For Security Integrators, There’s Value in Risk

Enterprise security risk management (ESRM) is a strategic approach to security management that ties an organization’s security practice to its overall strategy using globally established and accepted risk management principles. ASIS International began incorporating ESRM as a global strategy for security executives in 2017, and a resulting ESRM Guideline was published in 2019.

ESRM is a heady concept that requires study for security executives to become proficient; however, using ESRM can also be vitally important to security integrators who are working with these “prospects” – often a Chief Security Officer, security manager or their designated representative.

I often ask enterprise integrators how they are marketing their products and services. I ask if they are content with current sales levels, number of clients and profit; and how long the sales cycle is for a new client.

Most importantly, I ask them what problems they are solving for their customers. In the context of security, selling is about solving customer problems and creating value. Enterprise integrators should be working with a goal of genuinely creating value with their solutions. They should understand a customer’s issues or concerns as their marketplace evolves, their risk changes, and their needs change.

This is where ESRM comes into play, as it can provide the framework for integrators to focus their solutions on problem-solving and creating value; thus, creating a successful path to being a trusted advisor and an ongoing business relationship.

The ESRM Lifecycle

There are four steps to the ESRM lifecycle:

• Step One – Identify and prioritize assets: The process of identifying, understanding and prioritizing the enterprise’s resources, which can be people, intellectual property, manufacturing facilities, critical equipment, research, and more.
• Step Two – Identify and prioritize risks: Identify, understand and prioritize the risks to the enterprise and their relationships to the value of the assets. Risks can be human-made, for example, crime, terrorism and civil unrest; technological, such as an industrial accident; or natural, such as pandemics.
• Step Three – Mitigate the prioritized risks: Take necessary, appropriate and realistic steps to protect against the most severe threats and risks.
• Step Four – Continuous improvement: Managing risks requires a cyclical approach to continuously improving and advancing the enterprise’s risk posture.

In this context, integrators and consultants solve a client’s problems by aligning risk, threat, vulnerability, and consequence with mitigations, thereby eliminating or minimizing risk, consequences, and their impact on the Enterprise.

For every identified risk, there is a vulnerability, consequence, impact, and mitigation. Post-implementation, the client benefits from the value gained in reducing risk and ensuring the Enterprise’s strategy is successful.

Finding the Value in ESRM

To gain a better understanding of where the value resides, take a closer look at consequence and impact. Consequences are the terrible things that happen if a threat is successful, and the impact is the effect of consequence on the enterprise. Of course, there are many different consequences resulting from crime, terrorism, natural disasters and accidental hazards; however, most impacts fall into one of four primary buckets:  

• People: Loss of life, injury, and loss of expertise.
• Finances: Impacts the enterprise’s financial health. If the economic impact is significant enough, the enterprise will cease to exist.
• Reputational: These impacts can have a significant financial effect, as customers may seek services elsewhere.
• Equipment: Impact to critical equipment and processes, the loss of which could be devastating to the enterprise.

The value of ESRM resides in understanding the cost of impact and the total cost of ownership. Case in point: A large warehouse loses $500K a year in shrinkage due to criminal activity. The integrator recommends mitigating the shrink with a $150K physical security system. If the system has an eight-year life, the enterprise will realize a net revenue increase of $3.85 million. In this case, the physical security system is a good investment that makes business sense. No selling is needed.

Thus, armed with the needed information to facilitate value-based decisions, integrators can make a complicated sale look like a “no-brainer.” Finding this information is obviously paramount, and to do it, integrators should refer back to the first two steps of the ESRM lifecycle (identifying and prioritizing assets and risk).

The Backbone: A Risk Assessment

The ANSI/ASIS/RIM Risk Assessment Standard defines risk assessment as “the identification, analysis, and evaluation of uncertainties to objectives and outcomes. It provides a comparison between the desired/undesired outcomes and expected rewards/losses of organizational objectives. The risk assessment analyzes whether the uncertainty is within acceptable boundaries and within the organization’s capacity to manage risk.”

As an enterprise security integrator, you should not be developing solutions or making technology recommendations without understanding the client and their particular problems. Risk, Threat and Vulnerability Assessments are often misunderstood, and therefore misapplied. Risk assessment is not merely identifying risks and calculating a risk level; instead, it should be an entry point for identifying and quantifying all enterprise risks. Further, it is a process of continuous improvement which ensures the accomplishment of the enterprise strategy.

From an integrator’s perspective, you can train an in-house person or engage a reputable consultant to assist with a risk assessment. Once you know and understand the risks and their impacts on the enterprise, it facilitates exceptional decision-making from a business perspective as well as technology-based mitigations that address the client’s strategic risk.