Security leaders gathered in London recently to discuss risk in a time of increasing volatility and uncertainty.
A global pandemic, wars in Ukraine and the Middle East; and in the UK, a cost-of-living crisis that continues to chip away at society’s stretched budgets. The acronym VUCA (volatility, uncertainty, complexity and ambiguity) seems apt in 2024.
It was the core topic of discussion as security professionals representing sectors including technology, retail and transport met at SHP’s sister site, IFSEC Insider’s head office in April.
The group shared challenges and solutions as the profession pivots against societal, financial and global changes as they look at new ways to protect their disparate workforce.
Covid-19 has had a far-reaching impact none more so than on people’s working patterns. Nearly five years on from the pandemic, hybrid working has warped the old Monday to Friday; nine-to-five structure and left a very different commuting framework.
In turn, employees’ new expectations around flexibility are skewing boundaries of what constitutes employee welfare and where an employer’s duty of care stops.
For Matt Hall, Associate Director, Health and Safety at Imperial College Healthcare NHS, these boundaries are clear when staff are in transit between shifts, but they become blurred when they are working from home.
“We have to give guidance to our staff which includes not wearing NHS identifiers on their commute,” he explained, highlighting the dangers that his staff face while travelling outside of work. While this advice is welcomed, there is no official responsibility that extends to protect staff on their commute despite people experiencing incidents of abuse, aggression and violence.
He continues, “What responsibility do we have in your home? What control do we want? What [technology solutions] should we have in your home because some of the safety solutions are seen as monitoring, and that’s the balance and the challenge.”
“It’s about balancing that duty of care and balancing the duty of responsibility which comes back to the cultural awareness.”
The group unpacked the issues around remote working and the security of equipment now being taken home. How can you instigate a culture of safety awareness when contact is limited and interaction is via video conferencing?
“I don’t think one-size-fits-all,” said one delegate, “it’s about balancing that duty of care and balancing the duty of responsibility which comes back to the cultural awareness. If you can get [staff] to think about the risk environment, then they can start mitigating the risk.”
They suggested an approach that incorporated internal stakeholders while taking a long view of the legal position. “You have to think about the legislation in its broader terms and bring in other aspects of your business and also your partners within the business such as health and safety.”
The boundary is further stretched when it comes to reporting incidents. Those isolated in a remote working environment is one nuance of the issue, the other is those in a public-facing environment such as retail or the transport sector. In 2024, and to reference VUCA, both sectors are facing an increased threat from a public less tolerant than they might have been five years ago; pre-pandemic and pre-cost of living crisis.
While incidents rise, studies have revealed one in four retail workers fail to report them when they do occur as they feel the process is futile. To counter this the group affirmed that employees should feel empowered that their issues will be addressed.
One silver bullet was to do away with cumbersome administrative processes and replace them with automated technology that can capture an incident quickly. “If [employees] think there’s a lot of paperwork and administrative burden involved, they won’t report,” said Mark Ryder, Chief Commercial Officer at Peoplesafe. “Reporting is about making it easy to use tech and giving the employee things that make their life easier. Take away some of the administrative burden from that situation.”
Sara Spence, Health and Safety Manager at Save the Children, looks after the charity’s network of UK shops. It’s a strand of retail perhaps vulnerable to theft, with aggression towards workers commonplace. Given the volunteer workforce there are also challenges around staff retention.
Previously Spence operated a rather piecemeal reporting system through emails, hard copy notes and phone calls. However, staff liked the system as it offered a human touch with workers wary of getting lost in a ticketing system, so when Spence introduced a new digital reporting platform, reaction was mixed.
The new triage approach filters incidents to a safeguarding team who allocate cases on a priority basis. A visual RAG scale is fed back to Spence who can make a proactive decision on action yet the process still includes a human touch point.
“People feel much more encouraged with the mixture of the online system,” she reflects, “It makes it easy for people to report it – they can do it on phones or laptops, and then follow-up with a conversation with a human.”
Alisa Sultmane is Head of Security and Emergency Planning at Keolis Docklands and oversees London’s Docklands Light Railway, a major artery of the capital’s commuting network connecting the city’s financial districts.
The network produces 99.6 million passenger journeys a year and again, employees are public-facing, with attacks and abuse towards staff common. To provide evidence when an incident occurs the workforce were issued with body cameras, yet staff were wary claiming the technology could encourage hostility.
When the cameras were eventually adopted (with support from Unions making them compulsory), some workers would not activate the recording facility, Sultmane told the group.
One attendee however made a case for the technology. “[This approach] can make a big difference,” they said, “because the behaviour is being shown back to the aggressor.” They pointed to a study in which a 47% reduction in assaults was achieved through the use of front facing cameras.”
Yet, they were keen to point out that real adoption can only be achieved through a strong security or safety culture supported by constant communication. “When people don’t want to embrace [body worn cameras], then you need to come back to them with a story. These positive stories can be really powerful.”
Digital reporting mines data; insight that can highlight trends from a risk management perspective but also build a use-case to take to management when justifying extra resource.
“So yes, you want to empower staff. Yes, you want to help them, but equally, how do you use that data yourself as a risk manager to build the business case?”
Russell Pheasey, Director, EMEA regional security at global software company SAP, which employs nearly 100,000 workers, explained how the firm’s digital reporting system was built to scale from an enterprise risk management perspective, and he echoed Spence’s theory around the human touch.
“Up until five years ago, we didn’t really have a mechanism for people to report,” he said. “Now, we’ve got ticketing systems; we’ve got apps. I’ve got security operation centres where you can pick up the phone and have a conversation with someone about an incident rather than getting lost in a ticketing system. The essence is there is a ‘white glove’ approach.”
“But it’s also about decoding what that risk is as well. So yes, you want to empower staff. Yes, you want to help them, but equally, how do you use that data yourself as a risk manager to build the business case?”
“We’re positioning ourselves now as revenue enablers for the business rather than just a suck on resource.”
To illustrate his point, he explained how the company’s arm in Switzerland felt a security manager wasn’t needed due to a lack of tangible incidents.
However, Pheasey was able to pull data around laptop loss and put an actual monetary figure on the impact. “This is the loss of asset if we’re talking about one laptop, something around €1000,” he said. “But if I’m losing 20 laptops a year, that’s a significant sum to some people. It builds that narrative back into the business. We’re positioning ourselves now as revenue enablers for the business rather than just a suck on resource.”
Hannah Newman Asyl, Security Specialist at Cadent Gas told the group she compliments digital reporting and data gathering with an active working group that touches across the business including its engineers, office staff and management.
“We’ve got a good group set-up that we’ve split into four areas within the business that we’re looking to improve and it’s really worked. It’s good for getting out and speaking to people; it’s getting me known within the business as security. I can’t reach everybody in the business, and this way I can [get insight from everywhere].”
She went on to explain that the success of the initiative has created further sub-groups including a women in operations group that focuses on women’s safety as the firm hire more female engineers.
The past five years have seen unprecedented change impacting the way the world now works – risks have shifted and the profession is pivoting with them.
Security teams now have to consider a wider remit of challenges to safety because of hybrid working and the increasingly volatile environments we work in. Embracing new technologies, as the discussion uncovered, enables employers to improve reporting procedures and enhance staff safety.
Managing a dispersed workforce makes it difficult to know where everyone is working and that they are safe and well. Therefore, having systems in place to capture data becomes vital to make proactive changes and put forward business cases for additional resource where needed.
Technology will play a role as will human input, but ultimately businesses will continue to look at their bottom line. As many of these industries struggle to retain disillusioned workers, in a VUCA world, getting a security culture right can be viewed as an investment to growth. Having a continuity of staff who feel safe going to work and at work will contribute to safeguard the bottom line and actively support business growth. What employers need to focus on is protecting that most important asset, the workforce
