The delivery risk playbook for residential and student campuses: a guide for new building and facility managers
A practical playbook for building managers and FM providers taking on a residential or student campus: how to reduce security, safety and operational risk from food, grocery and subscription deliveries — while cutting staff involvement to near zero.
If you've just taken on the management of a residential building, a student campus or a mixed-use scheme, deliveries are likely already the single most chaotic operational stream you've inherited. Food bags on the concierge desk. Couriers buzzing through the intercom at 11pm. Grocery crates blocking the lift. Meal-kit boxes stacked outside the wrong flat. The previous operator may have shrugged and called it 'normal'. It isn't, and it's quietly the highest-risk daily activity in the building.
This is a practical playbook — written for new building managers and FM providers — covering how to reduce the safety, security and operational risk from food, grocery and subscription deliveries while cutting staff involvement to near zero. It's deliberately framework-agnostic: the principles apply whether you're running a single PBSA block, a multi-core BTR campus, a co-living scheme or a mixed-use estate.
Step 1 — Audit what's actually arriving (and through which door)
Most operators wildly underestimate their building's daily delivery volume because they only see what reaches the concierge desk. The real number is usually 3–5× higher. Spend a week observing every entrance — including service yards, fire exits and underground car-park doors — and log what comes through.
- Food and takeaway: Deliveroo, Uber Eats, Just Eat, direct-from-restaurant
- Quick-commerce groceries: Tesco Whoosh, Sainsbury's Chop Chop, Deliveroo Hop, Joybuy, Amazon Fresh
- Scheduled grocery: Ocado, Tesco, Morrisons, Sainsbury's full-shop slots
- Meal-kit subscriptions: Gousto, HelloFresh, Mindful Chef, Thrive, Pasta Evangelists, Allplants
- Parcels: Amazon, DPD, Royal Mail, Evri, FedEx, UPS
- Returns: customer drop-offs leaving the building
You're not just counting volume — you're mapping which couriers use which doors, which floors get the most traffic, what time the peaks land, and which deliveries currently have no defined process at all. That map is the foundation for every decision that follows.
Step 2 — Run a delivery risk assessment, not a generic security one
Deliveries are now their own risk category. The standard building security risk assessment — visitor management, CCTV, access control — was designed for a world where the only unfamiliar people in a lobby were guests of a named resident. That world is gone. Treat deliveries as a distinct risk stream with its own assessment.
- Identity risk: couriers are unvetted by the building and rotate constantly — there's no 'familiar face' control to lean on
- Access risk: every admitted courier creates an opportunity for tailgating, fire-door propping and corridor access
- Lone-resident risk: late-night collections, especially by single residents, create a safeguarding exposure most operators never measure
- Building Safety Act risk: in higher-risk buildings, uncontrolled courier access is now an Accountable Person issue
- Front-of-house risk: concierge teams handling, storing and disputing deliveries are absorbing a workload that wasn't in the original scope of the role
- Reputational risk: stolen bags, missing parcels and refund disputes consistently top resident complaint categories
For the deeper safety case, see Smart food lockers and the Building Safety Act 2022 and An accident waiting to happen: unvetted couriers in residential buildings.
Step 3 — Define a single delivery handover model — and enforce it
The number-one operational error new managers inherit is having no defined model. Every courier improvises, every concierge improvises, every resident improvises. That's the chaos. Pick one model and apply it to every delivery type that lands at the building.
There are essentially four options. In order of operational maturity:
- Door-to-door: courier admitted, takes the lift, knocks. Highest risk, highest staff involvement, lowest scalability. Only justifiable for accessible-needs residents.
- Concierge handover: courier hands to staff, staff stores and notifies. Eliminates corridor access but maxes out staff time and creates a dispute queue.
- Reception drop-and-go: courier leaves on a counter, residents collect. Cheap but creates theft, mix-ups and refund disputes — usually fails within months.
- Locker handover: courier drops into a temperature-controlled, individually-credentialed compartment. Resident collects with a one-time PIN. Zero staff involvement, full audit trail, no corridor access.
For any building with more than ~50 deliveries a week — which is almost all residential and PBSA — the locker model is the only one that scales without absorbing more staff cost every quarter.
Step 4 — Cover the four delivery types separately
'Food delivery' is not one problem — it's four, and each has slightly different requirements. A serious playbook covers all of them explicitly.
- Hot takeaway (Deliveroo, Uber Eats, Just Eat) — needs heated compartments, fast handover, integration with platform standing instructions
- Quick-commerce groceries (Whoosh, Chop Chop, Hop, Joybuy, Amazon Fresh) — needs chilled compartments, multiple drops per resident per week, courier-agnostic flow
- Meal-kit subscriptions (Gousto, HelloFresh, Mindful Chef, Thrive) — scheduled, chilled, predictable; ideal locker fit; lowest-friction deployment
- Parcels and returns (Amazon, DPD, Evri, Royal Mail) — ambient, large-format compartments, return-out flow as well as drop-in
Buying a 'food locker' that only handles hot takeaway leaves three of the four streams unsolved. Spec the system against all four from day one.
See the dedicated Grocery & Meal Kits solution for the chilled-and-ambient stack.
Step 5 — Set the platform-side controls
A surprising amount of building risk is fixable inside the courier platforms' business profiles, before any hardware is installed. As the building manager you can — and should — register standing courier instructions with Deliveroo, Uber Eats, Just Eat, Tesco Whoosh, Sainsbury's, Hop and Joybuy that say exactly what couriers should do on arrival. Most buildings have never done this.
- Designated drop point: a precise lat/long and what3words address per locker bank — not 'the postcode'
- Photo of the entrance and walking route, pushed into the courier app
- Access notes: gate codes, intercom protocol, out-of-hours instructions
- Per-core routing for multi-entrance schemes — flat number maps to the correct locker bank automatically
- Explicit 'do not enter the building — drop at the locker' instructions where the policy applies
See Designated Drop Zone for the full wayfinding stack.
Step 6 — Engineer staff out of the routine, in for the exceptions
The goal of a mature delivery operation is not 'more staff to handle deliveries' — it's 'no staff involvement in normal deliveries, and clear escalation paths for the exceptions'. A locker-based handover hits this target by default. The exceptions worth keeping a human in the loop for are:
- Forgotten collections beyond a configurable dwell time — auto-reminders first, then a concierge nudge
- Wrong-bank or wrong-resident drops — flagged in the system, not discovered at the front desk
- Couriers attempting to bypass the locker (entering the building, propping doors) — logged for safeguarding follow-up
- Resident accessibility needs — explicit door-delivery exception list, not a default behaviour
- Incident response — clear escalation path for theft, tampering or safeguarding concerns
Set service-level expectations against each exception type so the FM team has a measurable target — not a vague 'do your best'.
Step 7 — Make it a written policy, not a verbal habit
The single highest-leverage document a new building manager can produce in their first 90 days is a one-page Delivery Policy that names: the handover model, the exceptions, the platform standing instructions, the staff escalation path, and the resident communication. Publish it to residents, paste it into the welcome pack, and keep it visible in the front-of-house manual.
Without that document, every shift improvises. With it, the building behaves like one operation regardless of who's on duty.
Step 8 — Measure, report, iterate
If you can't measure it, it'll regress. The minimum monthly delivery KPIs every residential or campus operation should report are:
- Total deliveries received, split by type (food, quick-commerce, meal kits, parcels)
- Locker dwell time — average and 95th percentile
- Forgotten-collection rate and resolution time
- Front-of-house dispute count related to deliveries
- Courier policy breaches (door entries, propped doors, tailgating)
- Resident NPS or pulse score for the delivery experience
Report these to the building owner, not just the FM team. Delivery operations are now a material component of the resident experience and the asset's risk profile — they belong in the asset-level reporting pack.
Step 9 — Communicate the change to residents up front
New building managers consistently underestimate how much resident push-back comes from being surprised, not from the change itself. A short note in the welcome pack and the next residents' newsletter explaining 'why our building handles deliveries this way' converts almost all of the initial friction. Anchor it in the four community benefits: faster collection, no strangers in corridors, hot food at temperature, fewer missing orders.
For the resident-facing version of the same argument, see Door or lobby? The food delivery debate.
Step 10 — The 90-day rollout
A practical sequence for a new building manager or FM provider taking on a residential or campus scheme:
- Days 0–14: audit all delivery streams and entrances; observe a full week of traffic
- Days 15–30: produce the Delivery Policy and risk assessment; brief the front-of-house team
- Days 31–60: register designated drop zones with every major platform; install or commission the locker bank if not already present
- Days 61–75: communicate to residents; run a 7-day pilot with concierge support; gather feedback
- Days 76–90: cut over fully; baseline the KPIs; lock in the monthly reporting cadence
Done well, by day 90 deliveries should be a near-zero-touch operation for staff, a measurable security and safety improvement for residents, and a story the asset manager can tell to investors and insurers.
What good looks like in 2026
A residential or student campus operating at the modern standard handles deliveries with: a temperature-controlled locker bank in every entrance core, every locker geocoded and registered with the major platforms, courier-agnostic drop flows for hot food, chilled groceries, meal kits and parcels, an audit trail of every drop and pickup, and a Delivery Policy that staff and residents can both quote chapter and verse from. Anything less and the building is carrying risk that no longer has to exist.