Exercise Evaluation | Risk
The Security Red Flag Hiding in Plain Sight
If you’ve conducted security assessments for your organization, this may have happened to you. You’re assessing a site, and right in the middle of the interview it starts occurring to you that something isn’t quite right here. Either the site isn’t as secure as it claims to be, or it isn’t as secure as your organization thinks.
How can you quickly tell you’re dealing with a high-risk risk without going through the entire assessment process first?
When I was a security consultant, and I got an inkling that something was wrong, I’d ask for a tour of the facility. Then I’d check the fire extinguishers. The inspection dates usually told me everything I needed to know.
When the fire extinguishers haven’t been inspected in more than a month, the site is almost always high-risk.
Why is it so important to check the fire extinguishers?
Fire extinguishers should be visually inspected monthly, and undergo a full maintenance inspection once a year. These are common, routine inspections, required by both the Occupational Safety and Health Administration (OSHA) and the fire codes.
Because it's such a basic inspection, when monthly fire extinguisher checks are neglected, it’s often a sign that the site is unprepared for emergencies in other areas.
Fire extinguisher checks are neglected in more organizations than you’d think. I’ve run across uninspected extinguishers in all kinds of businesses, including major scientific labs, and it’s always been a signal that the sites’ other security measures need to be examined in detail.
In fact, sometimes it’s a signal that the entire organization needs to be examined more carefully.
The extinguishers haven’t been inspected. What next?
Uninspected fire extinguishers are a sign of a process problem: either there is no process governing fire extinguishers, or the process has broken down at this site.
Your next step as a security professional should be to ask questions about the site’s organization’s procedures and processes, going into as much detail as possible. For example, it’s important to find out who owns — or is supposed to own — that procedure and other security procedures at the site.
Then it’s time to review the organization's own policies and processes regarding fire extinguishers and other controls.
It’s possible that your security team has been so busy responding to risk that you haven’t been able to be proactive, but it’s important to set up processes – like inspections — that will allow you to quickly and safely respond to emergencies when they occur. If your security organization has been more reactive than proactive, it may be a good idea to bring in an outside consultant who will help you prioritize processes and procedures.
The best way to determine the risk level of your sites
While uninspected fire extinguishers are a powerful indicator of a high-risk site, there’s only one foolproof way to determine the risk level of any site or organization. A properly-performed risk assessment tells you the exact level of risk at all of your sites, taking both probability and severity into account.
It used to be that risk analysis could only be done by a security consultant or an internal expert, but security risk assessment software has changed that.
Efficient security risk assessment software now makes it simple for you to design a risk assessment capable of collecting risk data from all your sites, and presents that data in a dashboard so you can see — at a glance — which threats are most likely and what you need to do in order to mitigate those threats. Circadian Risk, for example, presents threat data as an actionable list, so that your team can take steps to reduce the risk of likely risks as soon as possible — starting with getting those fire extinguishers inspected.
Ready to take control of your organization’s risk?
Contact our experts today to learn how Circadian Risk can simplify and strengthen your security.
About the Author
