The cost of security risk management for NGOs
Security risk management is usually described as a cost with no measurable return. This study examines what it actually costs, how that cost is recorded, and why it is systematically understated in proposals and budgets.
The accounting problem
Security costs are rarely held in one place. A security officer sits in operations. Training is charged to human resources. Vehicles, communications equipment and residential hardening appear under logistics or as programme delivery costs. Insurance is a finance line. The consequence is that no organisation can state what it spends on security, and therefore no organisation can argue about whether the amount is right.
The study's first recommendation is unglamorous and effective: put the cost in one place, even if only for the purpose of an annual review. An organisation that knows its number can compare it against others and against its own risk profile. An organisation that does not is negotiating blind.
What the cost consists of
| Category | Typical components |
|---|---|
| Personnel | Security staff and focal points, the proportion of managers' time spent on security, and the cost of training, including the staff days removed from programmes. |
| Equipment | Communications, vehicles and vehicle standards, protective equipment, physical hardening of offices and residences, and the maintenance and replacement of all of it. |
| Insurance and medical | Medical and evacuation cover, death and disability cover, and the medical capability maintained in country. |
| Operating costs | Approved accommodation, higher transport costs, additional flights and rest breaks, and the difference between running a programme under restrictions and running one without. |
| Programme costs | The work that could not be done, or was done more slowly, because of the security arrangements. This is a real cost and it is almost never recorded. |
| Incident costs | Response, investigation, legal costs, repatriation, and the cost of replacing staff who leave after an incident. |
Why the figure in the proposal is wrong
Donor budgets are built from templates, and the templates have no line for most of the above. Security personnel are charged to management. Training is charged to capacity building. Vehicle standards are absorbed into logistics. The result is that the security cost of a programme is real, is paid, and is invisible.
Invisibility has consequences. A country office that cannot show what it spends on security cannot defend the spend when a budget is cut. A programme that appears to cost less than it does will be judged against programmes that have been costed the same way, and the organisation that budgets honestly looks expensive. And the cost of the work that was not done is never presented at all, so the programme appears to have delivered what it promised when it delivered less.
What the study recommends
- Record the full cost centrally, even where it is incurred in different departments.
- Present security costs in proposals as a stated percentage of programme value, with the components listed, rather than dispersed as unlabelled overhead.
- Cost the programme consequences of restrictions, so that the trade-off between security measures and delivery is visible to the people deciding the budget.
- Compare the cost against the risk profile, not against other organisations, since a programme in a low-risk country should cost less and the comparison is otherwise meaningless.
- Treat the cost of an incident as part of the baseline, because over a long enough period every programme in a high-risk environment will incur one.
Related
Practical guidance and research on the security of humanitarian staff, for the organisations that send them.