Roads to Resilience

quickly communicated to senior managers. Risk radar helps an organisation identify risks earlier and communicate these to senior managers who can then take the necessary steps to respond rapidly in a controlled and considered manner. The boxed extract from the InterContinental Hotels Group (IHG) case study illustrates the importance of risk radar as a principle that supports the delivery of the customer experience. It shows the value of constant vigilance and the avoidance of complacency based on routine threat and vulnerability assessments (TVA). The IHG case study demonstrates that, when risk radar is well established, an accurate TVA can be undertaken and necessary responses identified and implemented. The same approach is also taken by IHG to the risks associated with the tactical and strategic aspects of the business. The TVA was the starting point for a renewed risk analysis and two IHG security experts immediately flew to Lebanon. Both had a military background, like many in the IHG security community, and they checked for any obvious security vulnerabilities of the hotel. The pair knew that “ even with the limited intelligence provided by the source we needed to act. Our first job was to decide how the hotel might be attacked, when and by whom. Our second job was to design ‘bespoke mitigation’ – ways to prevent an attack – and get them quickly implemented ” (Head of Security Risk Management). In visiting the hotel, the two security experts observed how the hotel functioned on a typical day, with an eye for what terrorists would be looking for. Quickly, it emerged that regular deliveries meant that delivery vans were often parking close to one of the hotel towers. Immediately, this risk was mitigated by having the deliveries rescheduled and re-routed, to reduce the risk that a delivery van could be high-jacked and used in an attack. Measures were also taken to prevent other possible ways of attacking the building. The security improvements were made quickly and so it became harder for the terror cell to plan its attack. Shortly afterwards, members of the terror cell were captured by the local authorities. It emerged that their main plan had indeed been to substitute a delivery van and fill it with explosives, but because of the IHG security experts’ mitigation measures, this became unviable and the attack was delayed. For more insights into resilience at IHG, refer to the full case study in Appendix A

AIG uses what it calls a Vulnerability Identification Process (VIP). This is a regular survey of thousands of employees to gain their candid views on the risks the organisation faces. Part of the constant questioning is being aware that the initial indications of an emerging problem or incident will be hard to spot. These can be termed ‘weak signals’ and represent indications that are missed or ignored by many organisations. Questioning conducted by different functions also helps develop better understanding of how to respond to and, if appropriate, take advantage of these ‘weak signals’. Rather than relying on individuals or the risk management department alone, resilient organisations involve all of their employees in identifying risks. Employees are encouraged to be vigilant, avoid complacency and constantly question what they see. When risk information is generated, it is Guests expect to be safe and secure in IHG hotels, wherever they are, this includes in high-risk places where security is more challenging. However, IHG has developed an approach and a security network to mitigate such risks. The approach starts with a TVA – Threat and Vulnerability Assessment – something that every IHG hotel operating in high ambient threat locations will conduct. However, in locations where the political situation poses more risks, the security network that IHG has created plays an essential role. The security network is key to IHG’s approach to security across the estate in all areas and threat environments. The network consists of all of the security managers at IHG hotels, who report anything out of the ordinary in ‘Security Intelligence Reports’. These feed through to the Global Risk Management Department, which analyses the information, seeks additional information from other sources, identifies trends and decides on actions. The IHG Risk Management and security community also has strong contacts with a wide variety of sources including government agencies around the globe. Such sources give warnings about possible terrorist and criminal activity and this was the case in a Beirut hotel a few years ago: “ A well-placed source told us they believed that terrorists in Lebanon were planning an attack on the IHG branded hotel in Beirut. We were given further details and are used to dealing with such information: we must use any intelligence we get and make decisions based on that to mitigate the threat to the hotel, its guests, staff and visitors ” (Head of Security Risk Management). So the security team was set into action immediately.

Case study: IHG – Threat and Vulnerability Assessment (TVA)

27

Roads to Resilience: Building dynamic approaches to risk to achieve future success