printer friendly version

Building a solid foundation

Imagine you are building a house. You need a solid foundation to ensure the house stands tall and strong. In the security world, understanding the roles of a Risk Assessor and a Risk Manager is like building a foundation. Let us break it down to make it easy to understand.

André Mundell

The Risk Assessor: The investigator

The Risk Assessor’s job is like that of a detective. He investigates to find security risks that might lead to crime. This investigation is called a risk assessment. Think of it as the first stone in building our foundation. A risk assessment is always first.

The Risk Assessor’s independence is not just a feature; it is a necessity. By not being tied to the company or property they are assessing, they can provide an objective view. This is crucial as it ensures that every potential risk is thoroughly examined without bias or influence. If the assessor were an internal employee, they might inadvertently overlook certain risks due to their proximity to the situation.

The Risk Manager: The overseer

The Risk Manager’s job is to manage risks. Unlike the Risk Assessor, the Risk Manager usually works for the company. They deal with all kinds of risks, not just security risks. For example, they handle safety, building, and even environmental risks.

The Risk Manager’s job is more complex because they oversee various managers. Directly below them, you might find the Security Manager, the Safety Manager, the Building Manager, and even a Fleet Manager. Each of these managers focuses on different types of risks within the company.

It is always said that the risk needs to be identified before you can manage it effectively.

Another issue is that only about 0,2% of residential estates have a dedicated Risk Manager. Without one, the responsibility often falls on a security person on the board of directors. This person is not entirely devoted to security and has other duties as a director, which is not ideal.

Why independence matters

The Risk Assessor stands outside the company and looks in. He provides a fresh perspective. He can see things that people inside the company might miss. This is because he views the company from the outside, just like a criminal might. The assessor’s job is to find all possible security risks and report them.

The Risk Manager, on the other hand, looks at risks from within the company. They manage the risks that have been identified, including those found by the assessor. Their focus is on ensuring that the company runs smoothly and safely.

The deep dive: Risk assessment

When the assessor embarks on a risk assessment, they delve deep. They stand outside and scrutinise everything with a critical eye. They adopt the mindset of a criminal: ‘How can I breach this security? Where are the vulnerabilities?’ The assessor invests significant time and effort in investigating these risks, leaving no stone unturned. This thorough approach instils confidence in the process and the results it yields.

For example, the assessor might examine how a criminal could get through the main gate and check whether the security cameras are working correctly. The assessor looks at everything from the criminal’s viewpoint. This thorough investigation helps uncover hidden risks that need to be addressed.

The day-to-day: Risk management

The Risk Manager’s job is different. They rely on reports and information from various managers and might not have the time to spend as much time onsite as the assessor does. The Risk Manager is often busy with paperwork and meetings. Their job is to take the information from the risk assessment and manage it effectively.

The Risk Manager has to ensure that everything runs smoothly. This includes fixing potholes, ensuring traffic lights work, and managing health and safety risks. Sometimes, they miss some security risks because they have many other responsibilities.

Working together: The perfect balance

The true strength of a secure company lies in the harmonious interplay between the assessor’s and the Risk Manager’s roles. The assessor’s meticulous risk assessment comprehensively represents all potential security risks. The Risk Manager then takes this information and, in collaboration with other managers, effectively manages and mitigates these risks, ensuring the safety of the company and its assets.

However, in some companies, the roles are not well balanced. The Risk Manager might occasionally rely too heavily on the data the security provider provides without questioning it. This can lead to gaps in security.

A Risk Assessor does not work with a matrix system and does not have acceptable risk; on the other hand, a Risk Manager does work with a matrix system and accepts 20% acceptable risk (for example) on a scale from one out of five.

Understanding the difference

In summary, the Risk Assessor is like an external detective investigating and finding all possible security risks. The Risk Manager is the internal overseer who manages all types of risks within the company. Both roles are essential, but they serve different purposes.

The key for the Security Assessor is independence. The Risk Manager usually works for a residential estate and cannot do a security risk assessment because he cannot assess his own management team or himself.

Understanding the difference between a Risk Assessor and a Risk Manager is crucial for building a solid security foundation. Each role brings a unique perspective and set of skills, ensuring that all risks are identified and managed effectively. By working together, the assessor and the Risk Manager help create a safe and secure environment for everyone.

Share this article:

Further reading: