Alternative Strategies - A year away from the City - July
Anyone who has flown since the end of 2001 knows that tubes of toothpaste are deadly weapons, the preferred ordnance of an army of fanatics bent on the destruction of the civilised world.
I hereby confess that I was in possession of a tube of toothpaste as I stood at the boarding gate for my flight from Quito to Miami. Perhaps I had relaxed too much after a wonderful trip to the Galapagos but I had put the toothpaste in my hand-luggage after wickedly brushing my teeth at the airport. I had already been through the airport security checks and was, quite literally, at the door of the plane. The airline conducted its own security check and, to my shame, my nefarious plan was discovered. The guard held up the offending item as if it was a dead rat and told me that I could not bring it on board. Ever willing to be reasonable I told the brainless goon to buzz off (but not in exactly those words).
A period of discussion followed.
I pointed out that it was below the airline’s three ounce maximum size for containers. In case he might think that I was not taking things seriously I did not point out that it was half empty or that Al-Qaeda was still wrestling with the technical difficulties of synthesising mint flavoured Semtex. Nor did I point out that he would not have found it if I had put it in my jacket pocket rather than in my bag. Fortunately he was willing to compromise. Recognising that the tube was of regulation dimensions he agreed that it could be taken on board provided it was in a quart-sized, clear, plastic, zip-top bag. He was not able to explain how this defused the explosive power of the toothpaste but was adamant that I could not board otherwise. Unfortunately he had the power to make it stick so I had to go back to the duty-free shops and buy a bag for $1 so I could make the 20 foot walk to the airplane in compliance with security regulations.

Photograph by Lucy Reeve.
This is a fine example of a meaningless control. Jeffrey Goldberg of the Atlantic magazine has written an entertaining series of articles on what he refers to as the ‘security theatre’ that has added several layers of inconvenience and wasted time to air travel.

Photograph by Lucy Reeve.
A control designed to prevent a certain outcome is referred to, logically enough, as a preventative control (the other major class covers detective controls). There are a number ways in which risk managers and other interested parties test the effectiveness of preventative controls and they include questions about whether, as designed, the controls can achieve their objectives either on their own or in combination with other controls, whether they will work on a timely basis and whether the actual operation of the controls corresponds with their design. A question that should be asked just as rigorously is whether the cost of the control is proportionate to the risk being addressed.
Even in the financial sector, where the costs and benefits of the implementation of individual controls should, in theory at least, be measurable in purely monetary terms, answering this question can be problematic. In many cases you will find that individual controls map to a number of risks or vice versa so that unpicking the cost or potential saving can be a time-consuming business. Trying to conduct a review to identify redundant or ineffective controls is equally time consuming, the more so in larger organisations where each individual control owner may be in possession of only part of the picture. However the exercise is still worth the effort as many of the more mechanical controls may turn out to have been superseded by process changes and the exercise can liberate people from some of the more tiresome and routine parts of their jobs. Redundant or ineffective controls can cost money and act as a brake on the business. Hence the question - are the controls proportionate to the risk being managed?

Photograph by Lucy Reeve.
Leaving aside for a moment the question of effectiveness, it is a political question whether many of the additional security measures around air travel are proportionate to the risks being managed. The decision is largely out of our hands and in those of our political leaders. Given that the major risk to them is not getting killed in a terrorist attack but being seen as not having done enough if other people are killed they have no incentive to have proportionate controls but only an incentive to have controls visibly operating. Fortunately for them they are generally exempted from the additional inconvenience caused.
The question of the effectiveness of the controls is more interesting and the evidence so far is that the controls are sometimes effective at preventing attacks by stupid terrorists who use tactics that have been tried and failed before or, at best, variations of tactics that have been tried and failed before. The security failures tend to be those of intelligence, both kinds of intelligence in fact. For example, the ‘underpants bomber’ was travelling without luggage, on a one-way ticket purchased with cash. He was on a terrorist suspect watchlist. His father had reported fears about his son launching an attack to US authorities a few weeks before the bombing attempt.

Photograph by Lucy Reeve.
It seems unlikely that the controls visibly operating would be more than an inconvenience to smart, determined terrorists. We must hope that the controls we cannot see are more effective.
The general findings of a control review in a company are often that most of the best controls are either stunningly obvious (e.g. keep the cash in a safe) or the result of conscientious employees understanding their roles and acting promptly when discrepancies are noted. Employing people to mechanically execute controls that they do not understand is a poor strategy for any organisation.
As for flying safely? Jeffrey Goldberg notes that since 2001 the only additional controls that have been shown to add to airline safety are the reinforcement of cabin doors and the alertness of and intervention of other passengers. Bon voyage.
Patrick Healy was the Group Head of Risk Reporting for Man Group plc
© Patrick Healy
“A background check is not only for the benefit of the company as a sound business practice, but also for the benefit of all employees. It is not reflection on an applicant.”



