Library

A toolkit built as a set of modules, each one covering a single part of security risk management. The design assumption is that a country office will work through the modules in order and produce its own documents as it goes.

Download module 12: people management (PDF, English)

How the toolkit is meant to be used

It is not a manual to be read. Each module poses the questions a country office has to answer, sets out the options, and points to the decision that has to be taken and recorded. A team that works through the modules produces a risk assessment, a security plan and a set of standing arrangements that belong to that office and that reflect the context it actually works in.

The order matters. Assessment before planning, planning before training, and training before the arrangements are relied on. Organisations that start with training, which is the most visible and the easiest to buy, end up with staff who know the theory and an office with no plan.

What the modules cover

• Context and threat assessment. What is happening, who the actors are, and how the programme relates to them.
• Risk assessment and the risk register. Turning the context into a ranked set of risks with owners.
• Security planning. The written plan, what goes in it, and how it is kept current.
• Physical security. Offices, residences, perimeter, access control and guards.
• Movement and journey management. Vehicle standards, journey authorisation, checkpoints and what to do when a journey goes wrong.
• Communications. Equipment, schedules, the communications tree, and what happens when the network is down.
• Incident response. First actions, the crisis management team, and the handover to a formal crisis structure.
• Medical. Capability in country, evacuation routes, and the arrangements that have to be in place before anyone is deployed.
• Training. What training is required, for whom, and how often.
• Hibernation, relocation and evacuation. The three plans that are written and never rehearsed, and what rehearsing them involves.
• Reporting and analysis. Incident recording and what the organisation does with the record.
• People management. The module reproduced here, covering recruitment, induction, support, performance, conduct and the end of an assignment.

The people management module

The module distributes this list covers the parts of security management that belong to human resources rather than to a security officer, which in practice is most of them. It deals with describing risk honestly at recruitment, checking that a candidate understands what they are accepting, induction and briefing, supervision in difficult locations, rest and rotation, recognising the effect of cumulative exposure, and managing the end of an assignment well enough that a departing member of staff does not become a security risk to the organisation or to themselves.

It also covers the manager's own position. A manager who is deciding whether to send someone into a difficult place is making a decision with consequences for that person, and the module requires the reasoning to be recorded at the time rather than reconstructed afterwards.

Related

• Security risk management: a basic guide for smaller NGOs
• Risk assessment for personnel security
• Security incident information management handbook