Early Prevention reduces potential risks

A few weeks ago a Swedish pilot was arrested by Dutch police at Amsterdam-Schiphol International Airport for flying a commercial aircraft for 13 years with a fake licence.
The 41-year-old pilot was about to fly a Corendon Airlines Boeing 737 from Amsterdam, the Netherlands, to Ankara-Esenboga Airport , Turkey, with 101 passengers on board when he was arrested. The pilot confessed he had been flying for 13 years on a false licence, accumulating at least 10,000 hours flying hours. The man did have a pilot’s licence, but when it expired or became invalid for passenger aircraft, he had falsified it.

He had worked for airlines in Belgium, Great Britain and Italy. A lawyer for Corendon Airlines commented that the pilot had worked for the airline for the last two years and had “expertly misled the company with his false papers”. (Radio Netherlands Worldwide)

Fortunately the pilot was more than capable of flying the aircraft but imagine the impact if that hadn’t been the case. Reactive security is the taking of countermeasures after an incident. Unfortunately, this kind of security normally doesn’t prevent image damage or financial and assets losses.

The current trend in loss prevention & security is to invest more in early prevention to avoid unsuspected high expenses in the future. The reasoning process is a simple business case of weighing the costs of early prevention versus the benefits of avoiding costly surprises after the fact. For example, the logistic and supply chain market is an almost perfect target for criminal organizations as relatively high value products are carried through the whole of Europe in a regularly scheduled manner. Counterfeiting, cargo theft, extortion and espionage are just a few examples of the activities that they will use to generate income. They will work to identify and exploit weak links such as employees working for the logistics organizations who can supply them with information about the products, shifts, security plan, transportation and most importantly, the associated timing.

The logistic and supply chain companies have to deal with a flexible and ad hoc environment. To save costs they hire a relatively large number of temporary workers for their warehouses and subcontractors for their transport. Due to the ad hoc environment most temporary personnel or subcontractor can start working without any kind of background check. We would pose the question as to whether this is a wise action.

Early prevention is the bases for an early detection of threats and risks for your organization. To prevent or reduce incidents you’ve need to use early prevention tactics as risk analyses and audits, vetting and pre-employment screening of personnel and contractors, create employee awareness and train personnel to detect threats and risks.

Risk analyses

Every organization has its own risks, for example natural disasters, theft, espionage, contingency, cybercrime, terrorism or sabotage. The severity of a risk can also be different for every organization. To indentify which risks are applicable or could have an impact you need to conduct a risk analysis and security survey.

After indentifying the overall risks you have to use a risk matrix¹ to determine the impact and consequences of each risk:

• The vulnerability, this means how susceptible the assets are to loss.
• The criticality, this means how critical are the assets to your organization.
• The vulnerability and criticality outcomes will result in a severity value for example I, II, III, IV, V.
• The probability, this means the chance of an incident happening.

¹ Example risk matrix

Vetting and pre-employment screening

Your personnel are the organization’s most important asset. But, they also present the biggest risk to its reputation. However, most organizations are not aware of this risk and are not taking any counter measures. Some examples of associated risks are: an applicant for the function of finance manager using false educational references, an applicant for the function of warehouse employee not having proper work permit documentation or a new employee for the function of transport manager who has a criminal record. Some of these risks can have a severe financial impact.

Vetting and pre-employment screening can help you to detect possible risks at an early stage. In some organizations for example airports, government services and security vetting and pre-employment screening are required. A vetting and pre-employment screening procedure can consist of:

• ID verification
• Criminal record checks
• Academic and professional qualifications verification
• Work Permit checks
• Character and educational references verification
• Multi-year employment checks
• Residency verification
• Credit checks
• Bankruptcies
• Driving licence checks

Vetting and screening should be required in every organization. The financial risks are much higher than the costs of the vetting or screening which vary between € 75, – and € 200, – for a standard procedure.

You can use a private investigation bureau or a specialized vetting and screening bureau to do the vetting and screening for you.

There are also local initiatives for example the “Alert register Logistic Sector” in the Netherlands or the “DID” (driver identification database) which work with a so called white list. These lists consist of screened workers. Everybody can be placed on the white list if they comply with the screening. If a person on the white list is involved in a predefined incident then he or she will be removed from the white list. Consequently, that person won’t be able to work for companies that use the white list.

Awareness training

In an organization security and safety has to be a part of the social culture. Each level within your organization has to be involved in the communication of incidents and potential risks. Awareness training should be integrated into the orientation of new personnel. The subjects in the awareness training can no doubt vary between organizations. At the end of the training everybody must know what the risk focus is, how to handle confidential information and what the procedures are. And, most critically who they have to contact in case of suspicious circumstances or incidents.

Contact

If you would like to receive more information about security measures, please contact Mari van Kuijk.