6 habits of a successful 'head of risk'

They work in a sector of the international development community that likes to remain under the radar. Yet they serve as a lifeline for thousands of humanitarians who risk their lives on a daily basis. They are the employees of security firms — the people who act as the eyes and ears on the ground, protecting the aid organizations with which they work. “Security is a state of mind,” said Andrew Firth, head of risk for WS Insight, one of South Sudan’s leading security companies. “NGOs can’t operate behind physical barriers and it’s our job to enable them to do their jobs.” The key to being a leader in the industry, Firth said, is to understand causality: “Focus on the ‘why’ of what happened,” he said. “Not only the what.” This helps give clients an overall picture as to the context of what they’re experiencing and helps minimize knee jerk reactions. “Security doesn’t have to be about gates, guns and guards.” --— Andrew Firth, head of risk for WS Insight As part of an in-depth report, Devex spoke extensively with Firth, spending time at WS Insight’s offices in Juba, in order to gain a better understanding as to what it takes to be a success in this field. 1. Understand the organization you’re informing. “Try to get a definition of what’s important to the organization you’re with,” Firth said. What is their approach and what are they trying to achieve? At the end of the day you’re there to enable them, not to constrain them, he added. The best way to do this, he said, is by communicating with them as much as possible in order to gain further insight and understanding into their overall goals. Talk to them, ask them questions and do what it takes in order to truly understand their philosophy and mission. 2. Know the environment and understand the relationship between it and your organization. Read, write, watch, and talk, Firth said. It’s critical that you understand the wider environment the organization is working in — and that you know it better than your clients do. “Everything that happens from the ground right down to the most detailed tactical incident is your business,” Firth said. “You need to be interested in everything.” 3. Don’t look only inside the organization. There are two key things to remember, according to Firth: Don’t be insular and don’t be shortsighted. The more you understand the environment, the more you’ll know how it will impact everything and potentially affect the organization. You want to make sure your firm doesn’t have a narrow-minded approach — and you can ensure this by using multiple sources, comparing data and making sure to factor in the larger context. “Very few things are black and white and there are all sorts of nuanced drivers of a particular situation,” Firth said. The more you understand why things are happening, the more you’re in a position to be proactive about what’s taking place around you. 4. Don’t accept first reports. “First reporting is always wrong,” Firth said. Take time to think about whether that particular piece of news is likely to be true and is going to be corroborated. You don’t need to seek absolute certainty of the truth, but reacting to first reports will get you into trouble and turn you in the wrong direction, he added. Look at them, accept them and then take time to make a decision in terms of which way you want to go. 5. There is no ‘one size fits all’ to security. “What you did in Iraq, what you did in Afghanistan, what you did in Libya is not what’s going to happen in South Sudan,” Firth said. In addition to understanding the organization, you have to understand the environment that the organization is working in and engage with them and those around you. Try not to bring preconceived notions from previous experiences and recognize that you’re a part of achieving their goal rather than trying to put things into place to prevent it. Just because the book says you should have a 12-foot high wall, for example, doesn’t mean it’ll fit that particular organization. “Security doesn’t have to be about gates, guns and guards,” Firth said. 6. Know the difference between threat and risk and security and risk. Ultimately, this is a service industry. It’s not about constraining and protecting, it’s about making sure that your organization can operate in the wider environment, Firth said, and you can’t keep them behind locked doors. So to be an effective security adviser you have to have knowledge of your subject, and understand the differences between risk and threat, and between security management and risk management. Risk is about doing enough in the environment to meet the threshold or risk acceptance: “If you’re threat oriented, you’re more reactive,” Firth said. The whole point is to enable the organization to do what can be done, to the minimum acceptable level. As opposed to warning people that it’s all too difficult, and it’s all too dangerous, and they shouldn’t be out there. It’s self-evident. Your clients wouldn’t be there unless they knew it was a high-risk environment. Our mission is to do more good for more people. If you think the right information can make a difference, we invite you to join us by making a small investment in Professional Membership.