It would seem axiomatic that if threats and hazards remain unidentified, vulnerabilities unacknowledged, incidents unrecorded and risk unqualified, that security must fail. In reality, however, it often succeeds, albeit more by good fortune than sound, strategic planning. It succeeds at one specific level, in that the most common threats can be guarded by the most common defences, in other words, those defences provided by physical security assets. There is, therefore, an illusion created, both objectively and subjectively that security is visible, (CCTV cameras and access controls) working, and is effective; objective in the sense that a seeming strong physical feature is a defence against all vulnerabilities and subjective in the sense that the resultant complacency becomes a by-product of the \u2018visual.\u2019<\/span><\/p>\n The illusion of security at work satisfies a variety of demanding issues; corporate management\u2019s requirement to discharge, (mistakenly, as it often transpires), best practice, deterrence by means of the visual existence of security assets, and the comfort and morale of staff. Security manpower provision, with the hours of deployment of staff inherited, unquestionably from contractor to contractor, and a by-product of stultified tender processes, may further enhance the deterrence factor sometimes in a positive way, but more often further compounding the illusion that security is working. The test of manpower\u2019s efficacy is the extent to which deployed security officer\u2019s duties morph into pseudo-security and facilities management. The more non-core duties that security personnel adopt, the more obvious it is that security is failing.<\/span><\/p>\n The question as to whether security fails is not absolute, as whilst it may fail the test, of a value sensitive, risk driven and strategically thought out process, it often succeeds, albeit as we have said, against the most common threats. Security, as practiced by the many organisations, works against what may be considered, seemingly, the most common denominators of threats and hazards \u2013 break-ins and fire.<\/span><\/p>\n The conclusion, drawn from our many years of experience, is that security does fail the test of value and nowhere is this more obvious, from the businesses surveyed, than in the provision of security manpower. Inherited hours of manpower deployment are often accompanied by the narrowest of inherited site assignment instructions, predicated and mandated in ignorance of the wide range of potential security weaknesses that, in the absence of risk analysis and assessment, remain unexposed. Investigation also reveals that the tasks and duties of the manpower equation of the overall security jigsaw, operates at one speed, taking no cognisance of the rise and fall of the macro-environmental, national risk. When the nation\u2019s threat level increases, it can be observed form the assignment instructions that the tasks and aims of security personnel will invariably remain unaffected and not mirror the necessity for increased vigilance and tasks appropriate to reflect the heightened risk.<\/span><\/p>\n <\/a> Enterprise risk management is now an established element of the body corporate, driven in the main, especially within those \u2018main board\u2019 listed companies, by the need to comply with the risk specified issues outlined in the Combined Code of Corporate Governance, or qualify their annual accounts accordingly and face the potential ire of the markets. There is an evident, disconnect, or \u2018firebreak\u2019 passed which, in most investigated organisations, that the enterprise risk matrix stops and that is at the door of the \u2018downside\u2019 risks from security threats of man and the hazards of the environment. The \u2018Code\u2019 it should be said, however, makes no distinction and expects a company to approach risk in a \u2018top to toe\u2019 manner, not distinguishing between the potential upside risks of the companies enterprises and the downside risks of security threats.<\/span><\/p>\n There is consistent evidence of what can be termed \u2018management snobbery\u2019 when compiling what may be a very sophisticated enterprise wide risk register, leading to a tendency to ignore those singularly \u2018downside security issues perceived as \u2018below the waterline.\u2019 This disconnect is often subjective, not simply a function of the fact that systems are not in place within the security division to produce their threat narrative, rather it is symptomatic of the role in which security, as a corporate department is perceived. The \u2018man on the gate\u2019 and the \u2018camera on the wall\u2019 become a visual metaphor for how unsophisticated in its operation, senior management perceive the role of security.<\/span><\/p>\n The objective of security to protect against criminal and malicious acts can become secondary to the imperative for it to be able to face the day-to-day challenges of operating within what can be termed the organisational culture. Entities operating within certain industries, where ideas and the flow of information are key, can develop a culture, one consequence of which is to labour under the mistaken impression that locking a door, managing strict access and access to sensitive information, all restrict the intellectual flow of information, thereby becoming an impediment to core, business processes. Where a higher than average staff intellect is added to the mix, then resistance to these apparent and inconvenient restrictions on the \u2018individual,\u2019 even for the benefit of the many is likely to further challenge even the simplest of security practices and procedures. The security department will be continuously dealing with a variety of arguments against its mandated procedures, however specious the argument may be.<\/span><\/p>\n Risk Managem<\/span><\/span><\/span>ent can be defined as<\/span> “a <\/span>systematic way o<\/span>f<\/span> p<\/span>rotecting the resources and income of a business against losses, so that the aims of the organisation can be reached without interruption.” No<\/span> security programme can be effective unless it is based on a clear <\/span><\/span>understanding of the actual risks it is designed to control and the value of the programme depends on its appropriateness and the relevance of resources. In other words, cost justification means not spending more than the benefits derived are worth.<\/span><\/span><\/p>\n Our range of consultancy services include;<\/span><\/strong><\/p>\n The Illusion of Security It would seem axiomatic that if threats and hazards remain unidentified, vulnerabilities unacknowledged, incidents unrecorded and risk unqualified, that security must fail. In reality, however, it often succeeds, albeit more by good fortune than sound, … Continue reading ![\"\"](\"http:\/\/futureriskmanagement.co.uk\/wp-content\/uploads\/2013\/01\/peghole-200x300.jpg\" "\\"peghole\\"")
<\/a>
\nTechnology solutions fare little better in the \u2018value test\u2019 and whilst the acknowledgement by corporate management that an apparent solution to manpower costs may well be the application of sophisticated security systems, most substitutions are driven by the suppliers sales efforts, with the emphasis on equipment complexity, not operational functionality, or even necessity. The absence of an Operational Requirement (OR), carried out to assess the operational needs and functionality of security systems prior to instalment, be they CCTV, access management or alarms and signalling, further \u2018tilts a lance\u2019 at the \u2018value test\u2019 in terms of success or failure of the security operation.<\/span><\/span><\/p>\n![\"\"](\"http:\/\/futureriskmanagement.co.uk\/wp-content\/uploads\/2013\/01\/physical-security-equipment-300x219.jpg\" "\\"physical-security-equipment\\"")
<\/a><\/p>\n\n