anomalies or failures
• Actions required as follow-up
• Confirmation of system restoration

The documentation accumulates over quarters and years into a record of system performance. Patterns become visible that single tests cannot reveal.

Common test failures.

Having facilitated alarm testing for many clients, we see recurring failure patterns.

Outdated contact list

The monitoring service has phone numbers from three years ago. Staff changes have not been reported. The call chain ends without reaching a current staff member.

Slow monitoring response

The monitoring service receives the signal but takes longer than contracted to begin the call chain. The cumulative effect across multiple alarms is a response that is measurably slower than what the organization is paying for.

Failed communication path

The primary communication path is not actually working, but the backup has been functioning so long that nobody has noticed the primary failure. When the backup also fails (which does happen), the system is silent.

Sensor drift

A sensor that was installed correctly has drifted into an alignment that no longer triggers reliably. Sometimes from physical impact. Sometimes from thermal expansion over years. The sensor appears active but no longer triggers.

Dispatch delay

The monitoring service’s dispatch policy has changed without client notification. Where dispatch used to occur after two unsuccessful verification attempts, it now occurs after three. Response time is longer than assumed.

The verse describes the posture of seeing and acting on risk. Alarm system testing is the operational version of that posture. The system is the eyes that see. The test is the verification that the eyes are actually open.

Integration with fDoS.

For organizations on fDoS engagements, quarterly alarm testing is scheduled and tracked as part of the ongoing program. The advisor coordinates with the monitoring service, facilitates the test, and documents results. Issues surfaced during testing feed into the broader audit and improvement cycle.

For organizations without fDoS, internal staff can facilitate testing, provided the process is documented and the ownership is clear. Partnering with the installing vendor or an independent security advisor for periodic external review is worthwhile.

The Southwest Florida context.

Our region introduces specific testing considerations.

Hurricane readiness

Before hurricane season each year, a specific pre-season test should verify that communication paths work during the conditions of a major storm. Cellular backup with battery power sufficient for multi-day outages is specifically tested.

Seasonal occupancy

For facilities with seasonal staff or programs, testing should occur at moments that match actual operational reality. A test during empty-facility periods may produce different results than a test during peak-occupancy periods.

Lightning damage

Lightning in Southwest Florida regularly damages alarm equipment. Any lightning event nearby should trigger a targeted verification of alarm function, not wait for the next quarterly test.

Power outages

Florida sees power outages more frequently than many regions, from storms, thunderstorms, and grid events. Backup power (battery, generator) for alarm systems should be tested for adequate duration. 24-hour battery backup that used to be sufficient may not be, given extended outages after significant storms.

The contract review alongside testing.

Quarterly testing should be paired with annual contract review. The contract specifies what the monitoring service should be doing. Testing verifies what they are actually doing. Annual contract review ensures the contract still matches current needs.

The combination is stronger than either alone.

Starting a testing program.

For organizations that have never conducted formal alarm testing:

• Call your monitoring service and request a full system test
• Request a current copy of your service agreement and contact list
• Identify the staff member who will own the testing rhythm
• Schedule the first test with adequate lead time
• Conduct the test with documentation
• Schedule the next test before closing out the current one

The first test will almost certainly surface findings. That is the point. After the initial testing cycle, subsequent tests catch drift as it occurs and keep the system healthy.

If your organization in Fort Myers, Cape Coral, Naples, or Port Charlotte wants support establishing an alarm testing program or evaluating current monitoring relationships, we would be glad to have the conversation.