Organisational risk and security management

1Organisational risk management

The ISO 31000 standard defines risk as the effect of uncertainty on objectives. A humanitarian organisation faces risks of several kinds: security, fiduciary (fraud, corruption, diversion), legal and compliance (sanctions, labour law, data protection), operational (access, supply disruption), reputational, ethical (abuse, breach of principles) and financial (exchange rates, cash flow, donor dependence).

The risk register describes each risk (cause, event, consequence), its likelihood and impact (often on a scale of 1 to 5), the existing measures, the residual risk, the owner and the review date. The risk level is often calculated as likelihood × impact: a risk with likelihood 4 and impact 5 scores 20 out of 25, above an escalation threshold set, for example, at 15.

Risk appetite, approved by the board, states which risks the organisation accepts in order to fulfil its mission. A medical NGO may accept a high security risk to provide care in a conflict zone, but accept no risk at all of tolerating sexual exploitation. Without a formal risk appetite, every decision depends on the personality of the director in post.

Risk transfer to local partners is a drift denounced by many studies: the international NGO stays sheltered while its partner carries the danger without means. Risk sharing means funding partners' security, sharing information and deciding together what is acceptable.

2Security risk analysis

Security risk management follows a cycle: context analysis (actors, conflict dynamics, crime, perception of the organisation), threat identification (kidnapping, armed attack, road robbery, explosive devices, sexual violence, arbitrary detention, civil unrest, natural disasters, disease), analysis of vulnerabilities and capacities, then risk assessment and choice of measures.

A teaching formula sums up the logic: risk = threat × vulnerability / capacities. You almost never control the threat; you act on vulnerability (exposure, profile, predictable routines) and on capacities (training, communications, procedures, network).

The acceptable risk threshold is decided by weighing residual risk against programme criticality: the more an activity saves lives, the higher the risk that can be accepted, with reinforced measures. The UN system's Programme Criticality framework and the approach of the Global Interagency Security Forum (GISF) formalise this reasoning.

Information sources must be cross-checked: network of local contacts, NGO security forums and security advisory organisations, UN agencies, local media, public conflict data (for example the Uppsala Conflict Data Program, UCDP). Sensitive information received from partners or third parties is not passed on without their consent.

3Strategies: acceptance, protection, deterrence

The security triangle distinguishes three complementary strategies:

• Acceptance: reduce or remove the threat by obtaining the consent of actors (communities, authorities, armed groups) through quality, perceived impartiality, transparency and dialogue. It is the preferred strategy of NGOs, but it is built over time and can collapse quickly if an actor judges the organisation to be partial.
• Protection: reduce vulnerability through physical and procedural measures (walls, guards, suitable vehicles, movement procedures, hibernation, reduced visibility).
• Deterrence: pose a counter-threat (armed escorts, conditional withdrawal, political pressure). Armed escorts are in principle a last resort, governed by the IASC guidelines on the use of armed escorts, because they can compromise perceived neutrality and create new risks.

A country security plan includes: risk analysis, security levels and indicators for moving from one level to another, standard operating procedures (movements, communications, cash management, visitors), contingency plans (hibernation, relocation, evacuation) and a crisis organisation chart. It must be known, understood and tested through exercises, otherwise it is useless.

Trigger indicators: decide in advance which events move you from one level to another (for example two armed incidents less than 20 km from the base in one week). Without indicators, the decision to relocate often comes too late.

4Critical incident management

A critical incident (kidnapping, death, serious assault, attack on an office, disappearance) exceeds normal management capacity. It is managed by a crisis management team at headquarters or regional level, separate from the team on the ground, with roles defined in advance: crisis lead, family liaison, communication, security, legal and insurance, human resources, psychological support.

Principles for the first hours: secure the people still exposed, verify the facts, activate the crisis cell, keep a log of all decisions and information in chronological order, control communication (no public statements or social media posts by staff, a single spokesperson), inform the family before any other audience, and coordinate with the authorities and other organisations.

In the event of a kidnapping, organisations rely on specialists and on their insurance; policies vary on paying ransoms, which several states prohibit or strongly discourage and which in some cases breaches sanctions regimes. The organisation's policy must be clear before the incident, not improvised during it.

After the incident: psychological support for the people affected and the team, a no-blame lessons-learned review, an update of the risk analysis and, where necessary, a review of the presence in the area.

5Business continuity and reputation

Business continuity prepares the organisation to keep its essential functions running despite a disruption: loss of an office, communications or banking cut, epidemic, cyberattack, suspension of registration. The plan identifies critical functions (payroll, payments to beneficiaries, life-saving supplies, communication with donors), their maximum acceptable interruption time, and fallback solutions (off-site backups, alternative bank accounts, signature delegations, remote management).

Remote management (programmes run by national teams or partners when senior staff can no longer access the area) requires particular attention: real transfer of security resources, third-party monitoring systems, verification calls to beneficiaries, and vigilance not to transfer the risk without transferring the means.

Reputational risk often stems from other risks: an abuse scandal, a concealed fraud or a badly managed incident cost far more than their direct losses. The best protection is transparency: inform donors and, where appropriate, the public, factually and quickly, showing the measures taken.

Cybersecurity and data protection are now major risks: two-factor authentication, backups, updates, anti-phishing training, and encryption of sensitive beneficiary data.