Jim Batty, Head of Risk Audit at Group 4 Securicor, writes on threat assessment.
Fuelled by high profile government warnings, media hype and evidence of worldwide terrorist attacks a ‘climate of fear’ is now evident in many UK businesses. However, while terrorism is a high profile risk facing the UK businesses, there are other threats that are more likely to have an impact on their ability to conduct operations. These risks include; disaster risks, IT and intellectual property based crime, damage to property, reputation and liability risk. It is of paramount importance that companies recognise the real risks they face, rather than reacting to a general and indeterminate threat.
Organisations that are most at risk from terrorist attacks are iconic national ‘flagship’ companies, particularly if they are located in major cities, or centres of government, like London or Washington. Attacking these entities would guarantee any terrorist organisation massive publicity and could also have a profound impact on the critical infrastructure and credibility of the organisations and governments affected.
Large corporations are increasingly associated with the national identity and economic position of the owners, or country of origin. These organisations are inevitably attractive as potential targets to terrorist organisations such as Al Qaeda, which recognise the media capital to be gained from a high profile attack. The majority of these flagship companies are aware of this increased risk and where possible have attempted to mitigate these threats.
Most organisations should recognise, however, that they are not exposed to the same level of risk from terrorism as these flagship organisations. Companies should not allow a general sense of terrorist threat to detract from security planning for other risks such as theft, which arguably can have a significant business impact and equally result in business failure. For example, a medium sized packaging company operating from a rural location is far more likely to suffer from theft, or disruption to the flow of the business as a result of fire, than it is of becoming a terrorist target.
The first step for any organisation is to identify the specific risks it faces. Ideally this recognition needs to be at board level, where an organisation has the scope and resources to ensure the implementation of appropriate security solutions. A flow of relevant information is critical to this process; ensuring a process of formal risk assessment and management, contingency planning, resource allocation and the design of appropriate security protocols and procedures.
To effectively assess security risk organisations can utilise independent risk consultants, in partnership with a business’ senior managers. This should result in the development of an objective and holistic business security risk profile, which will assist in creating an effective security function and mitigate risk. What is certain is that you get what you pay for in terms of overall security spend; if reducing security cost is the main driver and adequate resources are not allocated to mitigate risk, then a major security failure is only a matter of when…not if.
It is important that organisations consider ‘why us?’ when considering the potential risk from terrorist attacks, as random attacks in the UK are rare. This requires intelligence based risk management, which enables an organisation to determine if it faces specific threats, or whether the threats are more generic.
Corporate entities will never be able to completely remove the risk of terrorist strikes, but they can undoubtedly limit the impact of any attack and implement appropriate contingency plans. It is important that staff at all levels of an organisation recognise the importance of an effective security strategy and do all they can to support its implementation. The actions of employees can undermine the most expensive security solution. For example, it is no use implementing an expensive entry system utilising personalised door tags to monitor entry to a facility, if staff members wedge doors open with fire extinguishers.
The focus on terrorism should not detract from other threats to a business’ operation. In the UK many businesses are more exposed to a significant threat from animal rights activists. This trend is particularly evident in the pharmaceutical and cosmetic industries, where activists increasingly target the firms that supply or provide support services to an organisation they have targeted. By targeting a business’ supply chain activists hope to limit the ability of a company to operate. A spokesman from the Association of the British Pharmaceutical Industry recently stated in relation to this activist threat that, "the situation was a lot worse in the UK than elsewhere, with between £30m and £70m being spent on keeping staff and property safe each year". This cost inevitably impacts a business’ bottom line and illustrates the need for a proactive and focused risk assessment process to determine a company’s "risk profile."
The terrorism issue has focused businesses’ attention and diverted resources to reducing the threat. While some commentators argue that the terrorist threat for many businesses has been exaggerated, this is not necessarily a bad thing. Any organisation that invests in a high level, flexible security strategy to reduce terrorism will no doubt reap associated benefits to the wider security function. These include increased security awareness amongst staff, access control procedures, electronic and physical security measures and other security policies. Overall, these mechanisms may well offer a more robust security regime, which in turn will reduce the other associated risks facing a business.
