Security Threat Assessment & Risk Management - Relevance to Hotel Industry

Hotel facilities, however small or large they maybe, face a multitude of unique threats not always prevalent in other industries. A threat can be conceived as anything that has the potential to disrupt business, interfere with operations, harm guests, employees or physical property, or subject the facility to liability. These unique set of risks create a dynamic demand to strengthen business operations and remain vigilant in terms of security and emergency response plans. With the rise of new threats constantly evolving, one of the most effective ways to safeguard your guests, employees, hotel operations and your facilities to is have a Risk Control Programme in place. An effective risk control programme plays an important role in helping hoteliers provide a safe and secure environment for their customers and employees. It should include not only measures and programmes to address the safety and security of customers and employees but also risk management measures for property and daily operations.

Risk management starts with threat assessment and understanding the risks of doing business. After all, it's impossible to know the threats and vulnerabilities that affect your safety and security if you don't reasonably identify them in the first place. A thorough and comprehensive risk assessment can help in identifying and defining risks, vulnerabilities and potential consequences, outline a plan to prioritize and address these issues. Business continuity planning also can help hotel owners and managers to be prepared to respond to disasters and unforeseeable events (weather-related disasters, power outages, cyber attacks, and critical equipment breakdown). The ability to deliver a quality customer experience on a consistent basis is critical to the hotelier’s competitiveness, financial well-being, and reputation.

Identify and Define Your Risks

It may be tempting to take a "one size fits all" approach to risk assessments when determining the potential threats that may affect a facility, but this tends to be an incorrect approach. Risks and vulnerabilities are truly unique from location to location. It is a fact that a hotel in New Delhi and a similar hotel from the exact same chain in New York will each face unique threats. Their employee uniforms may look the same, their operating procedures may be identical, but the threats and risks can be completely different. As such, it's vital to take an honest look at all of the potential and unique risks facing the facility, and how the establishment can best respond to them should an incident actually occur.

A risk assessment looks holistically at any vulnerability and how that vulnerability could be exploited, starting with a hotel's physical location and operating procedures. For example, an unlocked door or improper key control can present a big vulnerability and subject the facility to unnecessary risks. Broken or outdated technologies, like a non-functioning video camera, also pose a large risk. Sometimes overlooked but just as important are the employees. They have unprecedented access to guests' personal information and belongings, making it vital that they are properly trained and screened. All of these scenarios, properly identified, addressed and taken into account together, can help leaps and bounds in reducing and potentially eliminating some of the risks.

In addition to looking at the physical location, a comprehensive risk assessment will also look at historical data, like weather, crime and demographic data, and then benchmark the hotel’s security protocols with that of it’s neighboring competitors. This should go without saying, but facilities located close to a coastal region need to be prepared in event of a windstorm or hurricane. Likewise, hotel operators with statistically higher neighborhood crime rates need to take these into greater account when assessing their vulnerabilities. It may not be out of the question to have uniform security on staff in a high crime area, whereas in other parts of the country it may be viewed as overly cautious.

Though not mandatory, it is advisable to consider hiring a disinterested third-party with risk management expertise to conduct a thorough risk assessment. This allows someone who is not involved in the operations of the organization and has no personal stake in the company to provide a different perspective on a particular vulnerability that may be otherwise overlooked. Once this risk assessment is complete, it is imperative to follow through by outlining a plan to address identified vulnerabilities.

Prioritize, Plan and Respond

Once a Hotel is successful in identifying its risks and vulnerabilities, it should plan corrective measures and implement them. Any thorough risk assessment should highlight a list of areas of recommendations and further outline high, medium and low priority action items. Prioritize the most important items, set a timeline to fix and implement a solution by continuously improving procedures and operations.

Though priorities and vulnerabilities will differ from location to location, the highest priority items should involve reducing the risk of a loss of life, be it through crime deterrence, physical facilities or in event of a natural disaster. Other high priority items include vulnerabilities that could potentially damage the property and tarnish the brand image of the hotel. Having assessed the potential consequences of these threats, a well thought out plan to address them should be devised.

Once the threat assessment is complete and a risk control program has been devised, it is time to ensure safety and security within available resources while operational and functional control measures are being implemented. Any planning to cause harm/ damage to the facility will often exploit the weakest point of the operations or a transitional phase. Hence it is vital to remain vigilant and be prepared to combat potential threats. A key to the longevity and success of any business is how they respond to a threat when an incident occurs at their location.

The last step in a comprehensive risk assessment and security plan is to plan a response. The four main ways to look at a response are: deter, detect, delay and respond.

Deter the Threat

The first step in responding to any threat is threat visualization and corresponding deterrence. Locks, fences and security personnel can all be successful deterrents, but it can be difficult to strike the delicate balance between a secure yet relaxed, home-away-from-home environment that hotel operators provide their travelers. This needs to be addressed tactfully without compromising on appropriate systems, equipment and security procedures in place to help deter an incident.

Detect the Threat

There are a multitude of methods and tools that can help detect a threat or vulnerability, but they are only effective if they are utilized properly. One of the biggest mistakes hotel operators make is using a closed circuit camera system as a crutch as opposed to a tool. Strategically placed video cameras can be an excellent tool for both detecting and responding to threats, but only if the video feeds are actively monitored. The staff monitoring the feed also needs to be capable of identifying the incident as a possible threat and respond appropriately.

Delay the Threat

Think of a delay as a physical deterrent or barrier to keep your guests, your employees and your business secure. These measures should give adequate time to respond to an incident, and are what most people generally think of when they think of traditional security measures. Every facility can be penetrated, but suitable mechanisms, policies and training can be put in place to help safeguard it.

Respond to the Incident

Though a full response plan will again depend on the individual facility, it is critical to determine how to respond and who will respond to an incident. Does a hotel have the capabilities to respond to a threat internally, through in-house security personnel, or do they need to rely on emergency services like local police and fire departments? If the best response is calling the police or fire departments, their emergency response times need to be accounted for and appropriate measures need to be catered for to protect the facility until they get there.

While the response plan and related timeframes will vary depending on the size and resources of the hotel, preparation and training can go a long way in reducing the severity of an incident and resultant damage.

The threat landscape is continuously changing. Many of the high risk threats today didn't exist two years ago; likewise, the potential threats two years from now don't exist today. It is obligatory that a recent and valid threat assessment defines the risk control program of any Hotel. Various facets of a safety and security plan need constant evaluation and audit depending the changing geo-political scenario besides location specific demography. Unfortunate but true that it's impossible to completely secure a hotel facility from every possible risk. However, the more proactive your approach to risk management, the more prepared facilities can be to help protect their guests, employees and business in the long run.