The 5 key elements in security risk management (which are often ignored)
Most organisations still get a key element of building security management wrong. And it is as simple as is important – good communication in a crisis.
In recent years, we’ve undertaken many security risk assessments. Just last month, we were asked to review a Sydney office tower that we’ve worked with for several years.
We found that the alert system was not fully understood by those on site. This is a common problem and can put a building’s occupants at risk, regardless of how noble the intentions of those protecting it.
In this case, a review had been conducted less than two years earlier but another was requested because the building’s use was about to change. Our client also wanted to know if they could handle a serious security incident.
One of the first items on our evaluation list was emergency management systems and processes. Critical incident management is very much about people and their roles and less about traditional security systems.
One of the first shortcomings we identified was that local security officers did not fully understand the Emergency Warning and Intercommunication System (EWIS). While property staff conducted all the usual evacuation drills, the company that coordinates them operated the EWIS rather than on-site security officers.
This was a concern and raised a series of related questions:
- Do the security officers understand the EWIS enough to operate it?
- What announcements would be broadcast over it?
- How would they decide if they needed to lock-down the building or evacuate?
- What systems would they need to perform a lock-down, and could this function be performed from the security control room?
- How would they keep themselves up to date on what was occurring and what tools did they need to do this? Did they even have all the tools they needed?
- How did they plan to keep occupants updated about what was occurring? The EWIS, or another method?
As with most risk assessments, identifying one shortcoming can often snowball into a whole series of improvements. It quickly became obvious that there were many questions that needed to be answered.
One major shortcoming of an EWIS is that it is only helpful for those who can hear it. How do you advise people who are outside on a coffee or lunch break? Do they need to be advised? If the building is in lock-down, the last thing you might want is staff coming back to an environment that is potentially unsafe.
Communication is critically important and we are yet to see a system or process that is perfect. We believe that this is due to the changing nature of security related risk and the fact that most buildings are typically only set-up to manage fire or another type of evacuation.
In an ever-changing environment, it is becoming more likely that security staff will have to deal with serious security related incidents over fire incidents.
A key difference with security incidents is that they aren’t always directly associated with the property in question. They can unfold a block or more away and still potentially impact a building’s operations.
During a significant incident, good communication is critical and information must be timely and accurate.
How are security officers expected to make informed decisions when they don’t have a full picture of what is occurring?
How are security officers expected to make informed decisions when they don’t have a full picture of what is occurring?
Earlier this year, a car travelled through Melbourne’s Bourke Street Mall, resulting in several deaths and many injuries. Such an incident can impact a number of properties directly and many more indirectly.
Using this type of incident as an example, we need to consider what information security staff would need, and how they would communicate it to a property’s 1500 residents.
We have client properties near the where Bourke Street incident occurred. Security staff only learned about what happened by asking staff returning to the building. This is less than ideal. Had it been on their doorstep, they would have had a better understanding of what happened, but would probably still not be in a better position to deal with it.
This is despite communication never being easier in 2017. We simply don’t apply modern communication methods such as instant messaging within the built environment, which is a concern.
We simply don’t apply modern communication methods such as instant messaging within the built environment, which is a concern.
For critical incident management, buildings should be able to immediately broadcast SMS alerts to all staff. As situations change, so should the messaging. Building residents need to know exactly what is going on and what they should be doing. And once informed, they need to be regularly updated as the situation changes.
All this requires is a broadcast SMS software package, of which there are many options available. We would suggest a program that allows pre-programmed messaging and then custom messages to be sent on the fly. This application should be in the security control room with other critical systems. Many systems are web based and can be managed from a tablet or mobile phone if needed.
Now that we know where the gaps are, where to from here?
- Empower your local security staff to make time sensitive decisions. If they must call somebody or wait for head office approval, change your policy. Document what they are authorised to do and when.
- Review what systems and processes need to be in place so security staff and building wardens can properly manage an incident. Do they have the required tools?
- Consider how you can keep your security staff informed about what is happening locally. Provide access to real-time news broadcasts and social media.
- Revise your communications system and how you can keep everybody informed – not just those within earshot of an intercom speaker.
- Practice. Run drills as you would for a fire alarm.
The benefits of clear and timely communication are often discussed in all facets of business. It’s time to consider how improved communication can better help manage critical security incidents. In an extreme situation, it could save lives.