Outsourcing – The Ups and Downs

Outsourcing is not only about cost reduction, it is about a range of solutions that give flexibility in workforce planning, having on tap, the scale and expertise needed in product development, and by doing that, allowing organisations to focus on their core business. It is a solution that can be difficult to argue against, particularly if it is well embedded within an organisation, but it is not all upside, there are downsides that have to be recognised. There is the potential loss of sensitive information, variations in contract delivery and from a security perspective, all the threats that the outsourced company has, have to be taken into account by the contracting organisation.

Facilities Management – An Essential Service

It is within this mix that Facilities Management sits and provides services essential in keeping an organisation functioning. Whether its “hard” services, such as lighting and fire alarm systems or “soft” services, such as mail room operations and catering, it would be difficult to imagine any organisations being able to deliver its core business without it.

The FM security offering, including the installation and maintenance of electronic security solutions and provision of manned guarding, straddles both hard and soft services. On the surface there is probably little difference between electronic security solutions and any other systems that there are, including fire alarms and building management systems. Security officers, while their roles are not the same as cleaners, mail room staff or catering teams, are people who need to be managed, trained and developed.

The product that FM is providing, is developing as it reacts to modern working practices. There is the need to redesign offices in light of hybrid working, generate efficiencies and improved cost management through the collection and analysis of data and within this FM is expanding it’s security solutions. This will bring in what is described as intelligence services, staff vetting and training, to get beyond purely guarding or the installation and maintenance of equipment and more into the core of what an in house Security team provides.

The overriding focus of FM is on delivering a workplace that enables employees within an organisation to be effective and to maximise their ability to deliver their core products. It is FM’s reason d’etre and clearly important, whether it’s cleaning or catering or providing not only sufficient but well designed heating and lighting, all of which impacts on staff wellbeing and productivity.

Security – It’s a Changing World

At a basic level, 30 years ago, maybe security was gates, guards and passes, but that era, if it ever existed, has passed. Global trade, extended supply chains, dependency on critical outsourced suppliers, major weather events and cyber-crime, at a minimum, has necessitated a change in Security’s approach. In a literal and metaphorical sense, the perimeter fence, is no longer a demarcation line.

Over the last 3 decades, not only has outsourcing changed business models, but running concurrently with that has been Risk Management. Whether it’s through ISO 31000 which describes risk as, “the basis of informed decision making within organisations”, or in fact imposed through regulatory requirements, risk plays a major part within business. Perhaps as risk has become an increasingly important feature of business life, the nature of Security and the product it delivers to an organisation has similarly changed.

Security – It is About Managing Risk

Security officers, intruder alarm systems and keyholding, typical of the services that FM companies provide, are (or should be) the outward face of a risk management process. However, while it is likely that Security might “own” those services, it is maybe unlikely that they actually own the risk. Within the Three Lines of Defence Model, a framework designed to manage and govern risk, it is the First Line of Defence, who have to identify and manage the risks that there are and this will include, where appropriate, Security.

It is the role of Security to engage with those risk owners and through analysis, provide recommendations on the controls necessary to mitigate the risk. On an ongoing basis, those controls have not only to be monitored for compliance, but how they might be affected by changes in the business and threat environment. Those controls may well include restrictions on how FM contractors are used, including where and when they can work.

Security – It Needs a Degree of Independence

To function effectively, Security needs a degree of independence as it should be able to challenge opinions, introduce and maintain measures designed to mitigate risk and undertake investigations in breaches of security. If there isn’t that independence there is a danger that risks will not be quantified either in the immediate or longer term potentially leaving an organisation exposed.

The potential for this can be seen due, in part, to the Covid-19 pandemic, when the uptick in home and hybrid working, has reduced the need for office space. The solutions have seen leases being assigned, floor space sub-let and in addition there is the drive to re-purpose offices. All of these solutions bring with them the potential for an increase in the overall security risk, which has to be quantified. If Security does not have that independence, but has their opinions ignored or suppressed to meet an FM solution, it could be to the detriment of the organisation concerned.

Security – Is It Part of an FM Solution?

FM provides an organisation with the tools that make a building habitable to work in. Without it there would be no power, light or heating, mail wouldn’t be delivered and catering would be non existent, they would be poor places to work in, but that’s not the role of Security.

Security is largely about understanding the risks that there are and how they might be mitigated with some of those functions being outsourced, including guarding and the installation and maintenance of equipment. However, to ensure the effectiveness of those controls, Security has to operate with a degree of independence, it cannot be swayed or ignored just to align with an FM solution.

So is Security part of an FM solution? Probably not, but that is dependent on the parent organisation and risk appetite that it has.

RedLeaf Consultancy – Advising Clients

RedLeaf Consultancy is a consultancy which is primarily concerned with advising clients on how security might impact on the risks that they have have and from that generating solutions.