Incidents: report, analyse, learn

1Why report

A security incident is any event that caused or could have caused harm to staff, assets, reputation or programmes. A near miss is an event that could have caused harm but did not: gunfire heard near a convoy, a fake checkpoint narrowly avoided, a verbal threat.

Reporting serves to:

• provide assistance immediately to the people affected;
• alert other teams and organisations;
• understand trends and adapt measures;
• account to senior management, the board, donors and insurers;
• demonstrate that the organisation is exercising its duty of care.

The incident pyramid (observed in many sectors) shows that before a serious incident there are generally many near misses and minor incidents. Not reporting them means depriving yourself of early warnings.

2The reporting system

An effective system has three levels:

• Immediate alert (within the hour): a call or message to the designated person, with the essential information: who, what, where, when, condition of the people involved, need for help.
• Incident report (within 24 to 48 hours): a standard form with timeline, consequences, actions taken.
• Analysis (within 1 to 2 weeks for significant incidents): causes, lessons, recommendations.

To encourage reporting:

• a simple form, available offline and in staff languages;
• no sanction for reporting a good-faith error (a "just" culture, which distinguishes honest error from gross negligence or deliberate violation);
• a confidential channel for sensitive incidents (sexual violence, harassment, incidents involving a colleague);
• feedback: teams see what changes as a result of their reports.

If a team never reports anything, it is almost never because nothing happens. It is a warning sign about the security culture.

3Classifying incidents

A common typology makes data comparable: violence against people (murder, injury, kidnapping, sexual assault, arbitrary detention), theft and robbery, intrusion, threat, conflict-related incident (gunfire, shelling, explosive devices), road accident, health incident, digital security incident, civil unrest.

Each incident is also given a severity level, for example from 1 (minor, no injury or significant loss) to 4 (critical: death, kidnapping, serious injury, withdrawal from an area).

Example of a quarterly table. 42 incidents reported: 15 minor thefts, 9 threats, 6 road accidents (2 of them serious), 5 carjackings, 4 conflict-related near misses, 2 short arbitrary detentions, 1 physical assault. There are 8 incidents of severity 3 and 4, i.e. 19%. All 5 carjackings took place on the same route, between 15:00 and 17:00: the trend can be acted on (change of timings, review of authorisations on that route).

4Analysing an incident

The analysis of a significant incident seeks to understand, not to punish. A four-step method:

• A precise timeline, reconstructed from several sources (people involved, witnesses, communications, GPS).
• Facts and consequences: damage, reactions, assistance provided.
• Causes and contributing factors: context (threat), vulnerabilities (procedures, behaviour, equipment), decisions taken and the reasons for them, what worked well.
• Recommendations: concrete measures, persons responsible, deadlines, and verification of their implementation.

Useful questions: was the threat known? Were the procedures appropriate? Were they known and applied? If not, why not (impossible, unknown, bypassed)? Was the response to the incident fast and appropriate? What should we have seen coming?

The people affected must be protected during the analysis: psychological support, respect for their pace, confidentiality, and no repeated questioning that re-traumatises them.

5Using the data

Incident data feed into:

• the context analysis and the risk assessment (frequencies, locations, timings, perpetrators, modus operandi);
• decisions on measures (what works, what does not);
• reports to senior management (quarterly dashboard) and to the board;
• sharing with security forums and sector databases, in anonymised form and with the organisation's agreement.

Useful indicators. Number of incidents per 100 staff; share of serious incidents; average reporting time; share of recommendations implemented on time. Example: 24 recommendations from the year's analyses; 15 implemented on time, 5 late, 4 not started. On-time implementation rate: 62.5%. The 4 not started are examined as a priority by senior management: a recommendation that is not applied leaves the risk intact.

6Reporting and communicating

After a serious incident, several audiences expect information, with different needs:

• The family of those affected: fast, humane information, from a designated person, before any public communication.
• Staff: factual information, measures taken, support available, to avoid rumours.
• Donors: depending on the contracts, rapid notification of serious incidents and their consequences for programmes.
• Insurers: notification within the deadlines for damage and medical costs.
• Other organisations: alert through the security forum.
• Media: only through the designated spokesperson; in the case of a kidnapping, public communication can put the victim in danger and is decided by the crisis management team.

Clumsy communication can make an incident worse: publishing a victim's name before the family has been told, publicly accusing an armed actor, or revealing information that compromises a negotiation.