Governance, security culture, business continuity and final project

1The security and risk management policy

The policy, adopted by the board, sets the framework that all countries and departments apply:

• principles (duty of care, acceptance, right to withdraw, equal treatment, no payments to parties to the conflict);
• risk appetite and thresholds by category;
• roles and responsibilities, from senior management to focal points;
• minimum requirements: risk assessment, security plan, training, incident reporting, crisis management;
• position on sensitive issues (armed escorts, armed guards, ransoms, communication in the event of a kidnapping);
• monitoring: reports, audits, reviews.

Minimum standards by risk level make the policy operational. Example: in any country classified as high risk, a dedicated security adviser, a plan reviewed every 6 months, advanced training for all exposed staff, an annual crisis exercise and satellite communications in every base.

2The role of the board and senior management

The board does not manage security day to day, but it bears ultimate responsibility for it:

• it adopts the policy and the risk appetite;
• it receives a regular report (at least annually, quarterly for major risks);
• it is informed without delay of serious incidents and crises;
• it checks that resources are sufficient and that audits are followed up.

Senior management reports using a simple dashboard: incidents by category and severity, rate per 100 staff, countries above the threshold, compliance with minimum standards (up-to-date plans, training, exercises), overdue recommendations, maturity.

Example of a reading. 12 countries; 10 have an up-to-date security plan (83%); 7 have held a crisis exercise during the year (58%); 3 countries have residual risks above the appetite. For these 3 countries, the board asks for an explicit decision: additional measures, reduced activities, or a reasoned, temporary acceptance of the overrun.

3Auditing security

Security audits (internal, peer or external) check that the system exists and works:

• documents: risk assessment, plan, procedures, contact lists, incident log;
• practices: check-in calls actually made, movement logbooks, visitor registers, radio tests;
• knowledge: interviews with staff (do they know the plan, the security level, the procedure in the event of an incident?);
• equipment: condition of vehicles, communications, kits, hibernation stocks;
• equity: real measures for national staff and partners.

Sample example. The auditor interviews 30 staff: 27 know the current security level (90%), 18 know what to do if a colleague misses a check-in call (60%), 9 have taken part in an exercise during the year (30%). The written procedures exist, but ownership is weak: training and exercises become priorities.

4Security culture

The best-written procedures fail without a security culture: a set of shared behaviours in which security is seen as a means of getting the work done, not as an obstacle.

Its signs:

• incidents and near misses are reported, and mistakes discussed without fear;
• managers follow the rules they impose;
• anyone can say "no" or "stop" without being mocked or sanctioned;
• national staff take part in analyses and decisions;
• security is discussed in programme meetings, not just among specialists;
• programme quality and personal behaviour are recognised as security measures.

Culture shows in what happens when a manager in a hurry wants to bypass a rule. If nobody dares say anything, the security culture is weak.

5Business continuity

The business continuity plan prepares the organisation to maintain its essential functions despite a major disruption: loss of an office, prolonged internet outage, cyberattack, pandemic, evacuation, sudden departure of key people.

Steps:

• Identify critical functions: payment of salaries, suppliers and transfers to beneficiaries, supply of health centres, communications with teams, donor reports falling due.
• Set a maximum tolerable interruption for each: for example 24 hours for emergency communications, 7 days for payroll, 30 days for donor reports.
• Plan fallback solutions: alternative office, remote access, backups, delegations of signing authority, back-up suppliers, stocks.
• Designate alternates for key functions and document essential access (without sharing passwords in plain text).
• Test the plan at least once a year.

Example. The payroll system is hosted on a server in the capital office. Maximum tolerable interruption: 7 days. If the office becomes inaccessible, restoring from the off-site backup takes 3 days, which is within the limit, provided the backup is recent and tested: the latest one is 5 weeks old. Action: automated daily backup, quarterly restore test.

6Final project: a risk management framework for a country

The final project of the Mini MBA Security and Risk Management consists of writing, for a real country or area (using public data only, never an organisation's confidential information) or a fictitious but realistic one, a risk management framework of 6 to 10 pages:

• 1. Context analysis: actors, dynamics, scenarios, indicators.
• 2. Risk assessment: threats, vulnerabilities by profile, matrix, inherent and residual risks, comparison with the threshold.
• 3. Strategy: mix of acceptance, protection and deterrence, and access and negotiation strategy.
• 4. Summary security plan: levels, key procedures, communications, contingency plans (medical evacuation, hibernation, relocation, kidnapping).
• 5. People: equitable duty of care, health, wellbeing, internal safeguarding, insurance.
• 6. Organisational risks: extract from the register (fiduciary, compliance, PSEA, digital, reputation).
• 7. Partners, budget and governance: risk sharing, security budget, dashboard, business continuity.

Assessment criteria: quality of the analysis, consistency between risks and measures, realism and proportionality, equity between staff and partners, respect for humanitarian principles, clarity. The project is part of the third-month exam.