Risk is a concept that every facility manager is familiar with. We take on risk every day when we’re in business: the risk that last week’s client won’t pay their invoice, the risk that an employee will hurt themselves on the job, the risk of defective work that requires expensive corrective action. Security is often regarded as yet another of the risks to cope with in daily business. It tends to be a lower priority until a lack of security causes direct (and substantial) financial loss.
Many businesspeople simply don’t see themselves as having time or resources to address security risk exposure. For many businesspeople, security risks are less common and therefore less of a priority. So why should we bother with security risk assessments?
Security risk in the bigger picture
Suffering loss tends to be the best motivator for proactively tackling risk exposure. For example, many small businesses will have robust debtor policies. A client failing to pay an invoice can have severe cash-flow ramifications for small business, and so there is incentive to have good risk treatment measures in place.
This incentive is often not as powerful for security risk, because businesses have insurance to protect them from losses associated with security risk events (e.g. theft, vandalism). As a result, security companies tend to work most often with companies that cannot satisfactorily offset their losses through insurance. Some businesses won’t be in a good position to see their own risk exposure in this sense, and will form the view that their security risks can adequately be handled through insurance and “being careful”.
Loss can take many forms, and not all of these are safely compensable by insurance. This would include situations where insurance cannot be relied upon to fully compensate financial loss. For example, where a theft or burglary causes downtime to a business, there is the risk that the insurance policy cannot fully compensate lost business opportunities. This is particularly important where the business relies on particular systems, and customers are intolerant of those systems being available: for example, companies like Amazon rely on their online shopfront to do business, and extended downtime to the system results in loss of sales to competitors.
Other problems can arise in situations where insurance cannot be relied upon to offset non-financial loss. Critical non-financial assets and capital could include:
- Time: This is particularly important in small business or in small management teams, where time is an extremely valuable commodity. For example, an arson attack on a small business office would involve significant time expenditure by the office manager. An insurance policy could not be expected to fully compensate for the time lost filling out police reports, filing insurance claims, and setting up an alternative business site.
- Ambience/experience: For example, I can remember a time when late-night train travel in Perth and other major Australian cities was regarded as a risky activity. Some people would avoid using the trains at certain times of day, and this damaged the carrier’s reputation, which in turn led to loss of business. This created incentive for police patrols and new transit security personnel on metropolitan rail lines. When a business is frequently the target of criminal activity, and senior management is slow to respond, it puts customers off.
- Reputation: This is related to ambience, and is important for consumer-oriented businesses or other operations that rely on image. Where a business develops a reputation for being slow to recognise security problems, customers may form a negative view of the organisation itself.
Security risk fits within the bigger picture of risk management, which is all about reducing the risk exposure of the organisation. The ISO 31000 standard sees risk as the chance of something happening to have an effect on the achievement of organisational objectives. In security risk, we’re generally talking about a negative effect on objectives. This is what is meant by loss: a negative impact that inhibits the capability of the organisation to do what it aims to do.
So why is it worthwhile to bother with security risk assessments?
#1 Security risk assessments identify risks that are not immediately evident to the business.
#2 Security risk assessment supports other areas of risk management.
#3 Security risk assessment provides perspective and intelligence for business continuity.
#4 Security risk assessment doesn’t need to be prohibitively expensive, and good security risk strategy can support the organisation in achieving its objectives.
Building your security risk awareness
I’d argue that there are a lot of reasons why you should bother with security risk assessments. In my experience, many losses due to security risk events could easily have been prevented with a bit of forethought. And there are instances where insurance is not an entirely adequate protection against financial and non-financial loss. So if your organisation has never undertaken a security risk assessment, give serious consideration to starting now.
–
This is an abridged article written by Peter L. Lacey, Lead Security Consultant at Bax Security Services. Click here for the full article.
