Good morning, welcome back. The penultimate training on the introductory course measuring and prioritizing the threats. So I've gone over this in some detail, but not in a systematic way. So when we look at the threats I've mentioned, how we measure them, I've mentioned about prioritizing them. This goes into a little bit more detail. And this is very important, because, as I said about the threats, the threats is the start point for all your security model.

So if you do it every week, then you have to re identify the threats, re measure them, and reprioritize them. They may well be week after week, pretty much the same. But there's that one time when criminal trends start to go up or the potential terrorist attack starts to go up. That's where you're doing your job. And at that point, you can start Changing the procedures of your staff, you can start building up your security mitigation. So that's the that's the important part of it.

Get your baseline at the right at the very start, understand where the threats are, how you measure them, we're going to cover that. But it's when you do it again and again. And again, don't just do it and forget about it. It's not a fire and forget weapon. It's the threats and the threats will change because criminals adapt, terrorists adapt. earthquakes happen when you least expect them.

All those threats can change over time, anything political can change over a weekend, or even quicker. So that's why it's very important to understand the threats and how to measure them and prioritize them. So we've looked at measuring them. In the previous section, we looked at a list of around about 22. I say maybe 22 on the slide there because, as I've said before, it varies from country to country, city to city, even neighborhood to neighborhood, you know, as well as I do that, any time Any city you have got good neighborhoods and not so good neighborhoods. So the threat level in one neighborhood, even one street, even one house in that neighborhood if you've got a particularly bad family living there can be higher than just around the corner.

Which is why we do this and it's an I suppose it's not just cyclical, it is not just something you do every day or do every week or once every six months. You do it when something changes as well. So if you're halfway through the review period, if you're three months in and you're you don't review for another three months, but something significant changes, that should be a trigger to relook at the threats because the change in one threat political for instance, may increase the potential somewhere else like conflict, crime. You know, if more and more people are going and becoming unemployed, they start to get desperate crime levels go up. So the trigger for one thing Could be a trigger to change lots of other different threats. And obviously, depending what it is.

So I've looked at the table below this. And then let's get going in a couple of seconds. So I've just said that depends upon your country or your area of interest. If it's a town and maybe the road between your town and the next town, it will vary depending on your operational scope. I What, what is your organization doing? Are they going out and doing humanitarian work on the border lines of some really rough places or other just in the city doing business?

You know, both both comes with their inherent risks, but some will be more than others. So you have to understand what your operational scope is and your your project profile. And use as baseline and grow your own guidelines and that's what you've got to do. You've got to take this out. The baseline and from there, you're going to start growing out your guidelines, your policies, your procedures, your recipes, based on what you do, and what the threats are. So here's the table I looked at.

So this is you would add this to a report, for instance. So you've done your 22 threats, you've measured them, you prioritize them, this would be the key. So this is something you could put at the end of the report, or the annex, and at the executive summary, you would say, refer to Annex A, for the key to the threat threat measurement guidelines. And this is, this is uh, this is basic, so this is generic because what I'm trying to say, and so we've got a one to five level here, so it's the usual one is very low blue and it says the type of likelihood. So the likelihood of this type of incident adversely affecting project activity is almost negligible at almost at to zero, so between zero and 20% of something, eventually happening to your project staff, your assets, project or business continuity in your reputation.

Any one of those can adversely affect your project your business. So all those potential threats arrayed against your staff, your assets, business continuity and your reputation, and each one of those will have a different profile. So it's done become a little bit more complex, which is why you need this baseline. Look at the threats to is moderate green. We've seen that before. And we're about 20 to 40% likelihood of this type of incident adversely affecting project activity.

So the incidents not expected to increase over the foreseeable future so it's relatively stable, or adversely impact baseline project took Objectives. So there may be stuff going on out there, it may happen 20 to 40% of the time or once every two weeks, pretty low levels, and it doesn't look as though it's going to adversely impact project objectives, as long as the baseline safety and security standards are maintained, and that's what it's saying they're just here is not adversely impact, baseline project objectives if safety and security standards are maintained. So what you're saying there is, as long as people do what they've been instructed to do, as far as the safety and security guidelines or policies and procedures, then things should be okay. They need to take care of themselves. Remember, safety is safety. Security is not just the safety managers, security managers responsibility is everyone's always an apparent increase in safety.

Security threat level so something could go up. But in the moment, everything looks stable. That's what a moderate is very low as you're on Iceland and things are pretty good at the moment. There's hardly any crime The only criminal on Yahoo has been locked up and we're happy for the moment. There's always going to be changes. And but at the moment, things are looking good for the foreseeable future, foreseeable future could be a week, two weeks time, it depends what your standards are, I tend to say okay, I can sort of detect, assess, make an assessment on what's going to happen over the next week or so.

But after that, it gets more and more hazy and the possibility of something happening that you're just not aware of or you or is geopolitical. It comes from some other country and it's politically based, becomes a lot wider so that funnel of probability extends out the further in time you you try and look it's impossible to assess and you know, If you look at the intelligence analysis course I do. And they would say that intelligence is generally right, or assessments and analysis generally right about 50% of the time. So if someone says was, tell me about the threat level on this road between A and B, next month, you might as well just toss a coin. And he says, good, not good. You've got the same sort of hit rate.

But you've also got your training, your experience, your understanding of the situation, your understanding of your project or business profile. And when you throw that in the mix, if if for instance, staff are working well to the rules and regulations, and they look after themselves and they report him when they're supposed to report in to take the right kit with them. They're trained, they're briefed, then obviously, the risk may go up the level may go up, but the risk may stay the same because you've you've trained them and super train them. to look after themselves and not take care of ridiculous chances. So there's lots of variations in this medium three yellow, that's on average 40 to 60% of the time, something's going to happen. So we're looking at medium, what countries we got there, Brazil, Turkey, Tunisia, Uganda.

So on a day to day basis, these countries as examples, are relatively peaceful. They've got good police forces, on the whole things are stable. And there is high crime in some areas, there is the potential for demonstrations in other other places due to what certain triggers. Bubbles a little bit, but not much. So there's some heightened threats, whatever they be, I mean, let's take Tunisia, there's the potential for a terrorist attack in Tunisia. And the further south you go, there's different threats bubbling away.

And there's some high unemployment in certain towns, which has increased the crime levels. And, and you could say that about a lot of these large countries so the profile is generally stable. But you'll need additional physical and procedural measures. So you need to take a little bit more care of your staff your assets, business continuity, new reputation, because something could happen. Threat assessments should be looked at every month or less. headquarters local crisis management plans review the practice yearly.

Okay. So things are relatively stable in the medium country that to Buffett, you have to keep an eye on it but it's on a day to day basis fine. And then you go into high orange. And again, these colors are you can make them whatever you want. These are just these seem to be industry standard at the moment. At the same with the the sort of high explanation and the numbering.

And like I've said previously, you can have 123 it doesn't make any difference if, if you think it's going to make it easier for putting these tables together, that's great. But the one to five allows you to break it down a little bit more so you can have more explanation about the threats, more explanation about the security measures, a little bit more accurate. I think 125 is, but 123 if you've got a small project and you're not doing much outside the local town, then what three should be fine. And same sort of explanation. 60 sorry, 60 to 80%. So now was sunny get busy.

Now there are particular threats against safety and security staff assets, project continuity and reputation. Some instance maybe particularly target against Western organizations, assuming of course that you're working for Western organization and safety, security. Levels should be ready for implementation at a moment's notice. So you have to be very quick. You have to react very quickly. So this is almost like a day to day basis where things could happen.

Kenya, South Sudan, Venezuela, and bearing in mind that these have potentially changed overnight. So don't go checking them or find the wrong. It's just that they were examples of songwriting. And this is the big one extreme, it's going to take up your attention 1216 hours a day, every day of the week, something 80 to 100% something's gonna have on almost daily basis, a serious event, challenging safety, security of staff, etc. is nearly certain to occur in this country. And I would say that's on a daily basis.

So this is of course your Afghanistan, Iraq, Libya, Syria and Yemen. Bombs bullets are happening somewhere around the country. Every single Good day, and where your staff are located almost certainly every day or every other day potentially. It depends where you are, of course. And so all safety and security mitigation measures should be well developed, you should have high standards of safety measures, plans slps threat assessments reviewed daily, okay, daily. So you need to have good sources of security information, you need to have them trusted, and you need to respond and react to them quickly.

So if the embassy sends out a message saying, there's a bomb out there, it's going to target a Western organization. You need shut the doors and make sure you staff are heading home. You need to take it seriously because the threat is extremely serious. And if you're working in countries like this, then it's a it's a day to day business. So these are the keys on sort of generic x explanations about the threat levels and that's how you You measure them. So you would tell you a threat.

In fact, let's go back, you would take your threat of terrorist attack, and go, all right, wherever you are in the world terrorist attack. In the past, we've had some shootings against the police, some bumped against the police. And they happen maybe once every four months. So is it extreme? No, let's not target against you. It's not a daily occurrence.

Is it happening 60 to 80% of the time? No. So I would say you know, the threat level for terrorism in that that sort of example is routed by media. You got to take it seriously. It's got to be a medium or above. Because you don't want your people driving through areas where there's going to be a shooting so you have to give them extra training briefing, prepare them, but it's not 60 to 80% of the time, it's not 100% of the time, they're not directly targeting new potential.

It's not like Afghanistan, Syria, Yemen. So there's your There's your sort of look at how you would make an assessment. So road traffic accident. Let's go back again. road traffic accidents we've already discussed. And I mentioned 100 times that it's probably the top of your list or it should be it's the top of every country's list around work.

So therefore is is the likely at very low. I would say no, unless you don't drive unless your company doesn't drive anywhere. It's just they come to work in the morning. They sit their laptops, their computers, go going evening, you know, so before they get to work, they're their responsibility at work. They're your responsibility. Once they go home.

They're their responsibility. If there's no absolutely no movement, no meetings, no humanitarian aid to the borders, then all right, it could be a pretty low risk but the time to see you gets in a car to go to a meeting somewhere, then the risk level goes up. And whoever you use to drive and whatever vehicle you use to take him there has to fit within or should fit within certain standard. So Road Traffic exit for a normal company with movement around countries, again, depends where you are. But bear in mind that Afghanistan, you're still at more risk in a road traffic accident than you are from a terrorist bomb. I would say it's up that the likelihood of the type of incident so road traffic accident adversely affected the project activity is around about 60 to 80%.

So it could be high. Yep, definitely. The roads are crap around here. The drivers are worse. Definitely during the monsoon season, it's going to be extreme. So we have to take lots of procedures about when staff get in a car and travel from town a to town B.

We have to be very careful. They have to be prepared. We have to be ready that something is likely to happen. After monsoon season, you might drop the threat level down too high. As long as your staff are wearing seatbelts, you drivers are driving within the speed limits. And they've been trained or at the very least sort of briefed how to drive properly and told if they don't drive properly, and there's complaints, there'll be out of a job.

You have to be firm with drivers because because they're in charge of people's lives. So you measure it. And then of course, on your risk matrix, you look at the impact, what is the impact of that road traffic accident. And that's something you have to measure on the risk management matrix. So there are many, many complex ways of doing this. The by far the easiest way is just having a spreadsheet and work it out using your experience.

And choosing and all these using what's happened isn't what you think's gonna happen, your company profile, all that sort of stuff. And just going it's high or extreme. If if you're putting a threat level up from high to extreme, and you need more funding for extra guards, for instance, then you have to back that up. If it's, if it's a day to day basis basis, and it's just you and you're just going to implement a couple of extra procedures for the drivers and the traveling stuff, then that's not so much of a challenge, you have to justify to yourself be done enough to justify it necessarily to your bosses. But if you go and ask him for additional funds, a larger budget, then you do have to justify it and you have to back it up using you know, reports that you've seen online or information.

You may get it from the local police, some local police forces are happy to give you crime rates. If you can trust them, then that's that's a good way or maybe report on the increase of terrorism in your areas of interest. That's justification to change procedures to maybe but Bolton some additional security. So they can be complex. But the my guideline is my advice is keep it simple. And then make it complex if you have to make it complex to justify to your boss for extra money.

Working on threats, I've got the threat list, add in take away use little subsections. Again, make it simple. Some sometimes the threats won't be there some some parts of the year and monsoons, cattle rustling all that stuff won't be there. So leave them on there so you don't forget about it. Just give it a zero. Go back to threat list and give each element the threat level based on your criteria.

Yep. So it's a one or a 54432 Based on that criteria, so where does it fit in the criteria? Now I've got some countries that aren't quite a medium, they're a bit high on the medium, but they're not quite as high threat. So they don't need the full spectrum security required for a high threat. So I sometimes give a three plus, and that means I take extra care when people are traveling to that country. I pay attention to them, I get to check in on daily basis, but I don't have to implement a whole host of security measures because a they're only there for a temporary period of time, maybe a week, two weeks maximum, and B. I'm not 100% sure that I'm moving that up to a high it's not quite as high doesn't quite fit the criteria, but it's a little bit more than a medium.

So you can you can pretty much do what you want with this. And I'm not saying fill the books I'm not saying make it a high so you can ask for more cash or make it medium So it it instead of a high, so you do less work. I'm saying, Be honest with it. If it's not a three and it's not a four, but somewhere, then three plus or 3.5, call it whatever you want. It's your work at the end of the day, these are just the guidelines and go back to your threat list and assess the likelihood is going to happen. Is it going to happen on a daily basis such as Afghanistan?

Yes. Somewhere in Afghanistan, there's going to be a bomb or shooting at least once a day. Is it going to affect you guys know, so it's not going to be 100% of the time, but it's very, very likely. So you have to say to yourself, is a terrorist attack? Likely? Yes.

Is it directed against you? Probably not. Is it indirect but in the general neighborhood, could there be people passing by in a car? Yes, definitely. Okay. So it's it's a high threat, but luckily enough it's Luckily for us, not direct.

So we In this, measuring and prioritizing your list who's in the car. And remember, I added all the this column up. That's what this this line is for, added all that up divided by the number of sections, which was 22, if I recall, rightly, and it came to 3.8, which is still medium between three and fours medium. So you could say it's over 3.5. So it's medium Plus, there needs to be additional training or preparation, certainly in these areas. But you can, if you really want to get complex with these things, you can add another column in putting like security measures and putting a number of to measure your security preparation and security measures in place that actually takes away from this column.

I know standing a little bit more complicated But the more you use it, the more you want to might want to play a play around with it and make it work the way you want it to work. So for instance, if you've got lots and tons of stuff in place about road traffic, and you're you're confident that your staff are doing as you ask them, as far as the poses and procedures goes, you could have security measures are at a five, there's nothing more we can actively do. And that can reduce the overall threat level. Because you're a threat, your threat is balanced out by somebody who security measures, there will always be a threat, they may only go down to three. But that's the justification for reducing your road traffic concerns the threat level is because your security measures you've got in place reduced quite considerably.

And that's that's another way of working. It takes a bit of time and effort to work that out. And I suggest that's a bit more advanced. So Start with this. But that's how we got to the average of 3.8. So that's a high medium.

And, and a lot of that is because you got lots of highs and quite a few extremes. Explain most of those just highlighted so you can see what it's about. Color coding is the same likelihood of it happening on a day to day basis. So that mean that average line is quite important. That's the that's the executive summary. So about every other day, something could happen.

So not daily, it's not Afghanistan as far as terrorism goes, but you know what, something on this list could happen sort of 50% of the time, and that's a good executive summary and that sort of thing your bosses would not be interested in knowing now the bottom man 22 years Yeah, this is where we relax. We don't have to worry about this too much. This may be outside your remit as far as security goes, but it's something you need to keep an eye on, you should be concerned about social media security, people leak information. You don't want people putting staff members putting information about traveling before they travel, it makes them vulnerable, it makes their homes vulnerable and makes your office vulnerable potentially depends on the circumstances. So that to my mind is social is a social security is a security concern. And you can brief staff up about that.

You can you can advise them what to do and what not to do. You can remind them that their phones can be tracked so when they put photos on Facebook, people get that photo off and see exactly where the photograph was taken. If so, you need to you need to ask them to be a bit more secure about their folks. And the social media input. So the frequency of doing this, I've mentioned this time and time again, so extreme, probably a daily thing. You know, you'll have your list your focus on your, you'll definitely focus on your most important criteria.

So whether it's terrorism, whether it's road traffic, that's where you'll be focusing most of your daily effort. High threat locations, may well be weekly. And again, this This all depends on your company profile, what you're doing. Your profile might change, if you're going to events, for instance, run by the US government, they might spike for a couple of weeks. So you have to look take them to account run monthly, for medium, moderate, every six weeks, low yearly. And these are just guidelines, remember?

And that's it. As far as the threats goes. got one more to do day to day activities, and that probably definitely covers reviewing your threat assessment. But this is very important. As I've said, this whole threat thing. So the all the lessons regarding the threat.

I've hammered home the same points in different slightly different ways and slightly different times. But it's all about the identification, the measurement and prioritization of the threat. Once you got that worked out, once you've got your little colors and your numbers and threats, measured and prioritized on a spreadsheet or a table, then that's your baseline. That's a ton of your work done. You just look at it every day and go, what's changing. What am I seeing on the internet?

What am I seeing on the news? What am I hearing from people that could make this change or that change, increase or decrease? So that's why it's important because it all impacts On your overall safety and security. Once again, thanks very much for your time. I'll be speaking to you next my day to day activities. Bye bye