January 27, 2010

The Broken Window Theory - CPTED (Crime Prevention through Environmental Design)

SECURITY PROGRAMS SHOULD START WITH THE BASICS & THEN BUILD - What do you think?

Use your imagination and picture two shopping malls across the street from one another, one on the left and one on the right. Or if you prefer, picture two apartment complexes across the street for one another, one on the left and one on the right.

Let’s assume that the property on the left side of the street is not well kept. There are a few broken windows, there is trash blowing about the parking lot some of the exterior lights are burned out. Let’s also assume that the property on the right side of the street is clean, it is well lit and burned out lights and broken windows are immediately repaired. The property is well landscapes and bushes are regularly trimmed.

Which of these properties has higher rates of crime?

If one hospital’s materials management storeroom is disheveled, cartons are half full with contents spilling out while the storeroom of the hospital down the street is orderly with a well run inventory control program, which one is likely to have a serious shrink problem?

Security is not just about guards, CCTV and alarm systems. It is also about behavior modification, security awareness programs and good housekeeping. If a warehouse or property looks unkempt and is poorly maintained, the odds are that crime will increase, both internally and externally. The disheveled storeroom sends the message that: “If you steal something from here it will go undetected.” Good housekeeping as a security device may also be applied to landscaping, lighting and graffiti eradication programs.

At Security Management Services International (SMSI) we often suggest to our clients that these CPTED (Crime Prevention through Environmental Design) principals should be applied early in the security program enhancement process, in part, because many of these remedies do not come with a big price tag. The application of CPTED principals will positively enhance the deterrent impact of more traditional approaches such as surveillance systems, access control systems and uniform security officers. In fact, in the absence of the techniques, the application of more traditional security methodologies will actually be diminished.

William H. Nesbitt, CPP

President

Security Management Services International, Inc.

www.smsiinc.com

Filed under Blog, Hospital Security, Hotel Security, Mall Security, Office Buildings, School Security, Security & Liability, Apartment/HOA by SSO

Permalink • Print • Email • Comment

January 1, 2010

How do you make apples & oranges security decisions? The Answer: Metrics

No two guard companies are the same. No two alarms companies are the same. How do you know what company to choose?

When security challenges turn up, how do you decide what mitigation strategy to apply? How do you decide how much of one remedy to apply as opposed to an alternative remedy? When you uncover threats, how do you know how serious the threat is on a scale of one to ten? What is the predicate on which your security budget is based upon and what is the targeted return on investment for that budget commitment?

The answers are that security decisions must be data driven. This means that risks and threats must be quantified in a manner that expresses the probability of occurrence. Proposed mitigation strategies must be framed in quantitative terms that define risk reduction. Back in the old days, one of the measures retailers applied to measuring the effectiveness of their theft abatement program was to compute the total dollar value of recovered merchandise through the shoplifter apprehension program. I remember hearing a retail security director proudly telling me that he had increased his recoverables by more than 15% over the previous year. However, it is very likely that this number was an expression of increased thefts and a reflection of a failed theft prevention program.

The point is, with a little creative thinking, those charged with making security decisions must do so predicated on factual data, and more importantly, a combination of data. Going forward, it is important to track the effectiveness of your program and to have the capacity to apply analytics to that data.

This process should be embodied in as many decisions as possible. If your company is contemplating hiring a contract guard service, will you be looking for the lowest bidder? That may or may not be an acceptable criterion. If the guard company you hired performs in a negligent manner and your company is on the losing end of a multi-million dollar lawsuit, maybe the low bid decision isn’t the best way to go.

When doing business with any security vendor, you should be trying to determine which vendor with provide your organization with the best value, not necessarily the best price. This means that you must develop a multidimensional matrix that allows you to score each vendor on a set of common criteria. Consider this: It may be that the vendor with the highest price provides the highest return on investment.

At some point in time, an objective baseline security/risk assessment is a must. This is one way to avoid compounding the mistakes of the past. Risk assessment will utilize incident history, police data and data from organizations such as the CAP Index. Moving forward all security activity must be tracked in a manner that facilitates statistical analysis and trend project. The usage of products such as Perspective from PPM 2000 is well advised.

The suggestions mentioned herein are rapidly becoming normative.

Filed under Blog, Shopping, Hospital Security, Hotel Security, Mall Security, Office Buildings, Entertainment Venues & Nightclubs, School Security, Apartment/HOA by SSO

Permalink • Print • Email • Comment

December 1, 2009

The Security Hospital Assessment – The Employee Perspective

Security Management Services International, Inc. (SMSI) has conducted numerous security assessments and consultations over the last 20+ years. Whether the assessment involves a manufacturing operation, a shopping center or a hospital, there is a period of time, during the initial phase of the consultation that is spent getting the lay of the land. This means trying to understanding the security history of each client, the primary mission of the organization and the ambient crime environment. The consultant also needs to understand the organizational milieu.

The early phases of the assessment process requires the consultant to gain an understanding of the risks and threats that separate this client form any other client. It is important to hear from management and supervisory personnel. It is also equally important to hear from rank and file employees. During the initial phases of the assessment, respondent responses are often guarded and sometime agenda driven. However based on these initial inquiries the consultant moves forward in a process to either validate or invalidate the responses to these early inquiries. This process sometimes takes three or four days before the consultant has enough information to make a more in depth investigation in an attempt to uncover unvarnished factual information.

About 2 ½ years ago SMSI embarked on a new strategy aimed at reducing this initial this initial acclimation period. SMSI developed a web based Likert style questionnaire. This questionnaire was developed by SMSI with the help of a computer programmer form Madison, Wisconsin, Michelle Curtis. A Likert style questionnaire allows the respondent to react to a series of statements by rating each the response to each statement by agreeing or disagreeing on a scale of one to five. Each respondent is also invited to make any comments they feel are relevant. The questions are hosted on the Security Management Services International Inc. Website (http://www.smsisitesecurityquestionnaire.com). Ms. Curtis designed a report format the rolls up the accumulative responses to each statement separately.

Each client is given a unique username and a unique password. The responding parties are assured anonymity. This anonymity seems to reduce respondent inhibition. Typically the client makes an announcement of the impending assessment, usually through thier intranet network. Employee participation is encouraged. The questionnaire announcement usually goes up about one to three weeks of SMSI’s first visit. It is not unusual, in the wake of the initial announcement, that we get more that 100 in the first few hours.

After 2 ½ years of using this instrument, the results have been very gratifying. We have found the rate of employee participation to be very high. Depending on the client, we find that from 40% to 60% of those participating in the process choose to make commentary. Often times the commentary offers more areas of inquiry that fall beyond the original scope of the questionnaire.

What are the benefits of this value added service?

The benefits are many and they differ slightly with each client. Without question, this questionnaire saves time by facilitating the ability of the consultant to hit the ground running once on-site. The questionnaire affords the opportunity for every employee to participate in the process. Employees know their voice will be heard. We find that employees who have input on the front end are more likely to buy-in on the ensuing solutions and remedies on the backend. Because the respondents are given anonymity, they don’t hold back. Having said that, to be sure some of the responses reflect hyperbole and distortion. However, the consultant is able to verify the veracity of those comments. Moreover, exaggerations may very well be symptomatic of a deeper problem. More importantly, most of our clients love this value added service.

A brief explanation of other diagnostic instruments, by way of analogy, may be helpful here. There is and/or used to be a psychological diagnostic tool called the Thematic Apperception Test. This test along with other such tests such as the Rorschach and Holtzman Inkblot Tests are generally referred to as projective tests. In both cases the subject is shown a number of panels and he or she is asked to describe what their perceptions are and sometimes they are encouraged to tell a story about their perceptions. The psychologist is then able to draw inferences from these tests by interpreting the recurring themes that seem to reoccur from one panel to another. The noting of recurring themes within individuals can be applied to a group of individuals. The themes that reoccur within the accumulative responses from one client, as they participate in the questionnaire process must be duly noted as a dominant perception. The use of this questionnaire efficiently facilitates this longitudinal perspective.

The data derived from this questionnaire allows us develop solutions that respond to the unique set of needs of each client. It also helps develop solutions that fit within each client’s collective frame of reference. Within the healthcare environment the Joint Commission expects the hospital security program to be a participatory exercise involving all employees. If we expect employees to fully engage in a comprehensive security and loss prevention program, it seems reasonable that their views and perceptions during the assessment process are worthy of consideration.

Filed under Blog, Hospital Security, Workplace Violence, Security & Liability by SSO

Permalink • Print • Email • Comment

November 25, 2009

What is the Backbone of a Successful Mall Security Program? - Is Your Security Planning Predicated on Outcome Based Decision Making?

After having reviewed hundreds of security and loss prevention programs, I find a great deal of disparity in the effectiveness of those programs from marginal to excellent. As a security professional, I am often puzzled as to how each security program evolved to the point it is at when I find it. In some cases it is apparent that the evolution has been the result of a logical linear reasoning process. In other cases the process seems less clear and it often appears that the program has been generally derived by reactive and crisis management responses. It is not unusual to find that many of the assumptions on which security programs are premised, are not rooted in reality. When this happens ROI is deminished.

When one begins the process of determining how the security program has evolved to the point that it has, the picture is not always clear. However it can be said that in a majority of the cases, we find that security programs are front-end driven.

What do we mean by “front-end driven?”

Let me give some examples of front-end driven decisions. Consider the use of CCTV. As we undertake the security assessment of a Shopping Mall for example, we note the use of closed circuit television cameras throughout the facility. When we try to determine the decision process behind the placement of each camera, we are told, “we want to watch exterior doors” or we want to watch the loading dock & parking structures” or “we want to watch fire exits.” First, we often find that these CCTV images are not actually being watched by anyone on a live basis. Consider this; Cameras providing surveillance of common areas such as hallways, parking lots and walkways that are not being watched by a security officer may potentially increase liability.

The rhetorical question I would like to pose, for consideration, is prior to deciding where to place a camera, a card reader, a cipher lock, a floodlight or a barrier is: What is the outcome this action is likely to produce? The best way to avoid the pitfalls of the “law of unintended consequences” is to consider the outcome you wish produce before you make the decision to go forward. When applying security technology, It is all too easy to get caught up in making decisions regarding the assumed benefits of applying a particular technology or procedure. How often have we all heard the utterance, in the wake of a theft, “we need a camera.” This comment implicitly assumes that a CCTV camera, in of itself, would have prevented the theft. Cameras that are not monitored have diminished deterrent value and may actually encourage theft.

It is important to remember big picture. Security programs are all about behavior modification. The use of security technology and/or the use of security officers are all intended to modify behavior by way of deterrence. Security cameras and card access systems are intended to modify behaviors with ultimate intended result of protecting people and property. The role of security is to anticipate and deter. The success or failure of any security program can be measured, in part, by how well that program changes behaviors. The effectiveness of security devices to positively affect behavior can be greatly enhanced by strong security management, workplace violence prevention programs and robust security awareness programs. Whether considering security technology or security officers, the decision making process should remain constant.

Effective mall security programs must reinforce Security Awareness as a positive value system. This program must foster a partnership between mall employees, security officers, tenant and the local police jurisdiction. These actions will increase the benefits to be derived from the application of security technology several times over.

So next time you have a security problem to solve, ask yourself: What will be the intended outcome of my proposed solution? What are the metrics that will support your decision?

William Nesbitt, CPP is also a member of ICSC.

Filed under Blog, Shopping, Mall Security, Workplace Violence, Security & Liability by SSO

Permalink • Print • Email • Comment

November 22, 2009

JCAHO: EC.02.01.01 - Does Your Security Program Meet the Spirit of EC Standards?

We all know there is a difference in complying with the “letter of the law” and the “spirit of the law.” The same rule can be applied to Joint Commission Safety & Security Standards. You will notice that the Joint Commission standards define expected outcomes, but they do not specifically explain how to get there, nor should they.

A couple of points are worth noting: JCAHO standards implicitly recognize that security is a situational discipline, which means that what works for one hospital may not work for another. Second, JCAHO Standards as applied to the hospital security program establishes the floor, but not the ceiling. This means that one cannot assume that by merely complying with JCAHO Standards one is meeting a “reasonable standard of care.” This assertion is supported by the fact that most hospitals that have been the object of security driven litigation, have complied fully with JCAHO EC Standards on their last survey and have still been held liable.

The implicit weight of the JACHO standards is considerable. Consider the weight of this simple statement: An effective security management should include proactive surveys, remediation, and training. The clear message is: “Anticipate and Prevent!” How these standards are applied will vary greatly from one hospital to another. The variance of compliance within these standards between a rural 30 bed hospital in Montana will differ greatly from an urban hospital in Los Angeles. There is certain wisdom in these standards in that they allow for situational variances. Universal remedies do not fit hospital security programs the way universal precautions fit hospital safety programs.

Although understandable, there seems to be a disproportionate emphasis on child abduction from the JCAHO point of view. If one considers the National Center for Missing & Exploited Children data, you will find abductions from hospitals are very rare, especially since the advent of electronic tag systems. The problem is, like terrorism, the hospital cannot afford to be wrong, even once. A missing baby will always make the major networks’ six o’clock news. Our litigation experience tells us that when infants are abducted the primary common denominator is staff inattentiveness. In other words, a hospital can be fully compliant with the prescribed EC standards and still be adjudged negligent for a breach in security.

JCAHO seems to advocate the best security programs require the full participation of all employees thereby ensuring they are part of the security solution. This is one of the fundamental components of any effective security program under any circumstances. Eliciting rank and file employee input during the assessment process is also vital. Those same employees may be speaking with a JCAHO surveyor. Therefore, to understand their perceptions before the fact is vital. Additionally employees who are consulted during the assessment process are much more likely to buy in on the resulting solutions.

Meeting these standards, while at the same time, meeting a reasonable standard of care requires due diligence. The foundational basis of due diligence is a comprehensive and objective security assessment. Before one considers the application of remedies such as visitor control, infant security, emergency department chaos, and criminal acts of violence, risks and threats must be not only identified, but they must be quantified. A proper assessment will also provide the path to cost efficient decision making. The assessment process will help each hospital to define the parameters of an appropriate reasonable standard of care.

Filed under Blog, Hospital Security, Security & Liability by SSO

Permalink • Print • Email • Comment

November 17, 2009

How Did You Build Your Security Program? - Security Planning – Outcome Based Decision Making

After 30+ years as a security practitioner and after having reviewed hundreds of security and loss prevention programs, I find a great deal of disparity in the quality of those programs from marginal to excellent. As both a security consultant and as a forensic security expert, I am often puzzled as to how the security program evolved to the point it is at when I find it. In some cases it is apparent that the evolution has been the result of a logical linear process. In other cases the process seems less clear and it often appears that the program has been generally crisis management driven. Itis not unusual to find that many of the assumptions on which the security programs are premised, are not rooted in reality.

What do we mean by “front-end driven?”

Let me give some examples of front-end driven decisions. As we undertake the security assessment of a hospital, for example, we note the use of closed circuit television cameras throughout the facility. When we try to determine the decision process behind the placement of each camera, we are told, “we want to watch the front door” or we want to watch the loading dock” or “we want to watch the pharmacy.” We also often find that these CCTV images are not actually being watched by anyone, live, 24 X 7. Cameras providing surveillance of common areas such as hallways, parking lots and walkways that are not being watched by a security officer may potentially increase liability.

Many of the facilities we consult with use access control cards to largely control ingress to certain doors. We are told that the security department wants to track who accesses any door as well as the date and time they gain entry. Yet, 80% to 90% of all employees can access 80% to 90% of all the access controlled doors. In about 98% of the cases there is no restriction for the time or day that access is granted. In hospitals access is more usually tightly controlled for doctor lounges, the C-Suite, the pharmacy, the business office and labor & delivery, including nurseries. With non medical facilities there are far fewer restrictions unless mandated by regulatory agencies such as DOD and NRC.

The rhetorical question I would like to pose, for consideration, is prior to deciding where to place a camera, a card reader, a cipher lock, a floodlight or a barrier is: What is the outcome this action is likely to produce? The best way to avoid the pitfalls of the law of unintended consequences is to consider the outcome you want produce before you make the decision to go forward. It is all too easy to get caught up, when applying technology, to make unsubstantiated decisions regarding the benefits of applying a particular technology or procedure. How often have we all heard the utterance, in the wake of a theft, “we need a camera.” The comment implicitly assumes that a CCTV camera, in of itself, would have prevented the theft. Cameras that are not monitored have diminished deterrent value.

Let me give you an example that turns this assumption upside down: Several years ago when conducting a security assessment for a large healthcare facility. I noted an auto-pan camera mounted on the roof of the hospital that was ostensibly surveilling surface parking lots. Despite the use of this camera (remember it was an auto pan camera) theft from vehicles was not abated. I proceeded to determine where the camera was being monitored. I eventually found the monitor in a closet in the basement of the hospital. Obviously, this hospital did not have a control center. One of my recommendations in my final report was that a control center was justified and that an unwatched camera providing surveillance of common areas might be a liability.

Five years passed, when the hospital contacted me and told me it was time for another assessment. When I arrived to proceed with the consultation, I immediately noted the roof mounted auto pan camera was gone. When I met the security manger, I said “I see you didn’t get the control center.” The manager responded, “How did you know?” I related that the removal of the roof camera was a clue.

Here comes the rule of unintended consequences for the good: The security manager told me that when they took the unwatched camera down, the car break-ins ceased. The only logical explanation was that the bad guys probably thought we hid the camera. Sometimes unintended consequences are for the good.

It is important to remember that security programs, the use of security technology and/or the use of security officers are all about behavior modification. Security cameras and card access systems are intended to modify behaviors ultimately aimed at protecting people and property. The role of security is to anticipate and deter. The success or failure of any security program can be measured, in part, by how well that program changes behaviors. The effectiveness of security devices to positively affect behavior can be greatly enhanced by strong security management, workplace violence prevention programs and robust security awareness programs.

So next time you have a security problem to solve, ask yourself: What will be the intended outcome of my proposed solution? What are the metrics that will support your decision?

Filed under Blog by SSO

Permalink • Print • Email • Comment

November 12, 2009

Tyco’s Security Design & Technology Symposium 2009

Bill Nesbitt, CPP, President of Security Management Services International, Inc. (SMSI) and Ron Lander, CPP, CMAS, Executive Vice President of SMSI, recently attended the Security Design & Technology Symposium in Chandler, Arizona. This Symposium was sponsored by Tyco International Companies: Software House, American Dynamics and KANTECH.

In order to better serve the customers of Security Management Services International www.smsiinc.com

Bill and Ron believe that their role, in part, is to keep abreast of the ever expanding use of technology as a tool to mitigate security problems and provide real world solutions for our clients. Ron Lander stated “We were looking for different integration perspectives, due to our frequent risk assessments that unveil multiple incompatible systems that are in need of integration on a common platform.” Tyco conducted an informative workshop that was not laden with implicit sales pitches, but rather their goal was to inform and to listen to security practitioners and the challenges they are facing where the rubber meets the road.

Like any symposium worth attending, at least half of the benefits gained from attending stems from the “networking” with other attendees. Security technology has evolved to the point where one can frequently do more with less, with a little foresight. Security control centers are no longer limited to being housed in the facility they are serving. A single control center can now service several regional, national or global facilities. This means there is a reduced need for designing and constructing multiple control centers. The payroll burden of FTEs for each control center is reduced when there is consolidation. This Symposium gave us an opportunity to see Tyco’s flagship integration model, along with its partners in a smooth operating environment.

When SMSI conducts a security assessment of a shopping center, a hotel, a manufacturing plant or a hospital, the mere identification of weak spots and outright breaches is useless without the offering of mitigating solutions. Those solutions must involve the participation of key stakeholders, the application of security operatives and the efficient use of technology. Security methodologies, whether through the use of security officers or video surveillance and card access systems, are really all about “behavior modification.” If the application of technology fails to positively affect behavior in a way that reduces risk, there will be little return on investment. Both the sponsors of the Symposium, as well as those in attendance, seemed to understand this reality very well. The meetings and displays were low-key and not marketing-oriented. The sponsors spent a great deal of time soliciting our collective input and the input of other consultants who specify the products, and integrators who deal with their products daily. We were also exposed to real-time case studies of successful integration by the actual practitioners.

It was a worthwhile two days for the good of our clients (Security Management Services International) , both present and future. The adage, “less is more,” seems to apply to this symposium. The “less” component was supported by the reality that the Tyco companies were not in a full-blown sales mode. If you are a security provider who is invited to speak to any group. such as an ASIS workshop or seminar, and instead of informing, you spend more time pitching your product or service, the end result will be that you will turn off the audience to the organization you represent. If, on the other hand, your primary goal is to inform and to listen to your potential customers, as the Tyco folks did in Arizona, everyone wins. This symposium succeeded in spending less capital on selling and much more capital on informing.

Filed under Blog, Hospital Security, Hotel Security, Mall Security, Office Buildings, Entertainment Venues & Nightclubs, Workplace Violence, School Security, Security & Liability, Apartment/HOA by SSO

Permalink • Print • Email • Comment

Security Source Online: The Website

The Security Source Online (SSO) (www.securitysourceonline.com) blog is about to morph into a unique website. The goal of this website will be to facilitate the ability of this site to meet the mission of becoming an all inclusive Security Source for those seeking answers to security problems and those seeking credible security solutions. Security Source has engaged the services of a web design/SEO company (Magical Productions) to facilitate this transition.

SSO will continue to produce security information, news of the day and emerging trends. SSO will also continue to conduct surveys that are of interest to the security industry and to the public at large. As a security professional for the past 30+ years, I continually receive phone queries asking for security advice and questions regarding where to find security resources. These inquiries lead me to believe that there is a need for the establishment of a resource for security information as well as a wide range of security resources.

In order to fulfill this need, Security Source Online (SSO) will become a meeting place where those with security needs will be able to find security solutions. Those solutions may come in the form of information gained from the postings of our contributors. However, often the provision of mere information is insufficient. Organizations, corporations and individuals often need the services of security professionals as well as those that provide security products and services.

SSO will meet those needs by providing searchable listings of security providers. These listings will soon be available on a subscription basis. It is intended that these listings will be searchable for specific vertical markets, by region and/or by products and services offered. It is intended the SSO will become s resource for security products and service for small and large businesses, security managers and even the general public.

Those who list with SSO will be invited to contribute informational articles to the site and to offer commentary on the security news of the day. We also envision that subscribers would be able to publish employment opportunities for a very nominal fee.

Security Source Online is unique in that the site is managed by security professionals who understand client needs and the security industry as a whole. SSO will truly become the place where security problems meet security solutions.

Filed under Blog, Home & Family Security, At Home, Traveling, Shopping, Hospital Security, Hotel Security, Mall Security, Office Buildings, Entertainment Venues & Nightclubs, Workplace Violence, School Security, Security & Liability, Apartment/HOA by SSO

Permalink • Print • Email • Comment

July 29, 2009

Apartment Complex – HOA: How Much Security is Enough?

There is no easy answer to this question. Why? “Because security is a situational discipline.” This means that the efficacy and the adequacy of each security program is predicated on the distinctive set risks and threats peculiar each location. Ignorance or failure to consider this fact of life can increase liability.

It is difficult to impose a security program on an apartment complex and/or a condo complex. The point we are trying to make is that no matter how many cameras are installed, no matter how sophisticated the access control system is and no matter how many security personnel are on duty, the security program may still be mediocre. The missing ingredient is the full participation of the residents. Without something akin to a Neighborhood Watch Program with involved residents, the security program could be rendered impotent. This means that security needs to be sold as a positive value and one of the prerequisites of just being a good neighbor.

The security programs for residential complexes must be multidimensional and need driven. Apartment complexes and condominium properties should be aware of how to best apply CPTED (Crime Prevention Through Environmental Design) Principles. When the security design is not predicated on a sound risk and vulnerability assessment, lawsuits loom on the horizon. Residential complexes represent a significant portion of all premises liability litigation where the adequacy of security is called into question. We have even seen swimming pool accidents credited to the lack of sufficient security. A little mitigation in the short-run can save major financial hits in the log-run.

We have testified in hundreds of these kinds of lawsuits over the past 30+ years. We think prevention is the way to go.

W. H. Nesbitt, CPP

President

Security Management Services International, Inc.

LinkedIn:http://www.linkedin.com/in/williamnesbittcpp

Filed under Blog, Home & Family Security, At Home, Traveling, Workplace Violence, Apartment/HOA by SSO

Permalink • Print • Email • Comment

July 18, 2009

Adding Value to Hospital Security Programs

The annual security budget for most Hospital Security programs is a substantial contributor to overall operating costs of the hospital as a whole. That budget must support infant security systems, card access management systems, CCTV systems and uniformed security personnel. How much of this investment contributes positively to the bottom-line? Justifying security budgets is difficult because it’s akin to trying to prove a negative. Do you really know what your security program actually prevented?

If the hospital has a good computer-based system that tracks daily security activities and security incidents, some answers to the previous question may be forthcoming. If the computer-based security management system has sophisticated analytical capability and is able to predict trends, even more answers may be forthcoming.

However, there is one area that many hospital security programs fail to properly leverage: asset protection. Unlike the security programs of most enterprises, healthcare facilities tend to ignore, or at the very least, deemphasize the protection of property, including, but not limited to: patient property, employee property, hospital property and even cash.

Think about this; hospitals are loaded with thousand of goods and equipment anyone could use around the home or even in the operation of a business. Hospitals are loaded with food products, cleaning supplies, office supplies and equipment, linens and yes, even medical equipment, supplies and drugs.

Think of the hospital as your neighborhood department store, except for one minor difference, there is no checkout counter. One of the reasons for a checkout counter, excepting the obvious (a place for customers to pay) is to track everything going out the door through the use of scanning so there is some basis for inventory control and a means for measuring shrinkage. Hospitals tend to use less precise measurements such as cost-per-patient-day ratios as means to identify red-flags. The problem with this measure is that it is imprecise and it is not sensitive enough to identify shrinkage problems when they are still in the incipient stage.

Here is one example to make the point. When doing a total hospital security assessment a few years ago, we were anonymously tipped off that there was a cashier in the cafeteria that was “suspected” of till-tapping. This tip did not come from the food service manager who detected declining revenues and/or inconsistent over/under reports from the cash register. It came from another cafeteria worker. With the help of the security manager it was decided to go into the cafeteria at night and install a pinhole camera over the register in question. After several days of observation it was determined that our cahier was knocking the hospital down to the tune of about $150.00 to $175.00 per day. This amounted to between $700.00 to $800.00 per week and $36K or more per year, tax free. By the way, she admitted as much.

What’s the point?

The point this: There tremendous opportunities for security program to affect the bottom-line in a positive way. There is an often missed opportunity here. Asset protection programs, often referred to as “loss preventions programs,” can be set in motion with very little additional expenditures, if any at all. There just needs to be an adjustment of focus and mission. There also needs to be proactive focus and less reactive. There is no single strategy for beginning such a program. The first task is to do a vulnerability-risk assessment. Whatever is being spent on security programs today, why did get some more bang for the buck?

Going back to our department store analogy; can you imagine a department store with no universal cash handling protocol? How, many hospitals have a universal cash handling protocol?

By: William H. Nesbitt, CPP; President of Security Management Services International, Inc.

Contact Information: Phone: 805-499-3800 Email: bill@smsiinc.com; Website: www.smsiinc.com

LinkedIn: http://www.linkedin.com/in/williamnesbittcpp ; Blog: www.securitysourceonline.com

Filed under Blog, Hospital Security by SSO

Permalink • Print • Email • Comment

July 16, 2009

Good Security is About Behavior Modification

What is the purpose of every security program, security policy, security device and/or security barrier, to name a few? Answer: To alter behavior!

B. F. Skinner (March 20, 1904 – August 18, 1990) was an American psychologist, author, inventor, advocate for social reform, and a poet. He was a Psychology Professor at Harvard University from 1958 until his retirement in 1974.He is the father of Behavioral Psychology. He originated the operant conditioning chamber, innovated his own philosophy of science called Radical Behaviorism, and founded his own school of experimental research psychology—the experimental analysis of behavior. He discovered and advanced the rate of response as a dependent variable in psychological research. In a recent survey, Skinner was listed as the most influential psychologist of the 20th century.

B.F. Skinner’s view of human behavior represented a significant change to the prevailing wisdom of the day represented by the works and theories of Sigmund Freud. Freud believed that an individual’s behavior was rooted in their past. He saw behavior as predetermined. Freud is best known for his theories of the unconscious mind and the defense mechanism of repression and for creating the clinical practice of psychoanalysis for curing psychopathology through dialogue between a patient and a psychoanalyst. Freud is also renowned for his redefinition of sexual desire as the primary motivational energy of human life, as well as his therapeutic techniques, including the use of free association, his theory of transference in the therapeutic relationship, and the interpretation of dreams as sources of insight into unconscious desires.

Both Freud and Skinner did research in the changing of behavior. Freud seemed adopt notion that the behavior of individuals could be modified by punishing negative behavior. Skinner added to this notion when he found that the incremental rewarding of positive behavior could affect long lasting change.

All of these concepts are implicit in any security program or in any security design. Managing a security program is like trying to prove a negative by trying to stop something bad from happening, despite the fact you can’t be sure something bad would have happened if you did nothing. Most security programs accomplish their mission through the use of implied (if not real) threats of punishments and rewards. This means that the way a security program is perceived is even more important than how good the security program is in actuality.

For example, consider one of the most fundamental security devices, the fence. Does a chain-link fence topped of with three stands of barbed wire protect property because it is an impenetrable barrier or does protect property because it sends a message, “Do not pass”? This analogy could be applied to a security officer, to a CCTV camera, or an alarm. The fence impacts the offender’s perception and that perception alters behavior.

If one accepts these theses, security programs must exert more emphasis on affecting the perceptions of all affected parties in order affect behavior. Those affected parties may include employees, customers, visitors and would-be perpetrators. This means security programs must be built from back to front. Rather than determining where the security program should go, the better question revolves around what outcomes should the security program produce. In considering the intended outcomes of security programs, one must determine how the symbolism of various security methodologies will affect behavior. The intended result is prevention and deterrence. If the security program is perceived to be a toothless tiger, deterrence goes out the window.

It is also important that the security program convey the perceptions that illegal or dishonest behavior has consequences. Experience shows us that those enterprises that rigorously investigate all internal crime and terminate and/or prosecute the offenders have fewer security incidents, because potential offenders perceive that the tiger has teeth.

Let us consider risk/benefit ratios. The Wall Street Journal postulated the “red face test” when deciding how much security do I need. In other words, if you security is beached, will you be red-faced? Clearly the basis for any security program, whether a home, a nuclear power plant, or a hospital, the question will need to be answered, “How much security do I need to reduce risk to an acceptable level?” Additionally the risk/reward ratio for the perpetrator should also be part of the equation. The goal is to raise the perpetrator’s risk of being apprehended to be greater than the reward he or she would receive if successful.

Keeping Freud and Skinner in mind, the behavior modification component is clear. We want to reinforce and reward good behavior and punish bad behavior, or at least present a credible threat of impeding punishment.

Let’s consider some practical examples. In some applications employees perceive that the security system is omnipotent and therefore will mitigate all threats, negating the need for their active involvement and vigilance. We occasionally find this perception in hospitals. For example, some mother/baby units that employ the use of electronic tags, CCTV and alarms have experienced breaches because the clinical staff ignored the obvious. In shopping centers customers are comforted by the presence of cameras, but how would they feel if they knew no one was watching the cameras. Conversely, how much deterrence would be achieved by those same cameras if would-be perpetrators knew the cameras were not being monitored?

Security personnel can significantly enhance the deterrent value of existing security devices without any increase in cost. By applying behavior modification techniques as an active security strategy, any enterprise can do more with less. Just ask the question before moving forward: What is the desired behavioral outcome we are seeking?

If you need specifics, please respond to this blog or go to our LinkedIn site (see below) and join our group Security Source Online. Please vote the poll question on our blog.

William H. Nesbitt, CPP

President

Security Management Services International, Inc.

1168 Pan Court

Newbury Park, CA 91320

Phone: 805-499-3800

Mobile: 805-410-2300

Website: www.smsiinc.com

Email: bill@smsiinc.com

Mobile Email: SMSI@att.blackberry.net

LinkedIn:http://www.linkedin.com/in/williamnesbittcpp

Filed under Blog, Home & Family Security, At Home, Shopping, Hospital Security, Hotel Security, Mall Security, Office Buildings, Entertainment Venues & Nightclubs, School Security, Security & Liability by SSO

Permalink • Print • Email • Comment

July 11, 2009

Upcoming Presentation to Health Care Executives of Southern California - September 17, 2009 - Bahia Corinthian Yacht Club - Corona Del Mar

Program Description:

There are two assumptions that are implicit in this presentation:

1. The three preconditions for any criminal behavior are motive, means and opportunity.

2. Security, especially hospital security, is a situational discipline. This means that security programs do not lend themselves to universal solutions the way safety programs do. This presentation will first set out to define the range of risks as well as the level of threat. A number of actual security events will be discussed along with the pre-incident circumstances. This topic will be followed a consideration of methodologies to be applied to determining the level of risk both in the long run as well as the short run. Various quantitative methods will be discussed. Finally, we will present a rationale for the development of a customized security program for your hospital with the intended objective of mitigating litigation while keeping patients and employees out of harm’s way.

Speaker:

William H. Nesbitt, CPP

President, Security Management Services International, Inc.

Bill Nesbitt is an experienced security professional with more than 33 years of experience, having become Board Certified Protection Professional (CPP) certified in Security Management, in 1978. Mr. Nesbitt is one of the nation’s leading consultants in hospital security. He has not only worked with many hospitals, but he also has the perspective of seeing firsthand the effects of inadequate hospital security programs. He is a sought after speaker on topics of health care security as well as legal liability. He is an experienced expert in the court, having testified in over 600 litigations in matters related to premise liability and a wide range of use of force issues. The hospital cases have included homicides (including wrongful death claims), infant kidnappings, child molestation, rapes, and assaults on patients (including excessive use of force and improper use of restraints). In one case a 60 year old women was sexually assaulted in her bed while hooked up to telemetry. The damages sought in these cases have ranged from $500,000 to $23.5 million. This experience has given Mr. Nesbitt and his team a great deal of insight in how to mitigate security lawsuits in the healthcare environment or, at the least, lessen their impact.

Filed under Blog, Hospital Security, Workplace Violence by SSO

Permalink • Print • Email • Comment

July 6, 2009

Contract Security Guards or Proprietary (In-House) Guards

There are strong opinions on both sides of the question as to which is better, contract security officers or in-house security officers. Most of the time when I am asked the question as to which I would recommend, the questioner usually has a strong opinion, one way or the other. There really is no correct answer to the question. For one thing, all contract and proprietary guard operations are not created equally. In other words there is good and bad on either side of the question.

For example, I have seen a few proprietary guard operations that were so corrupt that they were beyond redemption. The only alternative was to disband the in-house operations and begin searching for an effective guard company to fill the bill. I have also worked with clients who have used the same guard service company for over ten years and there was no good reason to change.

All other things being equal considerations of operating cost, control, liability and consistency are all factors that must be part of the decision equation. If you total up all operational costs and your organization is tied to a rather inflexible budget, contract service may be the way to go. Having said that, going with the lowest bidder is usually a mistake. It is therefore important to develop an RFP that allows for comparing apples with apples. With some companies the value-added services that are part of the bundle, may make the difference. With the wrong company, the initial savings achieved from going with a low-baller can easily be gobbled up when you find yourself named in a lawsuit.

If there is a daily requirement that your organization will need to micromanage the day to day activities of the officers, proprietary may be the way to go. Employee turnover can also be a problem with contract services, especially if your primary decision factor is price. Even moderate turnover can be a problem for some industries, such as hospitals. In hospital security programs site knowledge as well as customs and practices are very important. There are very few black and white security decisions in hospital security. On a daily basis hospital security officers will be required to make judgment calls several times a day.

On the other hand some security directors prefer their own employees because they want more control. However, one cannot assume you will not have control with contract officers.

The point I’m trying to make is don’t make the wrong decision for the wrong reasons. Don’t allow preconceived notions to influence your tough process. If you decide to come down on the side of contract security officers, than you must choose the right vendor. We suggest that you build a decision making matrix so that you can objectively making comparisons using a reliable set of criteria. Seek input from peers and consultants you trust and respect. One more hint, the quality of the security guard labor force usually goes up during time of high unemployment. Conversely during times of high employment the quality of the labor pool goes south, especial if your organization is paying a low hourly rate. This reality applies to both contract and proprietary security personnel. Geographic wage and salary benchmarking is available.

Submitted by:

William H. Nesbitt, CPP

President

Security Management Services International, Inc.

1168 Pan Court

Newbury Park, CA 91320

Phone: 805-499-3800

Mobile: 805-410-2300

Website: www.smsiinc.com

Email: bill@smsiinc.com

Mobile Email: SMSI@att.blackberry.net

LinkedIn:http://www.linkedin.com/in/williamnesbittcpp

Filed under Blog, Shopping, Hospital Security, Hotel Security, Mall Security, Office Buildings, Entertainment Venues & Nightclubs, School Security, Security & Liability by SSO

Permalink • Print • Email • Comment

May 16, 2009

Security Budgets – Doing More With Less

Cutting security budgets does not necessarily mean cutting security programs. Sometimes a tough economy forces all of us to adapt and often do better. Organizations and programs that are able to survive, and maybe even thrive in a recession will likely assume dominance going forward. During economic downturns organizations and institutions are often forced to engage in introspection and self examination. This can be a positive exercise.

Over time, many organizations have become inefficient and bloated and fail to deliver reasonable return on investment (ROI). In a booming economy deficiencies that have built up over time are either not spotted or simply ignored. Yet during an economic backslide the errors of the past are often exacerbated by the act of making arbitrary cuts. Often these cuts are made despite the fact that these reductions may have the net effect of exposing the organization to even greater risks and vulnerabilities, a condition rife for lawsuits. The key then is to make cuts, while at the same time, without diminishing the effectiveness of the security program.

Before going any further the following assumption is critical: Security is a situational discipline. One size does not fit all. The efficacy and adequacy of any security program is determined by a wide range of individuated demographic factors. Unlike other programs, such as safety programs, security programs do not lend themselves to universal solutions.

If it is mandated that your security program must be cut, what would you do?

The first step in the self examination process is to determine where the program is now and how it got there. The only way to make these determinations is to commission a comprehensive security review. The advantages of having an outside consulting firm conduct the security program review are objectivity and comparative experience. Some security managers perceive outside consultants as a threat. The opposite is usually the case. Security Consultants are more likely going to make the on-site security managers more successful and will help them achieve more with less.

Next, it is important the assessment process and the resultant security programs that emerge are metric driven. The security programs must also make objective sense to chief financial officer and any other interested bean counters. This means that conclusions and decisions can no longer be driven by intuitiveness and professional judgment. They must be data driven. If the tracking and analytic systems are not in place, they must be initiated. Tracking and analytic data systems can be acquired from companies such as PPM 2000 (www.ppm2000.com). Systems like these are an important ingredient, moving forward, ensuring the security program remains contemporary.

Once the assessment process is completed, it is important that the consulting firm recommends efficient solutions. In the last fifteen years security technology has advanced to the point of allowing the security professional to do more with less. Without ignoring the principal that security is a situational discipline, within the confines of any security programs there are still substantial opportunities for consolidation and some limited standardization.

Although within some circles “out-sourcing” is a dirty word, it is not an all or none proposition. There are pros and cons to proprietary versus contract security services. Again, even this choice does not need one or the other. It can be a combination of both.

Security Management Services International (www.smsiinc.com) has teamed up with PPM 2000 to offer Security Management Support to existing security programs in an attempt to bring added professionalism and experience (150 years of accumulated diverse security management experience). This service, by monitoring and supporting the existing security program, increases effectiveness without the layering on an additional level of payroll burden. Remember, security errors, even under the best of intentions, can cost millions.

The critical point is, until you fully understand where you are now, and how you got here, the security program will flounder and may well be doomed to repeat the mistakes of the past going forward. Most security evaluations result in lowered cost in the aggregate. If you are asked to cut your security budget, view this request as an opportunity to get better.

Security Management Services International offers a clear alternative to outsourcing. Under SMSI’s Security Management Support Program the client maintains the existing security managers and supervisors. SMSI simply becomes another member of the team by playing a vital supportive role and brings 150 years of security expertise toward making the security program better and more cost effective without the added payroll burden. The efficiencies gained could easily offset the cost of this service. For more information, email Bill Nesbitt, CPP at: bill@smsiinc.com or call 805-499-3800.

Filed under Blog, Traveling, Shopping, Hospital Security, Hotel Security, Mall Security, Office Buildings, Entertainment Venues & Nightclubs, Workplace Violence, School Security, Security & Liability by SSO

Permalink • Print • Email • Comment

May 12, 2009

WORKPLACE VIOLENCE PREVENTION

Workplace Violence often occurs suddenly and with devastating results. These acts are largely committed against individuals, sometimes randomly as in the Virginia Tech shootings or sometimes they are committed against specific targeted individuals. The individuals who commit these acts may be career criminals, disgruntled employees or may include individuals who are involved in a domestic dispute. Workplace Violence can also result in property crimes, including industrial espionage committed by those who may have a dispute with the targeted enterprise. In some cases, there may be the added intervening variable that these acts of workplace violence are being committed by individuals who are deranged, psychotic and/or chemically impaired.

Any enterprise that has not recently conducted a complete security assessment, inclusive of a workplace violence threat assessment, may be exposing themselves, their customers and their employees to avoidable risk. We have all seen how tough economic times correlate with increased acts of violence in the workplace. We are seeing the spillage of domestic disputes moving into the workplace. The risk for violence cuts across all sectors, including both private and public enterprises.

Security Management Services International, Inc. (SMSI) cannot guarantee the mitigation of all acts of violence in the workplace. No firm can reasonably make such an assertion. However, SMSI can reasonably reduce the probability of such acts occurring through the application of comprehensive threat assessments and the implementation of prudent mitigation strategies.

Critical to reducing the probability of Workplace Violence, is the ability of the enterprise to recognize the potential threat, while that threat is still in the incipient phase. It is also important to remember that acts of workplace violence do not occur in a vacuum. In some cases, factors in the workplace may inadvertently give rise to these acts of violence, thereby requiring security awareness and sensitivity training.

Workplace Violence Prevention programs must therefore be multidimensional. These programs require training for managers and supervisors in early recognition capability as well as the skills required to avoid not becoming part of the problem. Workplace violence prevention strategies also require the application of more traditional crime prevention methodologies; the reduction of motive, means and opportunity. This requires that the integrated design of physical security remedies must also consider the impact of access management, CCTV and locking system, along with security officer training on workplace violence threat reduction. Any complete security assessment security assessment should include workplace violence threat assessment.

Security Management Services International (SMSI) regularly conducts comprehensive security assessments the address a wide range of security risks including workplace violence. SMSI will recommend mitigation strategies and will offer site specific employee training program aimed at early risk identification and mitigation.

Visit www.smsiinc.com or call Security Management Services International, Inc. at 805-499-3800.

Filed under Blog, Shopping, Hospital Security, Hotel Security, Mall Security, Office Buildings, Entertainment Venues & Nightclubs, Workplace Violence, School Security, Security & Liability by SSO

Permalink • Print • Email • Comment

May 4, 2009

Security Assessments for Healthcare Facilities

There are no shortcuts for doing an effective security audit of a hospital or for any other healthcare provider such as extended care facilities and behavioral health facilities. Achieving an adequate level of security which ensures sufficient protection of patients, employees and visitors, and at the same time, adequately protects assets is no easy task for a number of reasons. First, most administrations do not want their hospitals to look like military instillations. This means hospitals must maintain the appearance of openness while at the same time filtering out criminality. Second, one size does not fit all. There are no universal solutions for mitigating security threats and risks. Security is a situational discipline which means that the efficacy and adequacy of the security program at your hospital must be predicated on the analysis of the special needs of your hospital. The security needs of a hospital in Lebanon, New Hampshire are different than the needs of a hospital in Lynwood, California for a variety reasons.

There are no quick fixes when it comes to doing security assessments, especially hospital security assessments. There are no off-the-shelf inventories or computer based instruments that can answer the entire range of necessary questions. Remember effective security programs are all about behavior modification. This means that the elements of an effective security program are intended to deter criminal behavior. It also stands to reason that if no two hospitals have the same set of unique needs, no two hospitals require the same set of mitigation solutions.

The security assessment process is all about assessing the probability of risk and subsequently reducing the probability of those risks coming to fruition. The key then is to determine how much risk is acceptable (with some exceptions) and then determining the level of resources required to bring risk to a tolerable level with one eye on the budgetary rule of diminishing returns.

In the previous paragraph, in parentheses, we noted “with some exceptions.” There are always exceptions to the rule. In hospitals the most glaring exception to the risk/prevention ratio is found in the way most all hospitals presently protect infants. Most hospitals allocate significant resources to the protection of infants. However, the risk of an infant being taken from a hospital in any given year, even before the application of tag systems, drills and the application of security procedures and technology, is probably less than 1%. Why than do hospitals devote so many resources to the protection of infants against an insignificant statistical probability that anyone will steal a baby? The answer: The hospital cannot afford to be wrong, even once.

Security assessments usually require at least a week of on-site presence. These assessments are best conducted by experienced security professionals who truly understand the uniqueness of the healthcare environment. Security consultants should also be independent and hence should not be tied to the guard industry or to the electronic security industry. Additionally, independent security consultants have the advantage of objectivity as well as the experienced of having worked with a large cross-section of hospitals all over the country. Now, let us briefly discuss the assessment process and goals.

An important component of the assessment process is the examination of both factual data as well as the perceptions of employees. When it comes to security programs, perception is often reality. Both the actions and inactions of employees are usually predicated on the inculcated perceptions of the actor. Sometimes good security programs are perceived as being poor. Sometimes poor security programs are perceived as being good. The latter carries much greater liability and is probably the most common.

Without getting to the specific details of the Scope of Services contained in the Security Assessment Proposal, a brief discussion of some of the components of the Scope of Services may be useful.

Clearly the security assessment will focus of those areas of special concern such as:

§ The emergency department

§ L & D and postpartum

o LDRP

o NICU

§ Pediatrics

§ Medical-Surgery units

§ Behavioral Health

§ Business Office

§ Admitting

§ Parking & Grounds

§ Access management

§ HR

o Background screening

§ Pharmacies

§ Support services

§ Asset protection

§ The issue of Workplace Violence Prevention as applied to all of the above

The security assessment will look at each of the aforementioned areas of interest from more than one perspective. Obviously the application of traditional physical security protocols will be reviewed, including:

§ Security guard operations

§ Locking systems and key control

§ Access control and automated lock-down systems

§ Closed Circuit Television application

§ CPTED (Crime Prevention Through Environmental Design)

§ Lighting

§ Use of barriers such as fencing

§ Security and sustainability for critical infrastructure

§ Emergency communication

§ The application of security awareness practices

The identification and quantification of risks will be studied using a variety of sources including:

§ Anecdotal employee surveys and interviews

§ Review of site-specific security data

§ UCR crime data

§ Local police data

§ Crimecast demographics

§ Professional judgment

On the mitigation side of the equation the security professional must exercise prudence. It makes no sense to commission a security assessment that ends up on a shelf collecting dust. Therefore the security professional must endeavor to produce mitigating solutions that are acceptable to the hospital and will actually be implemented. The delivery of a set of “pie in the sky” solutions will do the hospital no good and could potential cause harm. This is why it is so important for the consultant to take the time to understand the corporate persona and mores of the organization he or she is working along with the community the hospital is serving. Solutions offered must be cost efficient and produce measurable outcomes. The least costly fixes must be developed as a precursor to more costly remedies. More often than not, the outcome of a security assessment will lower total operating costs while reducing liability.

An area of opportunity often ignored by many hospital security and loss prevention programs is the whole notion of asset protection. Most hospitals are loaded with thousands of consumable goods that the average person could use around the home such as: linen products, food products and supplies, office supplies such as toner and computer paper, cleaning equipment and supplies, etc. Many hospitals take in cash in departments such as food service, gift shops, clinics and pharmacies, yet they have no discernable cash-handling protocol. The result: a cafeteria employee is able to skim about $175.00 per day, five days per week of undetected tax-free income. A hospital is something like a large department store, except there is no checkout counter.

In tough economic times, a stem to stern security assessment makes more (cent$) sense than ever. Security programs that are not comprehensive send the wrong message. It is important that hospital security programs are developed with the same vigor and employee involvement as is being done with safety programs with a fundamental difference. Safety programs more generally lend themselves to universal precautionary behaviors. The characteristics of an effective security program will vary from facility to facility.

In closing, there is the perception of some that the role of consultants is to find fault. Some employees perceive consultants as a threat. We at Security Management Services International (SMSI) believe in positive consulting. The role of SMSI is to ascertain what is right and what is working and then help to build on that foundation to make thing better going forward. After all, most security programs have evolved overtime. It is foolhardy to assume that all of this evolution is misguided. In keeping with the assumption that no two security programs are, or should be, identical, SMSI’s mission is to discover the unique set of needs for each client and to help those clients to develop security programs that address those special needs.

William H. Nesbitt, CPP is a Board Certified Protection Professional certified in Security Management and the President of Security Management Services International, Inc. He has more than 35 years of diverse security management experience. That experience includes his participation in approximately 600 security driven lawsuits as a court certified security expert covering 40 states. He and his team have also conducted numerous hospital security evaluations and needs assessments.

Bill is a longstanding member of ASIS International, as well as, IAHSS, ASHRM, and ACHE. He is also a member of the ASHRM Patient Safety Interest Network. For questions please call: 805-499-3800.

Filed under Blog, Hospital Security, Workplace Violence, Security & Liability by SSO

Permalink • Print • Email • 1 Comment

April 27, 2009

THE WHARTON EXPERIENCE

William H. Nesbitt, CPP, recently attended the ASIS International Security Executive Program at the Wharton at the University of Pennsylvania. This article briefly explains why he attended this program and some of the benefits that were derived.

I have been a practicing security consultant since 1989. My practice has two primary thrusts, providing security expertise to a wide range of commercial and healthcare clients and the provision of security expertise as a court certified security expert. Prior to these endeavors, I spent a number of years in the contract guard industry as well as in private investigations and the electronic security industry. I became a Board Certified Protection Professional in 1978 by sitting for the very first exam held in Los Angeles. If you do the math, it’s not hard to figure out I am no spring chicken.

I was aware of the partnership ASIS International had with the Wharton School and had contemplated attending this program a year ago. I actually called ASIS Headquarters to get a few names of former attendees. I then contacted a few and the feedback I got was very favorable. Early in the spring of 2008 I again began to reconsider attending the ASIS sponsored Security Executive Program at the Wharton School. Of course by now the economy was heading south. As a security veteran of more than 30 years I first questioned whether I was over the hill for such a program and, given the economic conditions of the day, was this considerable investment prudent? This decision presented a bit of a conundrum; spending thousands of dollars for an educational program when economic times are tough.

Subsequently, I eventually believed that I needed to attend this program, precisely because the economy was going into the tank. At the eleventh hour I decided in the affirmative to register. I attended a one week session in November of 2008 and the second week in February of 2009 and never looked back. This undoubtedly turned out to be one of the best decisions I have ever made. I found this program to be intellectually invigorating and of tremendous pragmatic value. Barely a week goes by that I don’t refer to my Wharton notebooks. Because of this experience I have purchased and read about five books and continue to remain curious.

I would like to take a little time to recount with some specificity the range of practical benefits one may derive from this program. Bear in mind that as a security consultant, I knew that more than ever I would need to bring real value to my clients by not only helping them develop effective security solutions, but by also helping them develop programs that are cost-effective with demonstrable ROI.

There is a double-edged sword phenomenon that has resulted from the economic downturn. The security risks facing organizations are greater than ever, in part as a direct result of the faltering economic conditions. At the same there is an increasing squeeze down on the financial resources needed to support security budgets. In the face of rising threats there is still an inclination by some in management to cut security budgets. We have already seen several acts of violence in the workplace that have, in part, origins contingent on personal economic strife. Clearly security managers must have the required skill-sets necessary to justify their budgets with hard data. They also need to quantify the ROI their budget will actually produce. (Not always an easy task because it is akin to trying to prove a negative.)

A reasonable question therefore is: How can you best articulate, in the language of business the need to invest in proactive security programs? How can you present your strategy so the C-suite will listen and approve your recommendation? How can you manage your own resources to maximize return on investment?

One answer: The Wharton/ASIS Program for Security Executives: Making the Business Case for Security. This program offers core business knowledge from one of the nation’s leading business schools, if not in fact, the leading business school in the nation.

This quotation is worthy of consideration: "Security executives need to become business partners. We sometimes are viewed as the people you call if you have a problem. We need to be seen as partners to make sure we contribute to the business. For example, we are working on issues such as counterfeiting, grey markets, and employment terminations, all of which address key security and business issues. We need to understand the directives and strategic objectives of the corporation and look out for the best interests of the company."
—Steve Chupa, Director of Security, Worldwide Security Group, Johnson & Johnson

Tough economic times bring out the best and the worst in leadership. For those leaders and organizations for which a faltering economy brings out the worst, failure will always be lurking around the next corner. For those that preserver by adapting and innovating, success will be achieved and those individuals and organizations will emerge stronger than they were going in. The Wharton Program helps one obtain the tools for the latter.

As it turned out, this program was one of most invigorating and informative education programs I have ever attended, and I’ve attended a bunch of seminars over the past 30+ years. I looked forward to heading to the classroom each day. As much as I gained from the Wharton faculty, I also gained immeasurably for the interactions with my peers, both in and outside the classroom. I would like to highlight a few of reasons for this statement.

First, the faculty is second to none. The folks at Wharton are not ivory tower academics steeped in theory. These professors all keep one foot in the academic world and the other foot in the real world in that they all do a substantial amount of outside consulting with Fortune 100 companies down to small local enterprises, and they do so worldwide. They understand the global marketplace the global economy that the marketplace must function within. There are also the benefits derived from interaction with fellow classmates which adds to the richness of this program. Additionally, this program does not allow passive participation. The attendees are exposed to theories and operational concepts and subsequently these theories are immediately put into practice through interactive role-playing.

One of the highlights of week one was when all of us were exposed to teaching by analogy. The following example also helps to convey the richness of this program. Prior to making the trip to Wharton, we were all invited to read a book entitled “Killer Angels” a novel recounting the Battle Gettysburg in 1863. We subsequentially learned that the reading of this book was preparatory to spending a full day at the Gettysburg Battle site with a Certified Battle of Gettysburg Historian. One might question the relevance of studying a single civil war battle in detail while attending an executive training program at Wharton. It all became clear when, on a cold blustery November afternoon, under the branches of a large oak tree, the professor queried; “If General Lee was running General Motors today, what would his management style be? How do you think he might resolve the current crises?” Similar question were posed throughout the day requiring each of us to apply our analysis to other Generals and battlefield commanders form both the Union Army and the Confederate Army.

The Wharton program for security executives provides the attendee with a set of tools by which to move a security program forward in a manner consistent with the corporate culture of the affected organization. This program also recognizes that no two corporate cultures are alike and that as security professionals, we each would be required to understand the culture and mores of the organization we were dealing with when we returned home. One of universal concepts that came through loud and clear is that corporate decisions, especially those requiring budgetary resources, must be data driven and expressed in quantitative terms. This approach is clearly within the value system of those whose organizations are metric driven. To quote John Percival, a member of the Wharton faculty, “Before you ask the company to spend money, you must know how they keep score.”

This program is not only instructive for those seeking to develop utilitarian security plans, but it is also very helpful in providing the tools required to make it happen. The program spends significant time on the ways and means of negotiations and both internal and external marketing strategies in furtherance of an effective security plan.

Finally, this program also recognized that all who attend this program are not created equally. As a precursor to both sessions, those of us who signed on to the program where asked to respond to a number of diagnostic inventories. These instruments were scored at the resultant profiles were provided to each attendee. The information provided by these instruments gave each of us greater insight into out strengths, preferences and management styles. The ability to asses a situation or to enter into a negotiation is enhanced if one better understands their own strengths and weaknesses as well as their biases.

I’ve attended numerous seminars and workshops over the years. After attending these workshops I come home with notes and handouts. Often these materials are placed on my desk and after a few months they find their way to a bookshelf or file drawer. Every year or so, the file drawers are purged and the materials are eventually discarded and the workshop fades in to a distant memory. This result seems very unlikely with the Wharton Program. The Wharton Program for Security Executives, at least in my case, has stimulated me to learn more. I know that what works today, may not work tomorrow. This means that in order to adapt and change. I must see change coming. Clearly this program has provided the tools to meet these challenges.

William H. Nesbitt, CPP

President

Security Management Services International

1168 Pan Court

Newbury Park, CA 91320

Phone: 805-499-3800

Mobile: 805-410-2300

Website: www.smsiinc.com

Email: bill@smsiinc.com

Mobile Email: SMSI@att.blackberry.net

Filed under Blog, Shopping, Hospital Security, Hotel Security, Mall Security, Office Buildings, Entertainment Venues & Nightclubs, Workplace Violence, School Security, Security & Liability by SSO

Permalink • Print • Email • Comment

April 20, 2009

Security Management Support For Limited Security Budgets

How To Manage A Security Program Without Added Payroll Burden

Tough economic times require innovative approaches in support of effective security management. An economy in free fall, coupled with rising unemployment on one hand, places ever increasing demands on security programs, while on the other hand resources in support of these of these security programs are shrinking. Security Management Services International, Inc. (SMSI) through its Security Management Support Program (http://www.smsiinc.com/services/virtual.html) offers an effective and cost-efficient solution. Organizations that make indiscriminant cuts in their security programs increase the probability of losses, and greatly increase the potential for liability driven litigation. Therefore the emphasis should not be on cutting, but rather should be on efficiency.

The SMSI Security Management Support Program provides a means by which organizations can maintain and improve the effectiveness of their existing security program while avoiding the payroll burden of a high paid security professional. The SMSI team is comprised of a diverse group of Board Certified Protection Professionals (CPP). These security professionals have expertise is such specialties as healthcare, hotels, shopping malls, high-rise commercial buildings, biotech and manufacturing operation. This group of SMSI security professionals understands the proper application of mitigation strategies such as security guard operations (either contract or proprietary). The Security Management Support Program can be applied to security system design inclusive of locking systems, card access systems, alarm systems and CCTV applications. With SMSI’s support, the effectiveness for organizations to deal with a wide range of security vendors will be enhanced thereby avoiding unnecessary expenditures.

Every security program can benefit from 150 years of accumulated diverse security expertise.

The Security Management Support Program is not intended to replace the existing security program. It is intended to take the existing program to a new level by supporting existing security management with a wide range of support services including unlimited telephonic guidance and problem solving. SMSI will provide this service on an annualized basis. A customized Agreement will delineate the Scope of Services to be provided. The underlying assumption of these offered services is that many organizations cannot support the payroll burden of 150K+ security professional, yet most organizations need this level of expertise in order to insure high quality while at the same time, achieving cost containment.

One of the backbones of this offering results from a strategic partnering between Security Management Services International and PPM 2000, the world’s foremost developer of Security Management software.The monthly subscription fee will included the hosted use of PPM 2000 Perspective Premium Incident Tracking Package. Critical to the security management process is the ability to make sound security business decisions going forward, predicated on real need. Security expenditures must be data driven and must produce measurable pay-back. The use of Perspective Premium will allow for the detailed tracking of security events, the early identification of trends and the early ability to mitigate future braches before things get out of hand. The analytic capability of the software is critical in assuring optimal ROI.

SMSI and PPM 2000 will set up the software and will assure it is customized to meet the unique needs of each client. Both the client and SMSI will have the capability to monitor recorded incidents and to subject this data to sophisticated analytics both investigative as well as remedial purposes. It is important to remember that security is a dynamic discipline and security programs must continually adapt and adjust to emerging trends and threats. Effective security programs should always strive to reduce the probability of liability claims.

Another important component of this offering occurs at the onset of the initiation of the Service Agreement. Immediately after the mutual acceptance of the Agreement, SMSI will conduct a thorough security assessment of the facility or facilities covered by the Agreement. This assessment sometimes referred to as a Security Audit, can range in cost from $7k to $50k and up. Security Management Services International believes that an initial security assessment is important for a number of reasons. First, in the majority of cases, when providing these assessments as a stand-alone service, SMSI almost always discovers opportunities to save money and/or improve efficiency and productivity. Second, often new, yet unaddressed threats are discovered which often require low cost remedies such as employee awareness training. Finally, it does not make sense to develop a forward looking security program without first establishing a foundational basis on which to build.

The Assessment will also include analysis of local crime data as well as the provision of a CAP Index Crimecast Report and a CAP Index Proximity Report (www.CAPIndex.com). SMSI will analyze this accumulated data and provide a context for any suggested improvements. Every client will receive a bound report including photographic support.

The cost of the Assessment will be offered substantially below the stand-alone rate and the majority of the cost will amortized over the term of the first year of the Agreement.

SMSI Assumptions

The client has, or is considering implementation of an enterprise-wide formal security program and strategy.
The program has a designated security manager or an individual responsible for oversight of the security program in addition having other managerial responsibilities.
The security program has or intends to include the application of security measures, that may include, but is not limited to:
- Access management system
- Closed circuit television usage
- Alarm system
- Information protection programs
- Uniformed security personnel
  - Contract
  - Proprietary
- Investigation personnel
The enterprise is composed of an excess of 100 employees

Security Management Support Components

The basic components of Security Management Services International’s Security Management Support Program include, but are not limited to:

An initial comprehensive security assessment. (It is important to establish a foundational basis from which to move ahead and to build upon moving forward.)
- Physical security audit
  - Lighting
  - CPTED (Crime Prevention Though Environmental Design)
  - CCTV
  - Access management
    - Card system
    - Locking systems
  - Security personnel usage
- Pre-employment practices
- Inventory and supply chain management security
- Exterior and perimeter security
- Security training needs
- Security awareness programs
- Internal & external crime threat levels

Development of a Security Plan
- Mission statement
- Job descriptions
- Workplace Violence Prevention
- Metrics
- RFP development if deemed necessary
  - Vendor selection oversight

Initiation of Perspective Premium Incident Management System
- Establishment of the Perspective Premium Incident Management program
- Security Management Support in setting up Perspective to ensure it meets site specific needs
  - Establishment of Perspective reporting, and other output functionality
    - Customized Reports
    - Charts
    - Graphs
    - Multimedia Presentation Capabilities
    - “State of the Art” Analytics
  - Ensuring that security decisions are data driven

Establishment of Security Management Support structure
- Development and defining the support role of Security Management Services International, including but not limited to:
- Response to special needs protocol

Investment
- A one-time modest retainer
- Contract for One Monthly Fee for Security Management Services, inclusive of the Perspective Premium monthly subscription

Benefits
- These combined services clearly fit the description that “The whole is greater than the sum of the parts.”
- The value of these bundled services is greater than the cost of the individual components.
- The likelihood of reduced liability.
- The reduction of both internal and external losses.
- The assurance of achieving greater value and return on investment from the accumulated security vendors.
- The result of maintaining a contemporary security program that addresses the needs of today and tomorrow.

Summation

Security Management Services International, Inc., through its Security Management Support Program is offering an innovative and unique alternative for the management of the security needs for a wide range of clientele. Organizations that may benefit from this innovative approach to security management include, but are not limited to:

§ Hospitals

§ Shopping centers

§ Apartment complexes and HOAs

§ Retirement and Elder-Care facilities

§ High-Rise Commercial Buildings

§ Manufacturing plants

§ Bio-Tech facilities

§ Educational institutions

§ Hotels

SMSI does not seek to replace the existing security program, its management and/or personnel. This programhas as a primary mission of enhancing the existing security program by improving its value added impact to the organization it serves. All too often securitydecisions areintuitively derived and may or may not sufficiently address specific needs. SMSI believes that security programs should be need drivenpredicated on hard data.

Filed under Blog by SSO

Permalink • Print • Email • Comment

April 15, 2009

Avoiding Security Litigation in a Healthcare Setting

The most common response to an adverse security event in a healthcare setting is: “We never thought it would happen here.” That is what the folks in Carthage, N.C. probably thought as they try to unravel the mystery of why a 45-year-old painter tore through a North Carolina nursing home on a terrifying rampage that left eight dead; a slaughter halted by a single shot fired by a decorated police officer responding alone to a 911 call. Other shootings in New York, Pennsylvania and Washington, all within a two week time frame, demonstrate the possible relationship between tough economic times and acts of violence. Recently a baby was abducted from a hospital in Santa Barbara, California. Even though the baby was recovered within three hours both the hospital and the parents of the child were traumatized. Most likely the mother/baby unit of this hospital thought their security program was sufficient and that it “would never happen here.” On April 16^th a Long Beach, California hospital pharmacy employee went on a shooting spree killing two before turning the weapon on himself ending his life.

As a security consultant and a court certified forensic security expert for approximately 600 litigations over the past 30 years, encompassing about 40 states, I have seen the aftermath of these acts. The hospital cases I have seen have included homicides of both patients and employees and have included sexual assaults, child molestations, elder abuse, infant abductions and assault and battery. I have also seen intentional tort cases such as sexual assault by employees against patients and use of excessive for by security personnel and by behavioral health workers.

The potential for security litigation is further enhanced by the general milieu of the healthcare setting itself. Generally speaking healthcare employees are altruistic and nurturing. As one would expect, clinical personnel are focused on patient care, but all too often at the exclusion of staying alert to security threats. The architecture of most hospitals affords virtually hundreds of points of ingress and egress. Most hospital administrators support this open architecture because they want to want to portray a welcoming sense openness to the community they serve. These factors and others make hospital security a challenging enterprise. Unfortunately, all too often, effective security programs do not emerge until there is a sentinel or near-sentinel event.

The challenge becomes, “How do we prevent patients, visitors and staff form being victimized by crime, while at the same time maintaining a perception of openness.” The key is, to use a football analogy, “Establish a bend, but don’t break, defense.” This means, it is a given that folks will enter our hospital that we would prefer would go elsewhere. Therefore the hospital must control where these folks go and what they can do.

How can a hospital ensure the safety of their patients and employees?

No security program, in any environment, can guarantee safety. Security programs are all about managing the probability of occurrence. Security programs must reasonably reduce the probability of criminal opportunism. Security is also a situational discipline. This means that security programs must fit the individuated needs of each hospital and no two security programs are, or should be, the same.

The only way to achieve these objectives is to conduct a complete security assessment of all hospital operations. The purpose of a security assessment is not to establish a ceiling for security remedies, but to rather establish the foundation on which to build upon for the foreseeable future. The only way to ensure an effective security and loss prevention program is to make sure that your security program is predicated on the unique set of identified needs of your hospital. This is the only means by which your security program can move from reactive to proactive. Typically hospital security assessments are and should be conducted by qualified healthcare security experts who also bring the perspective of objectivity to the task at hand.

On the solution side of the equation, without getting in to the plethora of potential security measures from guards to CCTV and everything in between, let us consider a few of the components that should be included in all hospital security programs. The single best and most cost-efficient security methodology is the full and enthusiastic participation of all employees in a comprehensive security awareness program. Anecdotally, we have found that the most frequent common denominator in most hospital security lawsuits is employee apathy and inattentiveness. By way of example, we have experienced cases where nurses have held the door open for a perpetrator who is walking out with a baby. We had a case involving the sexual assault of the female patient while hooked up to telemetry. In a case involving the homicide of a patient, 15 staffers, after-the-fact, reported seeing a “suspicious person” at various locations within the hospital, but none took action. All too frequently aberrant behavior is not recognized and dealt with in the incipient phase.

The same effort that goes into to promoting safety and infection control should be applied to security and loss prevention. Security needs to be sold as part of a positive value system. This effort must begin during effective new-employee orientation and must be reinforced on a continual basis thereafter. Hospitals cannot assume employees will “do the right thing,” nor can they assume that employees that employees even know how to do the right thing.

It is reasonable to assume that sooner or later a qualified security professional will do a security assessment of your hospital. If it is not done sooner, it will surely be done in the wake of a major security breach. The problem with the later approach, that security assessment will be conducted by the plaintiff’s security expert.

William H. Nesbitt, CPP is a Board Certified Protection Professional certified in Security Management and the President of Security Management Services International, Inc. He has more than 35 years of diverse security management experience. That experience includes his participation in approximately 600 security driven lawsuits as a court certified security expert covering 40 states. Bill is a longstanding member of ASIS International, IAHSS, ASHRM, and ACHE. He is also a member of the ASHRM Patient Safety Interest Network. For questions call: 805-499-3800. Visit www.smsiinc.com

Filed under Blog, Hospital Security, Workplace Violence by SSO

Permalink • Print • Email • 1 Comment

April 6, 2009

Security Management Support Program

Security Management Services International, Inc & PPM 2000

A Strategic Partnership

Security Management Services International, Inc. (www.smsiinc.com) is offering a unique and innovative approach to cost-effective security management. The security challenges facing enterprises in today’s economic environment can be daunting. The nature of these security challenges ranges from the threats posed by a wide range of criminal enterprise on one hand and on the other hand finding the means to address these challenges with limited and scarce resources. Security programs are asked to cut back, even as threats and risks are on the rise. Tough economic times also produce a whole new set of security concerns. This means that Security Programs must be more effective and more sophisticated while at the same time operating on tighter budgets. Security Programs must therefore be specifically targeted to meet the unique needs of the organizations they serve and this mission must accomplished efficiently with cost effectiveness.

Meeting these objectives requires experienced security management coupled with the application of the latest security technology. This security technology must be applied appropriately toward the solving of security problems through the effective use of CCTV, access management systems and alarm systems. When required, security vulnerabilities will need to be addressed through the effective use of security personnel, including uniformed officers. In today’s economic environment all of these decisions going forward must be data driven. Security programs that are not driven by metrics will not be effective and they will not stand the test of time.

In order to ensure that security programs are predicated on hard data, and that security programs remain dynamic and capable of adjusting to new and ever-changing challenges, Security Management Services International (SMSI) is offering a unique combination of cost effective services to their clients, enabling them to meet the challenges of tomorrow with cost-efficiency.

In order to deliver these security management services, SMSI has formed a Strategic Partnership with PPM2000 (www.ppm2000.com), the world leader in the development of Security Management Software. Through the useof PPM 2000’s Perspective Premium Incident Management Package, SMSI will beable to monitor their clients’ security events. This will allow SMSI to spot trends early-on and make the necessary adjustments aimed at extinguishing sparks well before they become fires.

The SMSI Security Management Support Program (SMS) is intended to support existing security programs by providing less experienced in-house security managers with the support of a group of highly experienced Board Certified Protection Professionals Certified in Security Management. This management support will be facilitated through the use of PPM 2000’s Perspective Premium Security Management Software. This software will be provided by SMSI on a subscription basis and will reside on a secure hosted site with no local software installation required.

SMSI Assumptions

The client has, or is considering implementation of an enterprise-wide formal security program and strategy.
The program has a designated security manager or an individual responsible for oversight of the security program in addition having other managerial responsibilities.
The security program has or intends to include the application of security measures, that may include, but is not limited to:
- Access management system
- Closed circuit television usage
- Alarm system
- Information protection programs
- Uniformed security personnel
  - Contract
  - Proprietary
- Investigation personnel
The enterprise is composed of an excess of 100 employees

Security Mananagement Support Components

The basic components of Security Management Services International’s Security Mananagement Support Program include, but are not limited to:

An initial comprehensive security assessment. (It is important to establish a foundational basis from which to move ahead and to build upon moving forward.)
- Physical security audit
  - Lighting
  - CPTED (Crime Prevention Though Environmental Design)
  - CCTV
  - Access management
    - Card system
    - Locking systems
  - Security personnel usage
- Pre-employment practices
- Inventory and supply chain management security
- Exterior and perimeter security
- Security training needs
- Security awareness programs
- Internal & external crime threat levels

Development of a Security Plan
- Mission statement
- Job descriptions
- Workplace Violence Prevention
- Metrics
- RFP development if deemed necessary
  - Vendor selection oversight

Initiation of Perspective Premium Incident Management System
- Establishment of the Perspective Premium Incident Management program
- Security Management Support in setting up Perspective to ensure it meets site specific needs
  - Establishment of Perspective reporting, and other output functionality
    - Customized Reports
    - Charts
    - Graphs
    - Multimedia Presentation Capabilities
    - “State of the Art” Analytics
  - Ensuring that security decisions are data driven

Establishment of Security Management Support structure
- Development and defining the support role of Security Management Services International, including but not limited to:
- Response to special needs protocol

Investment
- A one-time modest retainer
- Contract for One Monthly Fee for Security Management Services, inclusive of the Perspective Premium monthly subscription

Benefits
- These combined services clearly fit the description that “The whole is greater than the sum of the parts.”
- The value of these bundled services is greater than the cost of the individual components.
- The likelihood of reduced liability.
- The reduction of both internal and external losses.
- The assurance of achieving greater value and return on investment from the accumulated security vendors.
- The result of maintaining a contemporary security program that addresses the needs of today and tomorrow.

Summation

§ Hospitals

§ Shopping centers

§ Apartment complexes and HOAs

§ Retirement and Elder-Care facilities

§ High-Rise Commercial Buildings

§ Manufacturing plants

§ Bio-Tech facilities

§ Educational institutions

§ Hotels

Filed under Blog, Shopping, Hospital Security, Hotel Security, Mall Security, Office Buildings, Entertainment Venues & Nightclubs, Workplace Violence, School Security, Security & Liability by SSO

Permalink • Print • Email • Comment

• Next Page »

January 27, 2010

January 1, 2010

December 1, 2009

November 25, 2009

November 22, 2009

November 17, 2009

November 12, 2009

July 29, 2009

July 18, 2009

July 16, 2009

July 11, 2009

July 6, 2009

May 16, 2009

May 12, 2009

May 4, 2009

April 27, 2009

April 20, 2009

April 15, 2009

April 6, 2009

Recently Posted

Departments

Take our Poll!

Archives

Friends

Security & Law Enforcement Resources

Security Providers

Speaker's Bureau

Website Development