We receive a lot of responses to our various blog posts and one question gets asked a lot. Readers want to know, “what is our Return on Investment (ROI).” In other words, they want us to provide them with a reason or rationale that will justify them pulling the pin and engaging BDA to perform a comprehensive security assessment of their building and/or business. They want to know “Is it worth the expenditure – what’s the ROI?”
We usually advise them to look at the expenditure as an “investment” and not an “expense.” We then tell them that the main reason for doing a security assessment is to protect their assets (employees, buildings, equipment, company brand and reputation, etc.). We also tell them it’s being “proactive” rather than “reactive.” In addition, we tell them it reduces their exposure to various forms of civil liability, which can also help reduce their insurance costs (GL, E&O, etc.). We even tell them that many CEO’s have been forced to step down due to a significant incident related to security/safety or workplace violence, etc. If that’s not a strong enough reason to invest in a professional security assessment than we don’t know what is (just ask the former CEO of Target or BP or even the former Presidents of Harvard, Columbia and the University of Pennsylvania, or even the former Director of the U.S. Secret Service, etc.).
But here’s the more sophisticated answer, and executives at highly effective and successful companies get it. The ROI is directly linked to their strategic and competitive advantage as a company within a certain industry. The ROI comes from aligning your security posture in such a manner that it contributes to your companies long term growth and competitive advantage. Very simply, your company will quickly cease to be competitive if executives fail to grasp this concept. Lives, careers, reputations, etc., can be irreparably harmed and simply closing the barn door after the horse leaves won’t save you (just ask the people who “used to” work at the Boars Head plant in VA). Frankly, many companies do retain our services “after” a major incident, and we can certainly blunt the damage for those clients. But it’s always better to be proactive and prevent a security breach than to be reactive and respond to one after its happened.
At BDA, we specialize in doing a 360 degree, 30,000-foot overview of your security posture and your security capabilities. We have done hundreds of comprehensive and sophisticated security assessments for a wide variety of companies involved in a wide variety of industries – from Global 100 companies to Fortune 1,000 companies to medium or small regional and/or local companies. Our security reviews and assessments look at the entire risk landscape within your company (“Enterprise Risk Management”). Also, our security professionals are “Board Certified in Security Management” by ASIS Intl.
In addition, if your issue involves a compliance related problem or a theft, fraud or loss prevention problem, or even vetting for a merger or third party vendor compliance, BDA has experienced investigators on staff who are state certified criminal investigators and licensed private investigators. Our investigative prowess is second to none. In fact, most of our investigators have worked for the very same law enforcement or regulatory agencies you might be dealing with. We know those agencies and we know many of the executives in charge of those agencies. Our success comes down to following the 3 R’s (Relationships, Relationships, and Relationships).
When the subject of asset protection is brought up we sometimes get the simple response, “we’re insured against anything like that, so we’re good.” Sadly, it’s been our experience that many clients “think” they’re covered, but we have seen many cases where insurance coverage was either denied outright, or was excluded under a rider or binder, or the deductible was very high or several other tricks that insurance companies employ so as not to have to pay out (e.g., it happened outside in the parking lot; you’re not covered for crimes; you didn’t comply with required risk management measures; it involved intentional employee misconduct, etc.). The client usually only finds out when something happens and they file a claim. Then, they yell at the insurance broker or TPA but the damage is already done and cannot be corrected at this point.
For those working within a publicly traded company there’s Section 404 of the Sarbanes-Oxley Act (SOX). CEO’s and CFO’s must sign off on their Form 10-K filings with the SEC “certifying” that the company has established and maintains an adequate internal control structure and procedures for financial reporting, and that these controls are effective and capable of preventing fraud and financial misstatements. In other words, the CEO and CFO are on the hook to the SEC if that proves not to be the case.
In tandem with this is SOC 2, which requires that steps be taken to protect the physical access to the organization’s systems and facilities. Physical security is addressed in CC6. SOC stands for “System and Organization Controls 2.” It was created by the American Institute of Certified Public Accountants (AICPA) as a way to help organization’s verify their security and reduce the risk of a security breach.
Then there’s OSHA. The U.S. Department of Labor oversee the Occupational Safety & Health Act (OSHA). One section of the Act that is especially relevant to all employers is section 5(a)(1), commonly referred to as OSHA’s “General Duty Clause.” That section requires employers to provide workers with a place of employment “free from recognized hazards that are causing or are likely to cause death or serious physical harm.”
And let’s not even get into sexual harassment, creating a hostile workplace, premises liability, negligent security policy, training and/or supervision, etc. It’s a lengthy list of blind spots that clients miss. That’s why proactive, effective and successful companies call in BDA to perform a professional security assessment and review. They want a second pair of eyes. They also want our perspective. As ancient scripture says, “Once I was blind but now I can see.” Let us illuminate the path for you so you can see those blind spots.
As you can see, security assessments are no longer a luxury for companies—they are a necessity. Conducting regular reviews helps businesses stay ahead of potential threats and maintain a robust security posture in an increasingly complex risk landscape. Hiring a professional to conduct these assessments ensures that companies are getting expert advice, tailored solutions, and a proactive approach to risk management. By investing in professional security assessments, businesses not only protect their assets and people but also safeguard their reputation and future success.
If you want to communicate with us don’t hesitate to drop us a line at: [email protected]. We’d love to hear from you. We’ll also do our best to answer any questions you may have related to security, safety, emergency management and/or investigations.
