where to start...
Perhaps reach out to the kid, let him know he still has a job or that they will be covering any medical bills / lost time from work due to the incident... say that this is alleged behavior is unacceptable... maybe not take 2 weeks and a national newspaper story to take action and perhaps not ignore things and try and sweep them under the rug... give the kid tickets to an upcoming match (if they ever have one)... don't hire racist thugs to work in security, or perhaps tell companies that they subcontract to that they shouldn't hire racist thugs to beat up employee of other companies they subcontract to... have a better verification system so that they can tell who has legitimate reason to use an employee entrance on match day wearing a uniform of the company that does work in the ground.
That would be a little more than the bare minimum.