Identification of risk when conducting risk management surveys on behalf of a client is comparatively straight-forward if the consultant have a sound history of operating within a security focused organisation and having conducted an array of both planned and dynamic assessments. Experience gained will build up versatility and a knowledge-base to draw on when ‘anomalies’ are faced, as they more often than not are. Whilst there are a great many books and courses offering complete resources pertaining to risk management, I think that first and foremost, experience has no equal in this arena and when supported by up to date guidance and strategies, will result in a credible end-product, adding value to the organisation’s operations.
The risk management expert must be well read as a minimum about the area in which the task is focused and have a fairly good working awareness of the region. Planning for the task must take place well in advance and must include, as a matter of priority, a detailed statement of requirement from the customer. This will negate any misunderstandings relating to expectations. The expert should ensure that induction and introductory briefings regarding the customer organisation is undertaken so as to completely understand the customer. As an absolute minimum I would suggest the following as essential before starting the work:
- Know the client and what they do.
- Know where they operate, are looking to operate and the duration.
- Know what assets the operation involves – people, equipment, real estate.
- Understand the customer’s expectancies – statement of requirement.
Awareness of the above will give the risk management consultant with a very useful’ Know Your Customer Folder’ in order to plan and make initial preparations but much more should follow. Research on the customer organisation should include any history of issues encountered during, or resulting from previous operations and ventures. This is of importance when calculating the risks particularly if hostile actions followed. For example, if the population of a region may have objected to certain aspects of an operation within their region or does the organisation have a ‘reputation’ which has followed them and is the operation being undertaken by the client controversial in any way?
The value of local knowledge is priceless and having the opportunity to engage with informed locals frequently provides data vital to the task which may otherwise be ignored. Take the opportunity, should it present itself, to discuss matters with influential and well placed local members of the population. It has furnished me many times with a precise indication concerning future development of issues. Additionally, it results in the formation of relationships with local people and possibly even local authorities like the Police which is very useful.
Be methodical and thorough in your risk management survey. Whereever feasible prove the information you are handing over to your client. Take photos, drive routes, visit areas and test, test, test! Your customer is paying for a service and expects convincing and factual results and that of course includes furnishing him with any ‘bad news’ if and when it arises.
To summarise: A well planned, well-conducted and well presented risk management survey is potentially of extreme importance to your customer. Failing to plan is planning to fail and your paying client deserves the best from his consultant’s endeavours.
Craig Jones is the M.D. of Advanced Training and Security Solutions Limited, an independent company established to supply a bespoke security and resilience service. Craig has worked for a number of organisations in a variety of roles. ATSS have a base in Cheshire, UK with a presence in London and a worldwide reach. They have experience with working in the Middle East, North Africa and Eastern Europe. Graig is a prolific writer of articles concerning risk assessment, emergency planning, business continuity and security management.