Security is about preventing losses to your company caused by things outside the usual scope of your business. This includes risks to your facility and employees arising from problems with your facilities, from intruders, theives and terrorists, and from lawsuits. The risks discussed here are to a large extent controllable, or at least reducible, by actions you can take.

Notes

Discussion

Emergency exits need to be walked in person by the manager to be certain doors will open and pathways are unblocked.

In a high rise building that relied on external fire escapes, accessed through a window, the female clerks were unable to open the window at all, and most of the windows could not be opened enough for convenient passage by two men. Don't count on the fire inspector to test the safety of your building.

Open mail in a separate building if possible, or at least in an area that is effectively isolated from the remainder of your employees.

The "white powder" threat is fear, not anthrax. If it falls out of an envelop on your premises, you are out of business for the day. You will have to evacuate your employees and keep them in the vicinity until the authorities have cleared the risk. Isolating the mail area restricts the risk, and the down time, to a few employees.

Have a sensible "white powder" plan in writing, and posted on your intranet site as well as on your paper bulletin boards.

Without a plan known to everyone, foolish things will happen. A first reaction may be to release employees for the rest of the day, but that is the worst possible action if the contamination is real, since they are then unavailable for treatment, and can carry contamination to their families.

Lock your doors with devices that allow exit, but require electronic ID cards for entry.

You cannot keep your employees safe if the public is free to roam your facility. There are estranged spouses, purse snatchers, vagrants, and maybe even ex employees that don't like you. Insist on the maximum feasible limits on access.

While there is nothing that you can do to defend against car bombs located in the street, you can insist on steps that will prevent a vehicle from gaining access to the interior.

Notice that most federal building managers have developed an appreciation for plants and flowers in front of the street entrances to their building. These heavy planters will stop vehicles from driving into the lobby, where an explosion would do much greater damage than one in the street.

Disaster recovery plans have long been a requirement, but the PC revolution has significantly reduced the difficulty and cost involved in restoring vital operations. The essential fields of the entire master file can be maintained on an off site server, along with relatively simple programs that will enable billing premiums and policyholder service for the time it takes to restore full operations.

Going a month without collecting premiums or responding to policyholders would be very destructive, while paying agent renewals could be delayed (with the ability to make cash advances), and months of delay in determining reserves and financials would be tolerable in a disaster. Ranking essential functions in terms of time sensitivity will indicate what programs need to be on hand. Recovery plans used to involve standby facilities with massive electrical and cooling capacity. Today, with the appropriate files and programs stored off site, a company can replace equipment off the shelf and operate in any ordinary space adequately while full functions are restored. A disaster plan essentially becomes a set of tested server programs and an equipment list.

Security cameras used to require expensive cameras and monitors, but the new web cams are inexpensive, and will send images over the network you already have, viewable as a web site from any PC, from anywhere if you put it on the internet.

If you already have the old TV type cameras and a bank of monitors, your network person can translate the signals to a web site just as if they were web cams. Being able to watch the goings on from anywhere is a big advantage. It doesn't tie your watchman to a specific location, and who knows, YOU may be watching from home. That should chill the litterbugs.

Is your check stock stored and controlled properly? In Stories I mentioned storage in a closet with the hinges on the outside. If someone obtains stock and passes a check, the question of who bears the loss, you or the bank, will depend on whether you used due care in your procedures.

Checks are printed by computer. If the computer is the mainframe, the principle is to keep control of the check stock out of the hands of anyone who can initiate the check run, generally the operators. If printing is done on dispersed PCs, control (and due care) can be trickier. If any one person can take check stock to the PC and enter data and cause the printing of a check, you have exposure that over time can be significant. If you cannot avoid that, you will have to rely on the ability to catch the checks after the fact. If that same person is handling the bank statements you need to make changes.

An important life saving device is the portable automatic difibrillator. This can save a heart attack victim in sudden cardiac arrest, a condition that would otherwise likely be fatal. The average cost is about $3000, so it is hard to justify not having one on premises. The life you save may be your own.

Your local Red Cross will provide details. Your medical director should be involved in chosing the model purchased and supervising the training program. The machine can't save anybody if nobody knows where it is, or if people on the scene don't know who to call so that a trained person will immediately bring the machine. There should be a code blue procedure known to all, and a single number to dial that simultaneously rings the single purpose phones on the desk of every trained response person. A designated person has to be responsible for checking the location every week, so it doesn't end up in a locked cabinet, or have something piled on it, or any number of conditions that will delay availability.

You can get hurt by the sins of the past. As late as the 60s, and even 70s, policies were still being issued with substandard rates for minorities or occupations thought common to minorities. These may show up on the master file with different plan codes. Better look at your old rate books. At one time the practice was universal, based on perceived or real mortality differences.

According to the old rate books, the industry has made different rates, or refused coverage, to all sorts of classes. The usual, plus some you wouldn't think of. I saw an old rate book that prohibited writing life insurance on married women. Times change.

The only way to fix the few inappropriate ratings that may still be in force on the master file is to make it right. Change the offending policy to the standard plan code as of issue and boost the face to what the premium should have purchased.

One of your biggest liability exposures is for sexual harassment by your employees or agents. The company will be held legally responsible for the (clearly unauthorized) acts of your agents, and that includes male on male harassment as well as male on female and vice versa. You must have precise procedures in place to be receptive to and to deal rigorously with complaints.

The courts have established what steps an employer must take to avoid liabiltiy. These boil down to having a zero tolerance policy, communicating it effectively, and taking appropriate action when there is a complaint.

People are a lot dumber about this than you think. One life company had offensive posters in the mail room and an obscene cartoon on its web site. Both very funny. In another a senior executive made suggestive comments meant as humor to one too many women. These things cost serious money. Some training seminars are an excellent approach. When you listen to the comments you will realize that people do not want to take this seriously, so you will have to.