SEC Faculty Advisor

Helping Management Understand the Value of Your Security Organization

Q. I have been in charge of security for only a few years after leaving government and have no idea how to proceed in developing and presenting a plan to management.  What are some of the specific areas that I should highlight to emphasize the importance of security’s role?

A. Great question. As the person asking the question you understand the critical issue. The critical issue is, of course, creating a context or framework in which your business leaders can understand how security adds value.
 
Here are a few ideas to think about as you put your plan together.
 
How does security help the business leaders achieve the company's goals?  For example:  An "employees at risk program" helps protect all employees in a number of different ways. Working with the company travel department and human resources (HR) a review of all hotel properties where employees may reside while traveling should be done. This would include analyzing crime statistics,  speaking with the hotel chain about security at that specific hotel, interviews with employees after trips, maintaining a travel monitoring program, providing international travelers with country warning notices twice a year and conducting educational awareness training. In very difficult markets like Mexico a company may decide to use security car services to move employees around town and from/to the airport. They may also provide an emergency hotline number to all employees in the event of an emergency.  From a metrics standpoint, HR should conduct an annual employee survey to gauge feedback on the program.
 
Another example:  Working with legal counsel and HR, security may want to establish a background verification process for new employees. HR should track percentages of all applications that contain inaccurate information and the attrition rate of the new hires after verification.  Using this data HR can track hiring costs, employment law costs, disruptive employee costs and even training costs with the goal that these should trend down as a result of hiring the right people. If a drug testing program is set up along with the applicant verification, rates of applicants who screen positive for illegal substances should be tracked as after time the company may see a drop in employees with substance abuse issues because they are avoiding applying to the company.
 
These two examples are easy and almost everyone has these programs, but there are numerous other examples that can and should be used to tell the value story.  Remember this is a great opportunity to add a slide that says, "if resources were available we would be doing the following to reduce risks and costs in order to better achieve our company's goals.”

Answer provided by Richard Lefler, Security Executive Council Emeritus Faculty.

Developing a Security Strategic Plan

Q. I have recently been put in charge of defining the direction that security will take going forward within our company. Our group has already identified a department vision and mission.  Can you give me some pointers on developing a strategic plan and communicating it to management in a manner that shows the value that it will bring to the company?

A. First, congratulations on developing your vision and mission before tackling the task of creating a strategy.  A mistake often repeated is the misunderstanding of the differences between a mission, vision, strategy, and goals.  Quite simply, the strategy is the “how” or means in which you will fulfill the “what.”  Goals are the measurable activities you perform to get to the end result or the “what” – your vision and mission.

Your strategy must align with your company’s form, language and values.  Take the time to get input from trusted peers who have had success in developing, gaining approval and implementing strategic plans within your organization.  There is usually a common thread amongst all companies in what they want to achieve and how they achieve it.  However, priorities and emphasis will differ depending upon the company’s overall business strategy, culture and mission.  If your management and organization is known for its fiscal strength and emphasis, then be sure to include these as key ingredients in your strategic plan.  If personal growth and responsibility are emphasized, then ensure your plan reflects this value.

Leave yourself some options.  Devise and communicate your preferred plan with several different options in mind for management to consider and approve.  So often there’s the temptation to believe that a plan is so great that it’s presented with only one of two options – take it or leave it.  You are competing with other important functions for attention and resources.  Your ability to plan for this and have options for management to consider gives you credibility.  Your three-year strategic plan may end up taking five years to complete, but you have gained favor with key decision makers by putting yourself in their shoes and seeing the big picture.  Be very clear to inform them of the risks associated with their decisions, but be ready to be a team player.

Finally, be concise in your documentation and delivery.  Choose three to four memorable cornerstones to build everything around.  For instance, my most recent strategic plan was developed around four key ideas.

1. Create security ownership at every level of the organization
2. Partner with other functions to gain traction and integration of security solutions
3. Raise security issues to appropriate levels to gain quick and decisive action
4. Create solutions that are understandable, affordable, and align with business objectives.

Developing a successful strategic plan can be challenging; however, you will be rewarded for your efforts.  It’s your group’s roadmap to success.

Answer provided by Mark Lex, Security Executive Council Emeritus Faculty.