Security risk in the language of leadership

The operations team speaks in hours, posts and patrols. Leadership speaks in exposure: what could go wrong, how serious it would be, and whether the assessment rests on evidence or impression. ISO 31000:2018 sets out principles for identifying, analysing, evaluating, treating, monitoring and communicating risk across an organisation — and communicating it to leadership is part of the method.

• Likelihood: on a scale defined in words (rare to almost certain), grounded in the site’s own history.
• Impact categories: people’s safety, continuity of operations, assets, information, legal and regulatory exposure, reputation.
• Trend: is the risk rising, falling or stable since the last report?
• Evidence: shift reports, the incident log, audit results — not reassurance.

If a board report only counts activity (“1,200 patrols completed”), it says nothing about risk. Ask what changed in the exposure.

1. Scenario: threat, vulnerability and what is hit, in one sentence.
2. Likelihood and impact: the score before controls.
3. Controls: what exists today — people, procedures, technology.
4. Residual risk: the score after controls, and whether it is within tolerance.
5. Owner: one person, not a department.
6. Actions: what is being done, by when, with what proof.
7. Trend and last review.

The register need not be long. Ten to twenty scenarios per site are enough to show where the real exposure lies.

The most common mistake is to assume “security belongs to the security company”. The provider owns delivery; the business owns the risk. So each risk owner is someone inside the organisation — the facilities manager for the perimeter, say, or the logistics manager for the warehouse.

• The risk owner sets tolerance and approves controls.
• The security provider runs the controls, records, reports and proposes changes.
• Leadership or the board sees the whole picture, decides how much risk the business accepts and checks that owners do their job.

• Immediately: any incident touching people’s safety, stopping operations or creating legal exposure — under an escalation rule written in advance.
• Monthly: a review with the provider against performance indicators — see security company KPIs.
• Quarterly: the risk register to leadership: what changed, which actions closed, which risk moved outside tolerance.
• Yearly: a full review of the risk assessment and the tolerance levels.

Write the cadence and the escalation rule into the guarding contract, so neither depends on anyone’s goodwill.

1. What are the three biggest risks across our sites, and what evidence supports that view?
2. Which risk rose since the last report, and why?
3. Which findings or corrective actions are open past their deadline?
4. What was the most serious incident this period, and what did you change afterwards?
5. How would we find out if a control stopped working — a patrol not done, a camera offline?
6. What is not covered today, and who has accepted that?

The last question matters most. A provider that can say plainly what it does not cover gives leadership a real picture; one that says “everything is covered” does not.

1. Facts: what happened, when, where, who acted — from a written incident report.
2. Operational impact: which process stopped or slowed, and for how many hours.
3. Link to the register: which scenario does it match? Was it already listed, or is it new?
4. Re-scoring: does the scenario’s likelihood or impact change?
5. Decision: a new control, a change in tolerance, or explicit acceptance of the risk by its owner.

OVIT’s security consulting delivers independent findings, evidenced and prioritised in a risk register, ready for the board and the insurer. Day to day, the Guardly platform keeps patrols, incidents and reports in one picture that feeds the register.