Security Executive Council Faculty Advisor

Time Utilization and Staffing Capacity Analysis

Q. My company is in the midst of a reduction in force (RIF) and security is one of many areas being required to provide senior management with an analysis of time, cost of services and programs and staff utilization. What is the most effective way to approach this exercise, keeping in mind that the goal is to maintain our current level of full-time equivalents (FTEs)?

A. The first thing you should do is to perform a staffing capacity analysis to determine whether tasks being completed are mission critical and which are optional. Decide who does what and whether that is the most effective use of their time. Most staff work more than 40 hours a week; however, much of that time may be spent on noncritical – or optional – tasks that could either be eliminated or performed by someone else, e.g., a manager who averages 60 plus hours a week but spends at least 10 hours performing tasks that would be better suited for an administrative person.

Know the capacity levels for your staff and look for ways to effectively transfer duties accordingly. Develop a spreadsheet or chart to present to senior management that shows in a nutshell what your staff spends its time doing. Keep in mind that your primary objective is to demonstrate the criticality of those tasks in regard to functionality of the department as a whole.

Do a time-cost analysis on these positions and duties to determine the best use of your staff’s time and resources. Then present this data to senior management in a way that shows the true cost of security.

For an example of a time utilization chart contact us at contact@secleader.com

Answer provided by Bob Hayes, Managing Director, Security Executive Council.

Survival - 20 Minutes with the Board

Q. I have been asked to make a presentation to my company’s Board of Directors. Any words of advice?

A. First and foremost this should be viewed as an opportunity, not a risk. If you come prepared good things can happen.  Preparation is key. You have been given an opportunity to educate and potentially influence the decision makers of your company. Don’t take it lightly; you never know when the opportunity may come again. Consider the following:   

• Know your material, understand what is expected and focus your presentation. Know the committee’s degree of subject matter knowledge and appropriately level your presentation.  Be aware of the history and the committee’s current position on the topic; then practice, practice and practice your presentation.

• Talk to others who have been there and done that in the past. Ask the committee secretary what to expect, ask your boss for words of advice; all in an effort to get a lay of the land (hierarchy, roles, etiquette) and help manage your expectations. 

• Introductions. Understand to whom and how introductions will be made.  Take a little pre-meeting time to know who the attendees are and what they look like. Most companies have “face shots” and bios of their Board members and senior management.  

• Be punctual. Not too early and certainly not late. Hanging around waiting on your turn will just increase your anxiety, and being late will not only increase your anxiety but will certainly annoy the committee members. 

• Stay within your allotted time. Respect others time and don’t go over unless asked to do so. Often, the time allotted is not sufficient to address the topic, so know what’s really at the heart of the topic and, like it or not, your allotted time may be reduced at the last minute due to items beyond your control. Be prepared to present your 20-minute presentation in 10.

• Dress appropriately. Just because it’s casual Friday doesn’t mean khakis and a golf shirt are appropriate.  Have a clear understanding of what the expected dress is. It’s better to be a little over dressed than under.

• Presentation format. Know the desired and acceptable presentation format. Is it power point and if so what about backgrounds, animation and slide quantity? Should there be handouts and if so what about distribution - before, during or after? Don’t risk becoming a victim of technology; have hard copy back-up presentation materials available.

• Know the room setting. Are all participants in the same room? Will you be expected to stand at the head of the room while giving your presentation? Is there assigned seating and if so where will your seat be? Are there other room protocols that you should be aware of such as do you wait outside the room until summoned or are you welcome to enter the room upon arrival and if so through what door? 

• Get a good night’s sleep. This is not the time to stay out late and indulge.

• Eat light and mild. You don’t need a growling stomach or a stuffed one and you certainly don’t need to facilitate the production of stomach acid.

• Manage the caffeine. There is no need to be more on edge or chemically induce hyper behavior.

• Personal hygiene. Comb your hair, brush your teeth, use the rest room. Keep your audience focused on the topic not on the out of place hair on your head or the poppy seed stuck between your front teeth; and who knows when you’ll need or get a restroom break.

• Current affairs. Be aware of current affairs, especially those that could affect business and management perspectives. As an added bonus, be aware of social happenings that might be of interest to your audience; you never know when the meeting may go slightly off target to address a new item or just idle chit chat.

• Messenger. Whether you are delivering good news or bad news, approach your topic appropriately.  Delivering good news is a lot easier than delivering bad news, but someone has to do it and if you’re the chosen one, do it well.  

Board presentations can be challenging and certainly a little nerve racking.  Each will be a little different, but generally speaking if you know the rules of engagement, are aware of the group dynamics, pay attention to housekeeping and properly prepare your presentation, you should be the better for the experience. 

Answer provided by Kenneth Kasten, Security Executive Council Emeritus Faculty.

Making the Case for Capital Funding

Q. I need to obtain a large sum of funding for a security capital project.  What advice can you offer to help improve my case when submitting the request?

A. Each company has its own forms and processes, but generally speaking there are some basic guidelines that one should follow when presenting a case for project funding.  It’s important to know your audience, manage your time and prepare a thoughtful document that has considered the following:  

• Title Page: Include the project name, the individual and department names of who has prepared and is presenting the request, the date and any other information that is a company requirement.

• Table of Contents: Include section numbers, section/subject names and page numbers.

• Executive Summary:  First impressions are vital.  Clearly and concisely state your case; a project overview of who, what, why, when and how.    Who’s asking? What are you asking for? Why are you asking? When will the funds be used?  How will the funds be used?   All within a paragraph or two with supporting detail elsewhere in the funding request document.

• Project Description: Describe the project – history, recommendation, justification, strategic fit and alternatives.

- History.   Present the project history; what is it that has brought you to this point?  Have there been previous requests?  Is the existing system on its last leg? Is it costing more to maintain than it would be to replace? Have technology advancements passed you by?  Do new contractual agreements require a change?  Do changes in regulatory requirements necessitate a change?  

- Recommendation.  What is it you want and why do you want it? What homework (benchmarking, testing, industry reviews) have you done to ensure this is the best answer for your situation? How long will it take to complete the project?  What are the action steps of the project (testing, phased implementation)?  Are there business partners (vendors, suppliers, internal departments)?  Is there a long term or temporary operational business impact? 
 
- Justification. A simple but not always obvious and very important question – why is it needed?  Not only why is it needed but why is it needed now (replace failing systems, regulatory compliance, client requirement).  What’s at risk if you don’t complete the project (business risks, loss of client, government or industry fines and/or sanctions, security risks, employee/customer safety)?  What value will it bring to the company (reputation, client/customer value add, industry differentiation)?  Is there an actual return on investment (ROI)?  Is the project needed to meet contractual or industry requirements? Will this project result in potential business (marketing or sales) opportunities? 

- Strategic Fit.  How will this purchase fit with company and/or security department strategic goals, objectives and long range plans?  How does this project fit with other business units, sector or department goals or objectives?  How might this purchase facilitate and or support future business or security opportunities?

- Alternatives. What alternatives have you considered and why did you not choose them; other products, other timelines or other solutions?

• Request: Don’t forget to ask for the funding.   How much will it cost?  What will it buy; hardware, software, installation costs, operating costs (maintenance consumables, initial start-up costs).  Are there tax implications or purchase incentives?    Can related existing systems be repurposed?   Are the funds budgeted?  Remember to include a properly prepared and approved financial summary.

Check your math, dot your “i’s” and cross your “t’s”. It’s very important that your request be professional and complete.  Take the extra time to ensure you are prepared to answer any question or challenge that may come your way.  While you may not get the funding you’ve requested it should not be because you failed to properly prepare.  Generally speaking funding is a matter of prioritizing available dollars and while you may not get your money this time, priorities change.

Answer provided by Kenneth Kasten, Security Executive Council Emeritus Faculty.

Evaluating Your Company’s Business Ethics Hotline (Whistleblower) Process

Q.  I’m part of a team that is evaluating our company’s business ethics hotline (whistleblower) process.  We are trying to decide if we should manage the process ourselves or hire a third party.  What should we consider as part of our due diligence and decision? 

A.  While there may be some general designs for a business ethics hotline program, each company’s program must be detailed to fit its business operations and culture. There are a number of design decisions that must be made along the way and one of those decisions is whether to manage it yourself, hire a third party or implement some combination of both.  When making this decision, there are a number of points to consider, evaluate, compare and prioritize while determining which management process best meets your needs.  The priority and relative importance of each of these points will vary by company.  Items to consider include:

• International vs. Domestic – Will your hotline reach out to an international audience?  An International audience brings potential challenges with language, local costume and culture, local laws and regulations, time differences and technical support.

• Service Level – What is an acceptable service level? How much time is allowed to address an issue? How many hours (or days) are allowed from when the issue is received to start and completion of the  investigation? 

• Service Hours – What will be the desired hours of operation? Will all these hours require live call answer or voice mail, or a combination of both? What resources (personnel, technical and physical) will be required to accommodate the desired hours and method of operation?

• Call Volume – What is your current or anticipated call volume? What resources (personnel and technical) will be required to manage the call volume within acceptable service levels? 

• Confidentiality – Is there a concern with third party knowledge of the issues raised on the company hotline? Is there a concern (real or perceived) or a need for “arms length” objectivity? How will caller anonymity (perception or reality) be maintained?

• Company Culture and Business Operations – How important is (good) knowledge of company operations and culture to receiving and interpreting incoming calls and issues?  Will a third party provider have enough company knowledge to properly triage hotline calls?

• Resources (personnel) – What personnel resources will be required to manage an outsourced hotline operation? What personnel resources will be required to manage a proprietary hotline operation?  Is this a function that can be added to existing operations?

• Resources (technical) – What technical resources will be required to manage an outsourced hotline operation? What technical resources will be required to manage a proprietary hotline operation?  Is this a function that can be added to existing operations? How often will technical (hardware/ software/website) updates be required? Is it acceptable to have technical breaks in service? Must redundant operations be available?

• Resources (physical) – What physical resources (office space/equipment/furniture) will be required to manage a proprietary versus an outsourced ethics hotline operation?

• Administrative – How much of the hotline operation can be outsourced?  Is it all or nothing?  Can a hybrid process be created to meet company needs?  What services are needed; incident reporting (call center/website/e-mail/postal), incident tracking, investigative, management reporting, program and awareness communications?

• Incident Receipt/Delivery – What are the requirements for hotline information receipt?  Telephone (long distance requirements), email, text message, website, postal?  Are all calls to be answered live or is voice mail acceptable?  

• Data – What are your company or regulatory requirements regarding data protection and privacy for whistleblower related materials?  What are your company requirements regarding incident reporting, incident tracking, management reporting and benchmarking? 

• Cost – How do the costs compare? Are they justifiable? Can a third party program be customized allowing the option to purchase only what is really needed and desired? 

• Legal – Does local law (US Federal Sentencing Guidelines/Sarbanes-Oxley/EU Whistleblower Guidelines) or industry or contractual agreement (labor or clients) require a particular type of hotline (whistleblower) process?  Is there a reliable process to ensure on-going legal compliant operations in all markets?

• Other – Does outsourcing offer other service (security case management/assistance lines/client services) opportunities?  Are there specific or unique company, industry, labor or professional considerations and/or requirements?

Establishing clear company objectives related to hotline/whistleblower programs will assist in the evaluation and comparison of the pros and cons associated with a proprietary versus an outsourced (third party) managed whistleblower program.  Maintaining current program goals and a regular review of process will further help with keeping your program current, compliant, effective and efficient. 

Answer provided by Kenneth Kasten, Security Executive Council Emeritus Faculty.

 

Helping Management Understand the Value of Your Security Organization

Q. I have been in charge of security for only a few years after leaving government and have no idea how to proceed in developing and presenting a plan to management.  What are some of the specific areas that I should highlight to emphasize the importance of security’s role?

A. Great question. As the person asking the question you understand the critical issue. The critical issue is, of course, creating a context or framework in which your business leaders can understand how security adds value.
 
Here are a few ideas to think about as you put your plan together.
 
How does security help the business leaders achieve the company's goals?  For example:  An "employees at risk program" helps protect all employees in a number of different ways. Working with the company travel department and human resources (HR) a review of all hotel properties where employees may reside while traveling should be done. This would include analyzing crime statistics,  speaking with the hotel chain about security at that specific hotel, interviews with employees after trips, maintaining a travel monitoring program, providing international travelers with country warning notices twice a year and conducting educational awareness training. In very difficult markets like Mexico a company may decide to use security car services to move employees around town and from/to the airport. They may also provide an emergency hotline number to all employees in the event of an emergency.  From a metrics standpoint, HR should conduct an annual employee survey to gauge feedback on the program.
 
Another example:  Working with legal counsel and HR, security may want to establish a background verification process for new employees. HR should track percentages of all applications that contain inaccurate information and the attrition rate of the new hires after verification.  Using this data HR can track hiring costs, employment law costs, disruptive employee costs and even training costs with the goal that these should trend down as a result of hiring the right people. If a drug testing program is set up along with the applicant verification, rates of applicants who screen positive for illegal substances should be tracked as after time the company may see a drop in employees with substance abuse issues because they are avoiding applying to the company.
 
These two examples are easy and almost everyone has these programs, but there are numerous other examples that can and should be used to tell the value story.  Remember this is a great opportunity to add a slide that says, "if resources were available we would be doing the following to reduce risks and costs in order to better achieve our company's goals.”

Answer provided by Richard Lefler, Security Executive Council Emeritus Faculty.

Developing a Security Strategic Plan

Q. I have recently been put in charge of defining the direction that security will take going forward within our company. Our group has already identified a department vision and mission.  Can you give me some pointers on developing a strategic plan and communicating it to management in a manner that shows the value that it will bring to the company?

A. First, congratulations on developing your vision and mission before tackling the task of creating a strategy.  A mistake often repeated is the misunderstanding of the differences between a mission, vision, strategy, and goals.  Quite simply, the strategy is the “how” or means in which you will fulfill the “what.”  Goals are the measurable activities you perform to get to the end result or the “what” – your vision and mission.

Your strategy must align with your company’s form, language and values.  Take the time to get input from trusted peers who have had success in developing, gaining approval and implementing strategic plans within your organization.  There is usually a common thread amongst all companies in what they want to achieve and how they achieve it.  However, priorities and emphasis will differ depending upon the company’s overall business strategy, culture and mission.  If your management and organization is known for its fiscal strength and emphasis, then be sure to include these as key ingredients in your strategic plan.  If personal growth and responsibility are emphasized, then ensure your plan reflects this value.

Leave yourself some options.  Devise and communicate your preferred plan with several different options in mind for management to consider and approve.  So often there’s the temptation to believe that a plan is so great that it’s presented with only one of two options – take it or leave it.  You are competing with other important functions for attention and resources.  Your ability to plan for this and have options for management to consider gives you credibility.  Your three-year strategic plan may end up taking five years to complete, but you have gained favor with key decision makers by putting yourself in their shoes and seeing the big picture.  Be very clear to inform them of the risks associated with their decisions, but be ready to be a team player.

Finally, be concise in your documentation and delivery.  Choose three to four memorable cornerstones to build everything around.  For instance, my most recent strategic plan was developed around four key ideas.

1. Create security ownership at every level of the organization
2. Partner with other functions to gain traction and integration of security solutions
3. Raise security issues to appropriate levels to gain quick and decisive action
4. Create solutions that are understandable, affordable, and align with business objectives.

Developing a successful strategic plan can be challenging; however, you will be rewarded for your efforts.  It’s your group’s roadmap to success.

Answer provided by Mark Lex, Security Executive Council Emeritus Faculty.