Having both been in the security industry for over a decade, JX and Kevin have experiences and stories aplenty.

“It’s interesting,” JX shares with a laugh. “Handling people, and situations, but it’s also interesting to see how differently each person reacts to a situation.”

Kevin tells us that he enjoys not being bound to a desk, and has the freedom to move around. “Sometimes, I’ll help the on-site ops teams too.”

They’re not your typical security officers. In fact, they’re technically not security officers at all. JX and Kevin handle enquiries and provide risk updates for APAC, including (but of course, not limited to) advising what to do and what to watch out for in the various countries their clients head off to.

Background

Kevin joined security by chance. “I was in the police force when I was in NS so I just transitioned quite naturally to security,” he explains. “I tried other jobs but I didn’t like it. Previously I got an offer to work for the government, and actually stayed for 9 years, but then I resigned and came back to security.”

JX on the other hand, joined security to be around people, and to reach out as much as she could to help them. “I love being around people, knowing their worries and having the ability to help them ease the considerations and concerns in their daily lives, both in and out of work.”

Security misconception

“People say security is low class – people see condos and shopping centers with elderly guards and the perception is that it’s an easy, ‘for retirement’ kind of job. They say security is redundant, but when incidents happen it becomes ‘Why is security not here?’”

Kevin echoes JX’s sentiments, adding that they constantly experience getting scolded, and have people who think they know better telling them what to do.

“There are also the people who say ‘eh you should be doing this not that,’ and ‘Eh I pay for tax, I pay for your pay’ to frontline officers, and even police officers,” Kevin says, rolling his eyes at the arrogance. “We react based on what we see, and we do what we think would be the best in a situation, but these overly concerned people would say “No you should do this or that instead! Sometimes it ends up being more mafan.” (troublesome)

So… has the job changed?
For Kevin and JX, they were both on the same page, insisting that Security itself as an industry would never change, but that people change instead, and so the way they react also must change constantly.

JX  explains that because she is now more at the back end of things, she has a different perspective. For those on the frontline – first responders, ERT (Emergency Response Team), SO (Security Officers) etc, speed is critical in their decision-making process. For her and Kevin, they have more time to digest and think about how to best approach a situation, and that this change in pace is the biggest change for her.

Advice

“It’s not easy, and you have to be content. If you choose to join this industry, you have to grit your teeth and go through everything,” JX says, and Kevin nods in agreement.

“There are people who are drunk – and they will spit on you, vomit on you, and they think security should be OK with this. But you’ll learn a lot, and the rewards will be greater than you think,” Kevin adds on.

Kevin ends the interview with a final piece of advice – You have to be street smart, and this aspect is very hard to teach. If you only want just the basics, then just go study to be a policeman.

The post Not Just A Guard – Episode 4 appeared first on Security & Risk Solutions Pte Ltd (SRS).

The 64 year old tells us he’s spent the better part of the last decade in SRS, starting out as a floater (an officer who has no permanent site location) before switching to a full time Senior Security Officer.

“When I was young, I wanted to be a policeman, but I couldn’t.”

Samy joined CERTIS CISCO at first, working with the foreign worker management team under the Singapore Police Force. “Long story short,” he says with a nonchalant wave, his soft eyes and gentle smile belaying his fondness of his time there. “I was awarded the commissioner police award, and even though I wasn’t technically police, I had fulfilled my dream, and that was enough for me.”

As the sole breadwinner to his family, kids and his elderly mother, he worked, day and night, relentlessly for 34 years to ensure they lead a comfortable life – one he did not have growing up.

“I came from a very poor family,” he explains. “With a lot of hard work, I achieved what I wanted to achieve, and I owned my own transport company. But at one point I just had to give it up – my transport setup, everything, and settle down in one job – and I chose security.”

His transport business, he told us, was one of the reasons he barely saw his son and daughter. He didn’t spend much time with them, and the time they did spend together ended up mostly with his children sleeping in the back of his truck while he worked nights.

Out of Uniform

It wasn’t all work and no play for Samy though.

“I love gardening. I trim, fertilize and watch out for insects attacking my plants.”

Samy lights up as he talks about his plants, and he elaborated on how he fought for his plants when there was his town council disputed them. (Not actually fought… he asked very nicely) 

“My wife and I quarrelled a lot during this period. I’ve had these plants for over 30 years, and they aren’t small pots. I got frustrated and spoke to the MP to settle it.”

He proudly states that they managed to settle it amicably, and his plants are now sitting pretty outside his apartment.

“After I settled in security, I now have more time to spend with my plants and my grandson. He’s in P1 now, but he came to me as a 9-month-old, and it was so new to me – not as a father, but as a grandfather.” Samy’s expression is soft and filled with fondness as he adds wryly that he gets blamed for spoiling his grandson (he insists that he’s simply doing his job, and we’re inclined to agree.)  

The Good, The Bad, The Ugly and the Hopeful

When asked about the best and worst parts of working as an officer, he laughs. It’s fulfilling, he says, explaining that the best parts are the trust his bosses and clients have in him to take up responsibilities, but ultimately as long as they’re happy, he’s happy.

“You have to love your job. Like for me, I love my job, and whatever I do,” he states with conviction. “Be happy with what you have. Take everything as a challenge. If you keep thinking there are problems after problems, then life will be full of problems. I don’t let myself get affected by outside stories, rumours and such nonsense.”

“The worst part though? The long hours.”

It’s a sentiment that is echoed by nearly all the officers we‘ve spoken to – the long hours are one of the worst parts of the job.

What Lies Ahead

While it isn’t easy, he explains, Samy feels that the job suits older folks looking to earn some extra money, especially the locations and/or roles that are less demanding than others.

“It’s a very difficult industry now, especially for you youngsters,” he admits, gesturing to myself and my colleague across the table.” Not just the long hours, now everybody has a PLRD (Private Security Industry Regulatory Department – yes, no L, I know, it confused me too), and the SS certification is as common as the SO certification. The youngsters that want to come up in this industry, it’s quite tough for them.”

Despite that, Samy thinks that the security business will never die – in fact, he believes it will grow in demand as people make their way through an increasingly precarious world.

The post Not Just A Guard – Episode 2 appeared first on Security & Risk Solutions Pte Ltd (SRS).

The post Organisational Risk & Crisis Management appeared first on Security & Risk Solutions Pte Ltd (SRS).

The post Who‌ ‌is‌ ‌a‌ ‌Modern‌ ‌Corporate‌ ‌Security‌ ‌&‌ ‌Risk‌ ‌Manager?‌ appeared first on Security & Risk Solutions Pte Ltd (SRS).

The post Business Continuity Management appeared first on Security & Risk Solutions Pte Ltd (SRS).

The post Success and Cycle of Security Management appeared first on Security & Risk Solutions Pte Ltd (SRS).

The post Exceeding expectations: SRS Global Reach’s commitment to clients appeared first on Security & Risk Solutions Pte Ltd (SRS).

Incidents should be classified into different categories, from the least to the most pressing. By ordering incidents according to their risks and impacts, organisations are able to better decide the corresponding security protocols needed to respond to them. We are all aware that one cannot and should not respond to a critical incident with the resources meant for low-risk incidents – such mismatch is a failure in response and may flag a need for the organisation to review the suitability and robustness of their Risk Management Framework.

All responses to potential incidents and accidents are to be tested, observed and evaluated to ensure their effectiveness.

Enough said, let’s deep dive into the 4 main categories of incidents classification:

• Standard Incident,
• Routine Emergency,
• Major Incident and
• Crisis.

Standard Incident

Standard Incidents are generally predictable and relatively easier to manage with pre-planned response measures. With that said, when they emerge, how and what their consequences may be, can vary largely from organisation to organisation. Hence, there is no one-size-fits-all approach to manage it.

Standard incidents are commonly identified through risk assessments or situations where the risks are clearly and widely recognised. With timely and effective incident management protocols in place and proper Standard Operating Procedures (SOPs) routinely checked and tested, standard incidents can be brought under control.

Routine Emergency

Whether it is a disruptive event that occurred in short-notice or one that emerged from gradual failures, such incidents can be classified as a routine emergency. Recognising the early signs of problems is critical to curbing and managing routine emergencies. While there are protocols in place to manage routine emergencies, they typically take a longer time than standard incidents to be brought under control or to resume business.

Multiple solutions are usually required to manage these routine emergencies. The solutions should be tested at least biannually during drills and operational readiness exercises to ensure everyone is clear on what to do. It is most preferred to have the Business Continuity and Crisis Management Team within the organisation to helm the drills.

Major Incident

More often than not, major incidents are unique, rare or unforeseen problems that arise from poorly managed risks. Major incidents create exceptional challenges for organisations because they are not easily managed by pre-planned responses. Due to their surprise nature – emerging from accidents that have been overlooked or have suddenly escalated – these incidents are beyond an organisation’s control and can lead to long-term consequences and a long recovery period.

Organisations cannot rely solely on their crisis management team to resolve these incidents. Collaboration with other industry or corporate security partners and agencies are critical in offering strategic solutions to manage the confusion, fear and risks involved.

Crisis

Finally, incidents classified under ‘Crisis’ are the most dynamic and unpredictable. A crisis has the potential to single-handedly destroy the existence of an organisation. Crisis often comes with many multiple other parallel incidents and risks which can leave the organisation at a loss of what to do.

Many organisations attempt to prevent crises from happening by having various risk control measures in place but that is insufficient. There has to be sustained efforts and committed resources (capital, manpower and time) to watch out for crises and pre-empt them. Managing and identifying crises is everyone’s responsibility – no one department or individual should be the only owner.

The most common pitfalls leading to crises are denial and complacency. Individuals should be encouraged to exercise vigilance, creativity and be willing to step up beyond their usual scope of work to mitigate crises or take part in Risk & Crisis Management brainstorming sessions.

The post Hierarchy of Incidents appeared first on Security & Risk Solutions Pte Ltd (SRS).

In the previous articles, we discussed the effectiveness of using a Three-Stage Risk Management Process to manage the risks and incidents effectively.

Recall

• Risk Assessment is conducted to identify and mitigate the risks and their potential impact on any organisation’s functions and resources.
• Risks can be man-made, as a result of natural disasters or technical failures

Today, we will be looking at 5 underlying principles governing risk control measures. They are: Avoid, Reduce, Share, Transfer and Retain the risks.

1. Avoiding risks

To avoid risks, organisations must first be aware of the potential for these risks to occur. They must also understand the contributing factors of these potential risks, the probability of them occurring and the magnitude of their impact.

Scenario: Imagine the hypothetical situation where your company is planning to open a new research and development (R&D) office overseas as part of its expansion plan. All is well except that the proposed office location is in close proximity to a young or minor fault line. There has been no earthquake recorded in that area for the past 50 years and reports show that the probability of one occurring is low. However, if an earthquake does occur, the company would be in dire straits as the R&D processes and technology would be largely irreparable.

As the leader of the Security and Risk Management Department, you decided to strongly advise against this proposal, substantiating your rejection with a comprehensive Risk Analysis. You counter-propose to open the office in a safer location far away from the fault line.

The above example is an exaggerated scenario. In our day-to-day business, there are often many other decisions involving risks – how should the business operate, what IT restructuring is required or even what appropriate security protocols to go with. For instance, a company may have to choose between a security surveillance system which is cheaper but less reputable as compared to a more recognised and expensive solution. Weighing the pros and cons, it may be more prudent to go with the latter as the company should not risk having a security surveillance system that may fail or perform below expectations and jeopardise the security of the company.

2. Reducing Risks

Reducing risks is all about minimising the likelihood of a risk occurring or minimising the consequences caused by a risk. This is especially relevant in situations where risks cannot be fully eliminated or avoided. Take, for example, an employee is required to make a business trip abroad to a country infamous for drink spiking, snatch theft and transport scams. While the employee tries to steer clear from danger, he would still be exposed to these risks while commuting or participating in a social event.

Fig: Source (2017)

To avoid the employee from falling prey to these risks, the company should subscribe him to a real-time Travel Alert service which sends regular updates on the happenings and ‘danger zones’ in the country which should be avoided. Additionally, as cliche as it seems, it would be good to remind the employee of the DO’s and DON’TS and educate him on the cultural and etiquettes that should be noted when on a business trip.

Finally, depending on the seniority of the employee and the importance of the business trip, companies can consider engaging a recognised or approved third-party security vendor to provide journey management services. Journey management services ensure the safety of the employee to-and-fro the airport, as well as in and out of meetings/venues. One additional step that companies can take for extremely high-profile employees would be to provide them with a personal Close Protection Officer. Ultimately, it is never too much to think and plan for buffers or additional resources required to support the primary security plan, should it fail.

3. Risk Sharing

Source: (N.D)

Risk Sharing is the practice of distributing risks within the organisation such across departments, teams or any other working groups. This strategy diversifies the impact of risk so no one particular group absorbs too much risk and fails in its functions.

4. Risk Transfer

Source: (N.D)

Similar to risk sharing, risk transferring is also about the sharing of risk but particularly so to external organisations like a third-party or several organisations. It was originally derived from insurance where the signing of an insurance policy helped to transfer some of the risks from the policyholder to the insurer.

Back to the context of security, a risk transfer could mean outsourcing a unit of the security operation to a third-party vendor. Outsourcing does not necessarily mean that the company is not capable of managing the security operations — it could simply be that the third-party is more familiar or well-versed. By engaging the third-party, the company is essentially better positioning itself against the potential risks by sharing the responsibility with another qualified party.

5. Retaining the Risk

Some risks have low impacts but yet cost a lot to eradicate entirely. There is no fixed definition on the risks but here’s a guideline:

• When the cost of managing a risk is higher than the impact of the risk itself, it may be prudent to just contain the risk.
• As long as the risks do not bring major disruption to the operations or safety of the firm, it may make monetary sense to simply retain it.

Conclusion

These 5 principles can be used in conjunction or in part to help organisations achieve just the right amount of risk control to mitigate risks without over exhausting resources. The bottom line is to choose a suite strategy that best suits the risks (vs cost), and the skills and competency of your organisation.

Credit for Strategy Image: Adobe Stock

The post Five Risk Control Strategies appeared first on Security & Risk Solutions Pte Ltd (SRS).

Risk management is systematically executed based on the principles and processes outlined in the Risk Management Framework. To have a robust framework, three questions from the Three-Stage Risk Management Framework which we constantly use to ask ourselves:

• What could the problems be?
• What should I do about the problems?
• What happens if the plans go wrong?

As much as a hassle it may seem, these questions decrease the likelihood of firms developing a weak Risk Management Framework which can prove futile when responding to threats. Firms do not want to be caught in a situation where manageable risks or threats are underestimated, resulting in detrimental consequences.

Question 1: What could be the problems?

Some common problems include wrongful assessment of risks and overlooking secondary risks related to the primary source of risks or threats. For example, a typhoon would be a primary risk whereas other events or calamities that happen as a result of which, such as flooding, landslide, land and air transportation disruption, power outages, internet & telecommunication outages, damages infrastructures, human safety, food safety, health issues, and business disruptions, are all secondary risks. As one can see, these secondary risks are not new and can be avoidable or mitigable if only the stakeholders had taken them seriously and not waved them off as insignificant.

Question 2: What should I do about the problems?

Failure to understand the nature and severity of threats would result in a faulty Comparative Risk Value model and the lack of resources to tackle the problems. Rather than turning a blind eye to the new threats or risks which are now uncovered, it is crucial to ensure that the model takes into account all of them and resources (such as manpower, equipment and budget) are rejigged to mitigate these risks. Regardless of how robust a response or solution may be, failure to understand each threat’s scale and scope can lead to failures in the response.

Drills and exercises should always be in place to test the effectiveness of the different security plans in place. Sometimes, it is only through actual testing that we know if something works or breaks. These drills and exercises also increase the response team’s awareness and responsiveness towards executing these plans.

Question 3: What happens if the plans go wrong?

Fig 2. Risk Control

Inevitably, some threats do get overlooked or mismanaged but they must not be forgotten – these experiences serve as a reminder and an opportunity to make remedies. One can do so by firstly, reviewing the Contingency Plans and patching up the gaps that led to a near-miss or actual crisis. Finally, these lessons should be analysed and used as a case study for the risk management team to rethink possibilities and ways to better mitigate or avoid such crises. One approach to do so would be for the managers to brainstorm for complex situations or even supposedly ‘unlikely’ circumstances and come up with several solutions/response plans for one risk agent and decide on the best one based on past experiences or tested effectiveness. Never say never – what is ‘unlikely’ may not be that unlikely after all.

Conclusion

However robust our Risk Assessment Framework may seem, firms should conduct regular reviews to ensure the Framework is still relevant and effective to mitigate new threats and risks.

The post Fool-proofing the Risk Management Framework with these 3 questions appeared first on Security & Risk Solutions Pte Ltd (SRS).