Duty of care and security risk management: the framework

1Why security is a leadership function

Every year, hundreds of aid workers are killed, injured or kidnapped; the vast majority are national staff. Public databases on aid worker security show that violence is concentrated in a small number of contexts, but that no organisation working in a crisis zone is immune.

Security is not first and foremost about guards and walls. It is a leadership function that makes it possible to reach people in need while keeping risks to staff at an acceptable level. An organisation that manages its risks poorly loses its access, its teams, its funding and sometimes its reputation.

The aim of security risk management: to enable sustainable access to populations, not to eliminate all risk. The only way to eliminate all risk is to do nothing.

2Duty of care

Duty of care is the legal and moral obligation of an organisation to take all reasonable measures to protect its staff from foreseeable harm. It extends, to varying degrees, to consultants, volunteers, visitors and partners.

In practice, it requires the organisation:

• to assess risks before exposing anyone;
• to inform staff clearly about risks (informed consent);
• to train and equip;
• to put in place proportionate measures (procedures, communications, insurance, psychosocial support);
• to respond to incidents and learn.

Court rulings in several countries have recognised the liability of humanitarian organisations that had not taken reasonable measures in the face of a known risk. Duty of care cannot be fully delegated: an organisation remains responsible even when it relies on a contractor or a shared mechanism.

It must be equitable: historically, national staff have received less training, equipment and evacuation options than international staff for an equal or higher risk. Current good practice requires this inequality to be addressed explicitly.

3The security risk management cycle

The most widely used framework in the sector (formalised notably by Humanitarian Practice Network Good Practice Review 8 and the guides of the Global Interagency Security Forum, GISF) follows a cycle:

• 1. Context analysis: actors, dynamics, trends in violence.
• 2. Risk assessment: threats, vulnerabilities, likelihood, impact.
• 3. Choice of strategies and measures: acceptance, protection, deterrence.
• 4. Plans and procedures: security plan, standard operating procedures, contingency plans.
• 5. Implementation: training, equipment, budget, responsibilities.
• 6. Monitoring, incidents and review: reporting, analysis, regular updating.

The cycle runs continuously: any significant change in the context (elections, military offensive, serious incident) triggers a review, without waiting for the scheduled date.

4Acceptance, protection, deterrence

Three strategies are combined, in a mix specific to each context:

• Acceptance: obtaining the consent of communities, authorities and parties to the conflict for the organisation's presence and activities, through relevant programmes, respect for principles, dialogue and staff behaviour. It is the core strategy of humanitarian organisations.
• Protection: reducing vulnerability through measures and equipment (movement procedures, walls, unarmed guards, communications, suitable vehicles, shelters). It protects but can distance the organisation from communities ("bunkerisation").
• Deterrence: posing a counter-threat to deter aggression (armed guards, armed escorts, conditional suspension of activities). It is reserved for exceptional cases because it can compromise neutrality and acceptance.

Example. In an area where the organisation is well accepted but urban crime is high, the typical combination is: acceptance in the communities served, reinforced protection of residences and movements in town (no walking at night, locked vehicles), and suspension of activities as a deterrence lever in the event of a targeted attack.

5The acceptable risk threshold and programme criticality

All exposure must be justified by the value of the programme. The higher the risk, the more critical the activity must be for people (saving lives) and the more the organisation must genuinely have the means to manage it.

Programme criticality tools (for example the United Nations framework) rank activities from the most critical (immediate life-saving activity, or one directed by the Secretary-General) to the least critical. A low-criticality activity does not justify a high risk; a life-saving activity can justify a high risk, but not an unacceptable risk.

Decision example. A three-day project management training course in a city where the risk of kidnapping is assessed as high can be moved or delivered online. A vaccination campaign against an epidemic in the same city can be maintained with reinforced measures, because the life-saving benefit justifies a higher residual risk, within the limit set by senior management.

The acceptable risk threshold is set by the organisation's senior management, in writing, and not by the bravest team in the field.

6Roles and responsibilities

Security is everyone's business, but responsibilities must be clear:

• Board and executive management: security policy, acceptable risk threshold, resources, oversight of serious incidents.
• Country director: responsible for security in the country; this is a leadership role that cannot be fully delegated to the security adviser.
• Security manager or adviser: analysis, advice, procedures, training, incident follow-up.
• Security focal points in field bases.
• Every staff member: follow procedures, report, behave in a way that protects acceptance, and say no to a mission judged too dangerous.

The right to withdraw: anyone may refuse to go to a location or may leave a location if they consider the risk too high, without sanction. Conversely, management can prohibit a trip even if the person volunteers.