Imagine two NGOs responding to the same humanitarian crisis. It is a scenario we see every day in every conflict area in the world. Both want to assist the same population. Both have experienced staff, appropriate funding and a clear humanitarian mandate. Yet one organisation operates relatively close to an active conflict area, while the other decides that its staff will not travel anywhere near the frontline.
Neither decision is automatically right or wrong.
But they are fundamentally different security strategies, and those strategic choices determine much of the operational reality for the people who travel, work and live there on behalf of these organisations.
How much risk are we willing to accept?
Security risk management is sometimes treated as a technical exercise: identify threats, assess likelihood and impact, introduce mitigating measures and calculate residual risk. But before doing that, the real basis of good security risk management needs to be laid. An organisation needs to answer a more fundamental question:
How much risk are we actually willing to accept to achieve our objectives? How much do we think it is worth to complete our mission?
This is the organisation’s risk appetite. The maximum amount of risk with which an organization is willing to deal. To make this operational, parameters need to be defined: risk tolerance helps establish these boundaries between risks that are acceptable and those that are not. This seemingly abstract management decision has very practical consequences.
In our work in e.g. Ukraine, this determines in the end whether one organization acquires armoured vehicles, bullet proof vests and drone detection to reach those villages near the frontline, and that other organizations, with the same quality and funds, will decide to invest their staff and assets differently and to operate further away from the frontline.
So, a NGO with a comparatively high risk appetite may accept operations in conflict-affected areas because reaching vulnerable communities is considered sufficiently important to justify greater exposure. This does not mean accepting risk recklessly. It means investing in the measures necessary to bring those risks within the organisation’s agreed tolerance (e.g. the armoured vehicle and personal protection equipment (PPE)).
Another NGO may decide that proximity to active hostilities exceeds its tolerance regardless of the available mitigating measures. Its programmes may consequently need different locations, partners, and staff expertise.
Strategy eventually reaches the traveller
This is where organisational strategy becomes personal.
Risk appetite should ultimately influence questions such as: Where may staff travel? Which transport can they use? What PPE should be in place? When is professional security support required? What training should staff receive? Which activities require additional approval? And at what point should an operation be suspended?
In other words, travellers should not be expected to define the organisation’s appetite for risk themselves while standing in the field. The organization should define the risks and then inform staff, train them, and send them out prepared. Facing the risks the organization and they themselves, after their own informed consent, are willing to take for their mission.
Security management is not about avoiding all risk
Perhaps most importantly, good security strategy is not synonymous with being risk-averse. Humanitarian organisations frequently operate precisely where circumstances are difficult and uncertainty is high. So, the objective of humanitarian security risk management is not about a yes- or no question if they need to take risks, the objective is to enable organisations to reach people in need while managing risks to staff to an acceptable level for that organization.
The important question is therefore not:
“How do we eliminate the risks?”
It is:
“Which risks are we prepared to accept in pursuit of our mission, which risks are we not prepared to accept, and what must we do to protect our people within those boundaries?”
When leadership can answer those questions clearly, security stops being merely a list of rules for travellers. It becomes the basis of an organisation’s strategy and their operational protocols for their staff.