An audit into the territory government's "physical security" assets, which are designed to protect against potential security threats ranging from irate customers to terrorism threats was released on Thursday.

The audit found that while the government's overarching protective security framework was being "effectively implemented", some directorates have not completed "site-specific risk assessments" of their properties.

It showed both the education directorate and Access Canberra needed to complete such assessments of some of their properties, though none of the sites, or whether they are customer service offices or schools, are detailed in the report, "for security reasons".

The ACT Auditor-General's examination also found some sites controlled by ACT Health had not been assessed for up to five years, but since the audit had begun, the directorate had now begun a rolling assessment of all its properties.

It focussed on physical security measures, policies and implementation of the government-wide poilcy framework since it began to be developed in 2014 at ACT Health, Education, Access Canberra, Venues Canberra, and the Cultural Facilities Corporation.

The audit showed that while the overall implementation of the was sound, there was no evidence to show what communications and other activities had occurred as part of the implementation plans had occurred in the final three of the four-stage plan, particularly briefing sessions to staff about the later phases.

It also found there was no evidence that the Cultural Facilities Corporation was consulted in the development of the plan, or that the corporation, which oversees Canberra Museum and Gallery and Canberra Theatre, was included in presentations or training about the security policy.

While the corporation was not included in the broader framework and its development, staff told the audit office the corporation had updated its own internal documents to reflect the new policy.

"The lack of clarity in the ACT Government Protective Security Policy Framework regarding agency applicability and a failure to contact all ACT Government agencies presents a risk of an operational area not being aware of their responsibilities for developing adequate protective security measures," the audit reads.

"Confirmation is needed that all directorates and agencies are now aware."

The audit also found while physical security risks in the education directorate were known and managed at the directorate and school level, supporting documents were "not robust in some instances" and the current approach was not coordinated, though a new plan was a chance to "strengthen" such plans.

The audit recommended a whole-of-government risk assessment be implemented and overseen by Cabinet's security and emergency be told of "the highest risk areas overall and these are managed accordingly, rather than being determined on a directorate and agency basis" and the assessment be reviewed and updated at regular intervals.

It also found there was no specific territory government area with a role to "support
directorates and agencies by providing operational protective security advice and training", though Shared Services had sometimes performed such a role.

The audit office also recommended the justice directorate coordinate an assessment of all physical security operational needs across government and present the findings and recommendations to the security and emergency management senior officials group, among other changes.