Whilst taking a recent train journey, I was sat opposite and ended up speaking to a business owner who happened to mention that he has a lot of business issues keeping him awake at night now that Brexit is happening. He wasn’t sure if Brexit will cause him a great deal of grief but he said he has a lot more to think about now. Running his business at seven sites across the UK, but with primary offices in London and Birmingham, I asked him what his views were on the security issues and the threats from terrorism, given that those topics are found in the news headlines almost as much as there is talk about Brexit. He told me that he has a Health and Safety Manager for the company who doubles up as a Security Manager when the need arises and that “he takes care of all that for me”.
We continued to chat and he mentioned that his Health and Safety Manager had a decent set of skills and qualifications in the Healthy and Safety field, including the usual IOSH/NEBOSH. “It’s what he’s always done.”
Given my background, I asked “What about on the security side of things?” He then went on to tell me, and I was not exactly surprised to hear, that security was “just a secondary role” as they “didn’t have too many security concerns” and “nothing has happened so far so we must be doing something right.”
Their security management was essentially covered by someone not particularly experienced or qualified in security, but they handed the responsibilities over to the Health and Safety Manager as it seemed like ‘a natural fit’ and appeared not to be looking to invest too much in security because ‘nothing had happened’ thus far. He went on “If we get any real security concerns, we’ll probably have to bite the bullet and appoint a proper security manager.” That’s like trying to buy insurance after an accident or health insurance after the diagnosis. To hear that was nothing new for me as it’s a view that many business owners share.
Many companies ‘get by’ without fully examining the threats and risks to their organisation, their people, assets and resources and in effect, their livelihoods, because they are not fully sighted on or even best placed to make those informed decisions. They don’t therefore prioritise enough funding towards it. It may seem cost-efficient to some that they don’t need something because they haven’t had any issues or concerns before now, but if they reach the point where they really feel like they need it, then usually it’s because the horse has already bolted. The old proverb ‘prevention is better than cure’ stands true in the case of security issues. All too often, we see security taking a lesser role in organisations and only coming to the fore after the event, when it’s more about damage limitation and preventing repeat incidents. At that point, security unsurprisingly seems to be worth investing in.
Granted, not all organisations can budget for security managers and security team hires, but there is something out there for every business and there exists affordable and scalable options that can grow with you. You just need to know where to look and whom to speak to. Sometimes, just having the comfort of a security review on a regular basis can help and is usually much more cost-effective than dealing with a security incident after it’s occurred. The experts can tell you from their informed and experienced viewpoint about the gaps that need plugging and what risks you may be exposed to.
Security is too important not to give proper thought and attention to and many organisations have unfortunately not survived their first encounter with a tangible security issue. Rightly so, business owners will want to maintain a focus on their bottom line, their sales, revenues and costs, as that’s what they know best and that’s what will keep them in business on a day-to-day basis, but please don’t lose sight of the fact that security issues are ever-present, all around us and can be examined and overcome if things are not left alone for too long.
Just as the everyday risks to a business are there in terms of profitability, the threat to reputation or tangible assets is also something that will never go away on its own.