As an example, let’s suppose that one area of concern is that you have noted a disturbing trend of more frequent workplace violence incidents at a particular location. In the incident reports there is embedded data you can pull out, e.g., frequency, location, time, contributing conditions or circumstances, impact to the business, the perpetrator was an insider or outsider, and so on.
Now let’s move from an incident trend to metrics. What gaps in the security may be contributing to this increase in frequency and severity of workplace violence incidents? Is there a pattern that suggests a broader set of risks? What business processes may have failed, e.g., which ones should have mitigated these risks but did not and who owns these processes? We need to drill down beyond symptoms and reveal root causes. For example, you may discover Security was not informed by HR of pending terminations. Or 34 percent of incidents on the night shift involved alcohol.
This is serious business about known risk. We need to get to the business value metrics to show results of our mitigation efforts. For example, the resulting percent reduction in on-the-job violence incidents, the percent of reductions in alcohol-related cases and the avoidance of cost from potential litigation; the percent increase in reporting of restraining orders, which enables our protection strategy; and the fact that incident post mortems demonstrate that training and intervention techniques have thoroughly engaged shift supervisors and provided measurably improved incident response. The bottom line result is that employee surveys shows improved perception of safety.
Security needs to develop key business performance metrics. The next step is to effectively communicate these value stories.
Answer provided by George Campbell, Security Executive Council Emeritus Faculty.
Editor’s Note: Click here for an excerpt of George Campbell’s book on this topic, Measures and Metrics in Corporate Security.