Reduced access and continuing security incidents affecting National Society staff and volunteers in today’s increasingly volatile environments have shown that this gap needs to be addressed not only by National Societies operating in insecure contexts but by all Movement components at all times.
To complement the various “active acceptance” measures outlined in the other seven Safer Access Framework elements, a robust operational security and risk management policy, systems, guidelines, training and practices are needed to provide the concrete dimension to managing the identified risks of intentional violence facing staff and volunteers and to protect the organization’s resources and assets.

Myth: Adopting operational security risk management practices will reduce the National Society’s ability to meet the needs of people and communities effectively – highlighting the tension between the “humanitarian imperative” and managing risk.

Reality: Professional operational security risk management practices are designed to facilitate access and enhance security – mitigating risk – resulting in greater reach to those in need, more safely.

In summary, operational security risk management aims to safeguard the lives and well-being of staff and volunteers and to protect the organization’s assets, its programmes and even its reputation.

Adopting a safety and security policy

All environments contain a certain level of risk, whether from accidents (traffic or otherwise) or, at the other end of the spectrum, indiscriminate or targeted acts of violence. Therefore, whatever the situation, it is essential for the National Society’s leadership to put in place an organization-wide, context-driven safety and security policy, which will provide a solid foundation for the fulfilment of its “duty of care” to its personnel.

This policy would form the core of your operational security risk management approach and reflect the Fundamental Principles and other values governing your organization. It might very well also incorporate the Safer Access Framework, not only as a guide to overall capacity strengthening and preparedness to work in sensitive and insecure contexts, but also integrating the specific actions and measures that contribute directly to safety and security management.

The contents of such a policy would provide clear parameters to support personnel in making operational decisions and in the development of their local security plans. It should incorporate relevant Movement policies, such as on the use of armed escorts (Council of Delegates 1995) and the minimum elements for working with external organizations (Council of Delegates 2003), and highlight their relevance for application.

The policy must also reflect individual and collective governance and management responsibilities in the security management of staff and volunteers, clearly specifying each one’s accountability. Reference should be made to associated documents containing standard operating procedures and security guidelines that provide more specific guidance and that may be adapted over time, taking into account developments in the context.

Fostering a culture of safety and security

Such a policy will help foster a culture of safety and security, whereby each staff member and volunteer – at all levels of the organization – has the reflex to pre-screen every communication and action from the perspective of how it will affect the beneficiaries and how it will influence their own acceptance and security and that of their colleagues, their organization and the Movement as a whole.

Establishing an inclusive and integrated approach to security management is crucial to generating a common commitment and understanding of the expectations of individuals and of management and their subsequent responsibilities in this regard.

The value of continually strengthening a safety and security culture will become evident when someone suddenly faces a particular circumstance where the existing good practice and guidelines may actually have to be adjusted or even superseded by sound situational judgement grounded in an analysis of the context realities and the basic premises of the security culture.

Integrated operational security risk management system and structure

Building on the context and risk assessment and the safety and security policy, it will be necessary to adopt an integrated operational security risk management approach by establishing or adjusting current systems, structures, guidelines, training and practices. A risk management system is a core feature of this approach.

Risk management

Risk management draws on a thorough understanding of the context, including, where relevant, the “conflict” dimension (i.e. who is fighting whom, where, why and with what means). Armed with that knowledge, a structured and unbiased collective assessment can be undertaken of the threats arising from the context and their likelihood of affecting the organization and its people. (See Context and Risk Assessment.)

Once identified, these risks must be managed singly and systematically, either by taking measures to avoid or prevent exposure to them, by accepting them while taking measures to mitigate their impact or, when they exceed the organization’s pre-determined risk threshold, by transferring them to others more able to take on such risks. If a decision is made to take on a risk, while mitigating the impact, it must be determined that the benefit – often measured by the expected impact of the humanitarian service on the beneficiaries – outweighs the exposure to the risk.

The overall process must be inclusive, inviting input from all staff and volunteers and others such as trusted community members and Movement partners in order to benefit from a broad diversity of perspectives. This will result in a more thorough and comprehensive assessment. Inclusiveness will also engender a common understanding of the risks and a shared understanding of and sense of responsibility for the necessary security measures.

Operational security strategy, plan and guidelines

The results of both the context assessment and the risk assessment will guide the development of your National Society’s specific security plan, internal guidelines or standard operating procedures, security rules and guidelines, code of conduct and subsequent training and decisions on the equipping of your teams.

Insurance

Insurance coverage is not protection; rather, it provides compensation for injury or death sustained by either staff members or volunteers while fulfilling their work duties. It is one of many mitigation strategies. In order to determine the contents of a suitable insurance policy, a full appreciation of the types of risks personnel are exposed to is required. It is an important part of the “duty of care” and of due diligence in managing staff and volunteers at all times, not only in insecure contexts.

In insecure contexts, the coverage must include war risk and, possibly, criminal acts. The personnel and their families should be fully briefed on the coverage provided and how to make a claim. Staff and volunteers are also encouraged to take personal responsibility by familiarizing themselves with the insurance coverage and requesting more information if something is not clear. Some individuals might consider obtaining additional private insurance if not satisfied with the coverage provided.

Not having insurance coverage for staff and volunteers may expose the organization to potential lawsuits, as accidents or security incidents can have major financial consequences for individuals and their families.