How safe is your facility from attack? And should you care?
Ever wonder, as a senior executive, how safe your enterprise is from an assault in your facility? Or how safe your facility is from an armed attack where bad guys want to steal something by force? This is, while not exactly a reasonable question – groups of trained and armed men rarely attack here in the US– at the very least it is an interesting question.
To a large extent, the answer depends on whether you have considered this as a real risk (which for most of us it isn’t), and put in place procedures appropriate to deal with the possibility. In real terms you probably have, at one end of the spectrum of preparedness, nuclear power plants, and at the other hand convenience stores (which get robbed by amateurs with depressing frequency).
Based on a survey of the field, looking at facilities and audits, speaking with others in the field, and based on our own experience, we would guess that for the normal company the likelihood of the staff being able to defend against an assault approaches zero. For a nuclear power plant, where there is a resident armed swat team with practiced procedures in place, we estimate the likelihood of being able to defend from attack probably lies somewhere between 40 and 60 percent.
The more significant question is whether you should care. Assuming you don’t run a nuclear power plant, the answer is a resounding no: The likelihood of facing such an attack is so remote as to be right up there with your being squished by a meteor, or someone flying a hijacked airliner into a building. The fact is that meteors big enough to do damage rarely hit buildings, and that passengers will no longer allow aircraft to be hijacked by armed passengers, so these fall into the could-happen-but-really-unlikely category.
But, as we know, really-unlikely is not the same as impossible. Fortunately, if you practice disaster planning you should be able, as a commercial enterprise, to survive even an armed attack.
As risk managers, our job is to ask the question “What could put your enterprise out of business?” The truth is that any company can be put out of business. Generally the cause is something that could have been anticipated and prevented: One has but to look at Enron or Barings Bank. But attack by trained commandos is not high on the list of things with which one ought to be concerned: While physical assault may actually happen to some American company some day, it does not, for most of us, require a plan directly addressing the event. Rather, it will be covered by your other plans.
If you are prepared to lose a plant in an earthquake you are probably prepared to deal with the aftermath of an assault. But if you haven’t asked what can put you out of business, and haven’t come up with some valid answers, and found a range of solutions that will keep you from being put out of business, you have a potential problem.