Balancing commercial and security objectives

April 2016 Security Services & Risk Management

It is clear from the various incidents being reported in the media across South Africa that the commercial sector still has a huge opportunity to develop effective Facility Security Level Determination Framework and Operational Response strategies.

Christopher Cobb.
Christopher Cobb.

All facilities face a certain level of risk associated with various threats. These threats may be the result of natural events, accidents, or intentional acts to cause harm. Regardless of the nature of the threat, the commercial sector and facility owners/administrators have a responsibility to limit or manage risks from these threats to the extent possible.

Risk is a function of the values of threat, consequence and vulnerability. The objective of risk management is to create a level of protection that mitigates vulnerabilities to threats and the potential consequences, thereby reducing risk to an acceptable level. A variety of models can be used to calculate risk and to illustrate the impact of increasing protective measures on the risk equation.

Facility owners/administrators and in particular owners of public facilities, should develop and implement a security risk management methodology standards while also supporting the security needs of the organisation.

In order to achieve this Risk Management Process for Commercial Facilities, a set of standards need to be developed. Standards will need to be defined including the criteria and processes that those responsible for the security of a facility should use to determine its facility security level (FSL) in order to provide an integrated, single source of physical security countermeasures.

Commercial facilities need to introduce a risk management process that outlines the approach necessary to:

• Identify,

• Assess, and

• Prioritise the risks to facilities.

This should be followed by a coordinated application of countermeasures to:

• Minimise,

• Monitor, and

• Control the probability and/or impact of an unfortunate event from occurring.

Risk management decisions need to be based on:

• Application of risk assessment,

• Risk mitigation, and when necessary and/or

• Otherwise reasonably unavoidable-risk acceptance

The development of a Facility Security Level Determinations Framework for commercial facilities should involve obtaining information and process required when designating a FSL determination to a facility. The FSL determination must be utilised to create a set of baseline security and operational standards that are customised to address site-specific conditions and should include:

• Basis for the factors and criteria.

• Facility security level matrix.

• Facility security level scoring criteria.

• Mission criticality.

• Symbolism.

• Facility population.

• Facility size.

• Threat to tenants.

• Intangible factors.

• Level V facilities.

• Changes in the facility security level.

• Co-location of tenants with similar security needs.

• Integration of physical security.

• Apply the physical security criteria.

• Identify baseline level of protection.

• Identify and assess risks.

• Decision point: are risks adequately addressed by the baseline level of protection?

• Determine the level of protection necessary to adequately mitigate risk(s).

• Decision point: is the existing level of protection sufficient?

• Decision point: is the level of protection achievable?

• Determine the highest achievable level of protection

• Decision point: is the risk acceptable?

Take for example, the integration of the physical security criteria that should provide an overview of how the application of physical security criteria is predicated on a FSL designation. Once a FSL has been determined, commercial facilities can then follow a decision-making process needed to identify an achievable level of protection that is commensurate with – or as close as possible to – the level of risk, without exceeding the level of risk.


Without security processes (which is much more than a guarding mentality programme so prevalent in business today) being in place, an organisation’s reputation / brand trust can be so easily destroyed, not only by those criminal elements external to one’s business but especially so for new employees whose ethical outlook is unknown to any company.

Whatever the outcome, if companies are to protect their assets, market share, brand trust reputation then they must adopt a strategic all-inclusive proactive preventative approach to all forms of crime. The current responsive approach to crime, where business fail to perform effective risk assessments and wait for their assets to be stolen before attempting to catch a culprit, will result in placing their business their tenants, customers and employees at risk.

The integration, in a formal, collaborative and strategic partnership framework of the cumulative security resources of an organisation and other vested stakeholders is needed in order to deliver enterprise wide benefits through enhanced risk mitigation, increased operational effectiveness, efficiency, cost savings and brand trust.

For more information contact Christopher Cobb, UWC, +27 (0)72 633 2339, [email protected].

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Local manufacturing is still on the rise
Hissco Editor's Choice News & Events Security Services & Risk Management
HISSCO International, Africa's largest manufacturer of security X-ray products, has recently secured a multi-continental contract to supply over 55 baggage X-ray screening systems in 10 countries.

Detecting humans within vehicles without opening the doors
Flow Systems News & Events Security Services & Risk Management
Flow Systems has introduced its new product, which detects humans trying to hide within a vehicle, truck, or container. Vehicles will be searched once they have stopped before one of Flow Systems' access control boom barriers.

A standards-based, app approach to risk assessments
Security Services & Risk Management News & Events
[Sponsored] Risk-IO is web-based and designed to consolidate and guide risk managers through the whole risk process. In this article, SMART Security Solutions asks Zulu Consulting to tell us more about Risk-IO and how it came to be.

Cybercriminals embracing AI
Information Security Security Services & Risk Management
Organisations of all sizes are exploring how artificial intelligence (AI) and generative AI, in particular, can benefit their businesses. While they are still figuring out how best to use AI, cybercriminals have fully embraced it.

Integrate digital solutions to reduce carbon footprint
Facilities & Building Management Security Services & Risk Management
As increasing emphasis is placed on the global drive towards net zero carbon emissions, virtually every industry is being challenged to lower its carbon footprint and adopt sustainable practices.

Visualise and mitigate cyber risks
Security Services & Risk Management
SecurityHQ announced its risk and incident management capabilities for the SHQ response platform. The SHQ Response Platform acts as the emergency room, and the risk centre provides the wellness hub for all cyber security monitoring and actions.

Eighty percent of fraud fighters expect to deploy GenAI by 2025
Security Services & Risk Management
A global survey of anti-fraud pros by the ACFE and SAS reveals incredible GenAI enthusiasm, according to the latest anti-fraud tech study by the Association of Certified Fraud Examiners (ACFE) and SAS, but past benchmarking studies suggest a more challenging reality.

Deception technology crucial to unmasking data theft
Information Security Security Services & Risk Management
The ‘silent theft’ of data is an increasingly prevalent cyber threat to businesses, driving the ongoing leakage of personal information in the public domain through undetected attacks that cannot even be policed by data privacy legislation.

Data security and privacy in global mobility
Security Services & Risk Management Information Security
Data security and privacy in today’s interconnected world is of paramount importance. In the realm of global mobility, where individuals and organisations traverse borders for various reasons, safeguarding sensitive information becomes an even more critical imperative.

Proactive strategies against payment fraud
Financial (Industry) Security Services & Risk Management
Amid a spate of high-profile payment fraud cases in South Africa, the need for robust fraud payment prevention measures has never been more apparent, says Ryan Mer, CEO of eftsure Africa.