Latest Products

Be resilient in the face of terrorism risk

Monday 16 April 2018


* Click here to download a PDF version of this article.

This article was originally publisjhed in the
GRC Professsional: Financial Crime 2018 Edition  


By Gareth Byatt and Lloyd Figgins
 
 

Acts of terror continue to take place around the world. What can businesses do to prepare for a terrorist incident that may impact their people and operations?
 
This article is by Lloyd Figgins, an international risk expert and Chairman of The Travel Risk & Incident Prevention (TRIP) Group, and Gareth Byatt, Principal Consultant of Risk Insight Consulting and one of our regular columnists.
 
Is your business ready to respond to an act of terror that may impact you or your people in some way? When we say “ready to respond”, we are referring to activities you can undertake to prepare for the possibility that your people and/or your operations may be impacted by an act of terror, acknowledging that authorities and specialists will always deal with acts of terror on a public security level. This article provides some high-level global context to how acts of terror are evolving around the world and asks what businesses can do to best be “response ready” if their people happen to be caught up in such an event.
 
 
A global overview of where acts of terror are taking place
 
The Institute for Economics and Peace released their fifth Global Terrorism Index 2016 on November 15, 2017 (data for 2017 is not yet published). The Index states that, although the total number of people killed globally in terrorist attacks in 2016 fell compared to 2015, the number of attacks and deaths in developed countries during 2016 increased, with 77 countries experiencing at least one terrorism-related death--more than in any other year since 2001, and 11 more than in 2015. OECD countries accounted for 1% of global deaths from terrorism in 2016. 94% of all terrorism-related deaths in 2016 happened in the Middle East and North Africa, sub-Saharan Africa, and South Asia.
 
The Global Terrorism Index heat map for terrorism risk from the 2016 report is shown below:


 
    

 
Unfortunately, acts of terror continue to have devastating and far-reaching impacts on communities, locally and globally.

 
What is the real likelihood of being caught up in an act of terror?
 
Risk management involves understanding uncertainty, seeing insights, making risk-informed decisions and taking appropriate actions.
 
When it comes to a business evaluating the risk of being caught up in an act of terror, if we were to plot the risk on a Risk Matrix, the impact would undoubtedly be in the top segment, because lives could be threatened. Where would we plot the likelihood for a specific business and its people? The likelihood of anyone being caught up in an act of terror in most parts of the world remains very low. To give some perspective, the Huffington Post
posted an article recently that, in America, there is a higher risk of being killed by lightning, lawnmowers, or being hit by a bus, than being killed by terrorists.
 
The article included the following image:
 

 
Regardless of the likelihood of individuals being caught in an act of terror, they cause catastrophic impacts, and governments, authorities, and specialists around the world conduct extensive efforts and measures to counter the continued global terrorist threat.
 
The counter-terrorism activities of governments and agencies manifest themselves in many ways, ranging from surveillance, to thwarting attacks before they can be attempted, with counter-intelligence agencies across the world linking up to foil plots, and dealing with actual events that occur. Businesses play a part in this effort, such as banks blocking terrorist funding sources and property developers designing their spaces with anti-terrorist measures.

 
Visit any popular and well-recognised monument today and you will see various surveillance and protection measures in place (such as police presence and physical security measures). If you have attended a large city-wide outdoors event, such as a New Year’s Eve gathering or a national holiday parade, you will have seen lots of these security measures in place—such as large vehicles placed as anti-ramming blockades in the streets, and so on.
 
This is the situation on an international and public ecosystem scale. Businesses exist within a social ecosystem, with their offices and sites in specific locations and their people working for them in specific locations and commuting to work and travelling to various places around the world for business purposes. What can businesses do if an act of terror is committed that, to varying degrees, impacts their people—whether it is an act of terror event close to or on one of their premises, or people are unwittingly caught up in an event while travelling somewhere around the world?
 
Here are some points you may wish to consider:
 

  1. Do you use risk management to put appropriate control measures in place?
 
Risk management tools and techniques, such as scenario planning, crisis management and controls management, can help you think through how to prepare for an act of terror that affects you.
 
Once you understand the risk as it pertains to the specifics of your organisation and your people, you can review the controls you want or already have in place. With a defined set of controls, you can then monitor your control effectiveness to determine if they are fit-for-purpose.
 


 
 
You could use a document like this to go through your control measures and prioritise them (controls would be specific to the nature of your business).
 

  1. How good are your incident management procedures and tools?
 
What kind of incident management procedures do you have in place already for dealing with a range of incidents and events, and how effective are they?
For example, do you have Incident Management Plans in place, with people in Incident Management Teams properly trained and ready to form into a team to respond to a major incident?
 
Do you have a specific Act of Terror Response Plan, or a “threat scenario” as part of an overall Incident Management Plan to respond to an act of terror that affects your people or your operations?
 
Consider the following elements, for example:
 

  • Understand and adhere to advice from governments and counter-terrorism agencies in all places where you operate
 
Should you obtain specific feedback from governments, or from specialist risk consultants for the geographies where you operate?
 

  • Do you operate in certain parts of the world where specialist experts believe the risk of acts of terror is greater?
 
If so, do you have appropriate measures in place, including specific advice for your staff?
 

  • Do you have an intelligent communications tool in place to contact staff in an emergency?
 
An intelligent and easy-to-use communications tool to contact your staff in the event of an emergency is invaluable for dealing with many crisis situations. You won’t always know where your staff are when you need to contact them in an emergency, especially on weekends and holidays. With the use of such a communications tool solution, you can quickly reach your staff in the event of an emergency, and request a response, for example, for confirmation on whether they are safe.
 

  • What are your office / site procedures in a city lockdown situation?
 
 
How proficient are you at evacuating people expediently from one or more offices / sites, or knowing what to do to secure your premises, if an act of terror situation forces a city / area lockdown? If transportation is permitted, have you thought about transportation logistics available, factoring the possibility of road and rail closures etc. that may make transportation difficult?
 
 

  1. Have you sought advice from experts on how to best respond to acts of terror, and do you have an on-call agreement with any specialists?
 
Experts can impart valuable advice. For example, if your people are caught up in a health-related act of terror, do you have advice from experts on how best deal with it? Do you have specialists on-call that you can bring onto an Incident Management Team at short notice to advise and assist?
 
 

  1. Do you have call-off / retainer agreements in place with specialist physical security providers?
 
Most likely, you will already have certain physical security agreements in place to assist with responding to a number of different situations (perhaps as an extension to regular security arrangements). In addition to this, is it appropriate for you to have (perhaps in some parts of the world, if not all) an agreement with a special security services firm that can liaise with authorities if any of your staff get caught up in an act of terror (e.g. a hostage situation). Whilst it is clear that government authorities will deal with an event such as a hostage situation, a specialist security firm can help you to evacuate your staff if they find themselves in the unfortunate position to be caught up in such an event.
 
 

  1. What training do you conduct for your people?
 
Everyone is aware of the terrorist threat today. Are there some specifics you can help your staff with? For example, is it appropriate to provide training on how to deal with an “active shooter”, or what is expected of them if they are caught in a city lockdown situation (which could include basic awareness that you may contact them with the company “intelligent communications tool” and that you may ask them to respond to messages through it).
 
 

  1. Have you held a major incident simulation to test how you would respond to your people being caught up in a terrorist attack?
 
As part of your incident management planning, one of your “threat scenarios” should cover what you would do in the event that your people (and / or customers and suppliers) are caught up in a terror attack.
 
Do you have such a threat scenario documented, and have you held a crisis simulation exercise focusing on your people (and perhaps one or more of your sites / facilities) being caught in an act of terror? If so, did you involve some of the specialists mentioned above to help run it and to provide advice?
 
It’s not only about what businesses can to protect their staff, but what individuals can do to make themselves more aware of potential threats around them. Recent attacks have highlighted the need for greater public vigilance—not only to prevent attacks in the first place, but also to understand how to react once an attack is underway.
 
A key part of this is what the security industry refers to as “situational awareness”. This is an effective tool for those trained on how to use it properly.
 
However, situational awareness requires an understanding of what is normal in order that a baseline can be established and anomalies can be identified.
 
In the Melbourne attacks, vehicles were used as weapons. People expect to see vehicles on our streets, so how do we tell the difference between those being driven by someone going about their normal business and someone with malicious intent? After all, those who would do us harm rely on their ability to blend in, in order to carry out their attacks.
 
Therefore, it’s the small pre-event indicators we need to be aware of, the change in engine pitch, the screech of tyres, or the sound of people shouting. Unfortunately, most people are not attuned to such warning signs, not just because they haven’t been trained, but simply because they wander around in their own world or are too busy concentrating on their phone rather than what’s going on around them. There’s strong argument that Situational Awareness should be taught in the workplace, and should form part of the larger emergency preparedness training.
 
 
 

Conclusion
 
All businesses, large and small, can plan to be “response ready” in the event that they are affected by an act of terror. You can never know when or how your people, or your sites, might be impacted by an act of terror, but by being prepared to respond if such a situation arises, you can hopefully deal with it in the best way possible.
 

 
 
About the Author
 
Gareth Byatt is an Independent Risk Consultant and owner of Risk Insight Consulting. He is based in Sydney, and has 20 years’ experience in international risk management and project management.
 


 
 
Lloyd Figgins is Chairman of The Travel Risk & Incident Prevention Group and  author of  The Travel Survival Guide which will be published in April, and be available in Australia and New Zealand.