By Mac Segal
Fortunately for most hotels, emergencies rarely occur. Most security teams can usually rely on routine procedures. Unfortunately, emergencies do occur – and many hotel security teams are woefully unprepared to deal with them effectively.
In this article, hotel security expert Mac Segal takes a hard look at emergency procedures, and how and why security managers must prepare them.
Routine procedures are what security professionals spend most of their time performing. By far. Let's face it: Most days are routine, thankfully, and emergencies are rare.
It's therefore no wonder that security teams focus on routine, preventative procedures much more than they do emergency reactive procedures. As the saying goes, an ounce of prevention is worth a pound of cure – in health, business, and so many other areas – and robust preventative procedures must form the basis of any solid security program. Routine procedures are essential to security program success. We're not here to minimize their importance – quite the opposite.
What we do want to do is point out the importance of emergency procedures. Now, to some this might seem a contradiction in terms. After all, emergency is the opposite of routine: emergencies are unexpected, irregular, and extraordinary. How can one develop routines to deal with the exceptional? Yet this is exactly what security teams must do in order to keep people and physical assets safe. Let's examine why and how.
Just because emergencies are unpredictable doesn't mean you shouldn't plan for them.
My line of work takes me around the world, where I consult on security for hotels and other fixed sites. The job takes me to places in developed and developing economies, places with high crime rates and low, cities where terrorism is an ever-present or a very distant threat.
No matter what the project, some kind of Risk, Threat, Vulnerability Assessment (RTVA) must always be carried out. Depending on time and budget, the RTVA can be extensive or relatively quick, but it's always at the heart of what we do. Ours is the business of risk mitigation, after all, and unless we understand the intersection of threats and vulnerabilities that define risk, how can we effectively reduce the likelihood of security breaches?
A lot of what we do in hotel security RTVAs is observe and ask questions. "What if?" is one of the most important questions in our toolkit. "Who does what, when?" is another. "What then?" is a usual follow-up. The answers to these simple questions reveal a lot about how security teams plan for emergencies – or, more commonly, don't plan for them.
Let me illustrate this with two real-world cases that I have encountered while carrying out assessments of hotels run by some of the world's largest operators.
Case 1: Fire!
While conducting a safety and security audit of a five-star hotel in Africa, we enquired how a firetruck would access the property in case of a fire. The main vehicle entrance design made entry for such a large vehicle extremely difficult. What is more, approach from the main gate would have the firetruck driving straight towards evacuating guests and personnel. We were thus shown a large metal gate at the border of the property that was secured with a chain and padlock. Our conversation with the hotel's security managers went as follows:
- Q: "Who unlocks the gate in the event of a fire?"
- A: "One of the security guards."
- Q: "Which one?"
- A: "Er, someone."
- Q: "Where is the key?"
- A: "In the security office"
- Q: "Where, specifically?"
- A: "Er, in a drawer."
- Q: " When was the last time this gate was opened? Is it regularly maintained? How often is the lock checked?"
- A: "Really couldn't tell you. I think they check the gate sometimes."
We then went to the security office. Unsurprisingly, no one knew whose responsibility it was to open the gate. It took 12 minutes to find the right key, which didn't work because the lock was rusted permanently shut.
Now, let's remember that this hotel was run by a leading international operator, and that fire must be considered one of the more predictable hotel emergencies. This particular emergency response plan can only be described as wholly inadequate. Had there been a fire at that hotel, the firetruck would have been a seriously delayed, which could have resulted in disaster.
The fixes are straightforward. There must be a designated security guard on each shift whose job it is to open the gate if needed. The key must be in an easily accessible but secure location and clearly marked. There must be a backup key at a secondary location in case the primary key is inaccessible. The gate must be regularly opened and maintained. The team must train the emergency procedure regularly, and regular audits must prove readiness or identify weaknesses that can then be addressed.
Case 2: Active shooter!
Another example of poor emergency planning comes from a 300-key, five-star hotel in the Middle East. In this case, we were assessing the security control room's active shooter protocols.
We stood in the security control room and asked the guard on duty about the emergency response procedures to an active shooter situation. Here's an excerpt from that conversation:
- Q: "What if you hear gunfire and see hostiles with weapons on your CCTV monitor. What do you do?"
- A: "Call the security manager."
- Q: "Why?"
- A: Blank stare.
- Q: "What then?"
- A: "I make an announcement on the PA system telling guests to evacuate, or to get into a room and lock the door."
- Q: "What then? What exactly are you going to say in that announcement?"
- A: "I will say what I need to say."
So, we took him at his word and decided to do a simulation. After prepping the exercise, our security guard was sitting calmly at his desk when we started yelling, "Active shooter! Active shooter! Go, go, go!", banging around the room and generally putting him under pressure. Of course, nothing we did could ever come close to the stress of an actual hostile scenario; even so, the results were less than satisfactory.
He fumbled for the PA, forgot to press the button to open all channels, and then spoke rapidly and incoherently into the microphone. The words "attack", "lock" and "room" were just about all that you could understand. The rest was mostly stuttering, stammering and unintelligible noise.
This is not an effective emergency procedure.
Hotel security should have pre-recorded an active shooter announcement, as most do for Fire/Life/Safety incidents. Alternatively, the script needs to be written, printed in 44-point font, laminated, and stuck on the wall next to the PA. In times of high stress, unless you are highly trained your brain will not function normally. Even putting together a coherent sentence can be challenging.
In our experience, the following nine areas must all be carefully considered when preparing emergency procedures. Each is important. Together, they form the basis of reliable emergency procedure preparation and maintenance. Remember, emergencies are unexpected, so your emergency responses are time-critical. You have no time to consult or discuss. You must have an effective emergency plan and then by ready to be flexible and adapt it, real-time, in the field.
1. Base your emergency procedures on a reliable RTVA
Good emergency procedures start with thinking about risks. Given your hotel's specific combination of threats and vulnerabilities, what are the most important risks and what types of emergencies should you prepare for?
Probability of occurrence is one parameter. Criticality – or the impact of the emergency on human lives, physical assets, reputations or legal liabilities – is another. Time and money are, inevitably, also part of the mix.
There are no one-size-fits-all emergency procedure manuals. At least there shouldn't be. A solid RTVA, where site-specific consideration is given to all discoverable risks, threats and vulnerabilities, should be the foundation of all procedures.
2. Decide how you will declare the emergency
It sounds elementary. But if an emergency arises, it is critical that pre-appointed members of the team identify and declare it as such, and then initiate the appropriate emergency procedures. You must previously define what constitutes an emergency, who has the authority to declare it, and through which channels it will be communicated.
If there is an active shooter in the lobby, people out back by the pool must not remain blissfully unaware; they should be taking appropriate action. Whether the emergency is a fire, terror attack or earthquake, the designated people must declare the emergency and initiate the appropriate emergency procedures. Too often, we think, "That's obvious, of course everyone knows". Such thinking can result in injuries or worse. In an emergency, you can take nothing for granted. Every step must be thought through.
3. Assign clear roles & responsibilities
In an emergency, "someone" usually ends up being "no one". Everybody thinks that "someone" called 911, that "someone" locked the door, or that "someone" checked that the Children's Club was empty.
It is essential that all critical roles and responsibilities be clearly defined. Everyone at the hotel, whether the GM, the security manager, or the new recruit in housekeeping must know their designated tasks and their spheres of responsibility. It is crucial that nothing falls between the cracks. The same applies to crisis management teams.
Security managers must think through what actions need to be taken in an emergency, and who are the best people to carry out those actions. They should list the tasks that need to be done, making sure that all aspects are addressed, and assign a person to every one of them. For example, hotel security must remember out-of-the-way places as well as the busiest gathering places. If there is a play area for children, it must be someone's responsibility to check that area in an emergency.
4. Designate authority
Responsibility without authority is useless. It's like asking someone to juggle with their hands tied behind their backs. If you are going to assign roles and responsibilities, then you must also empower people to make the necessary decisions in the field.
Remember that time is critical in emergencies. If the crisis management team has to run everything by Corporate before taking action, there will be a time delay that will negatively affect the outcome. Emergencies cannot be managed by someone in an office 3000 miles away. While a Global Security Operations Center (GSOC) might be an integral part of overall emergency and crisis management, it is essential that there is someone who has the authority to make decisions on the spot.
Security managers must nominate capable people, train them well, then trust them to do their job. And as we know, trust is good – but control is better: As we'll see below, regular checks and audits are a necessary part of emergency procedure maintenance.
5. Check all relevant equipment regularly
Ensure that all emergency equipment is regularly checked and maintained. In an emergency, you have no time to look for phone numbers, struggle to open a closet or discover that the flashlight has no batteries.
Your SOPs must include the maintenance of all emergency equipment. Ensure that it is up to date, in good working order and accessible to whomever may need it. Think about things like local SIM cards, portable phone chargers, sat phones. Know what passports your crisis management team members hold and which countries they can enter visa free. Check that rusty lock.
6. Prepare for unambiguous communication
Nothing creates confusion quite like multiple communication channels all working at cross purposes. It's like four donkeys trying to reach the same destination by pulling a cart in four different directions.
During an emergency or while managing a crisis, clear communication is vital. The team must know where their instructions are coming from. Communication must be streamlined, unambiguous and clearly transmitted to all who need to know.
Far too often, confusion arises because team members receive contradictory instructions from different sources. Instead, security managers must define lines and methods of communication, as well as who is the issuing authority.
7. Write emergency procedure manuals that people actually read and use
Most hotel operators have file rooms full of manuals of all shapes and sizes, including Emergency Procedures. A 450-page emergency manual is simply not effective. Come crunch time, no one will successfully page through an encyclopedia to find the appropriate response.
Remember, emergencies are time-critical. That huge manual might be great when it comes to liability concerns after the fact. It will let you can show in court that you had a procedure for just about everything, from a fire to an asteroid hitting your hotel. But in times of actual emergency, what is far more useful is one laminated page of bullet-point instructions written in 44-point font and posted in a clearly visible location. This way the people who need to respond have the information they require immediately, effectively and unambiguously.
8. Train as if your life depended on it (it might)
No matter how good your emergency procedures or manuals are, unless teams train in them they are useless.
Training is how people learn to act reliably in high-stress situations. The more realistic the training conditions – and the more frequent the training sessions – the better the outcome.
Of course, time and budget constraints are always an issue when it comes to training. In an ideal world, there would be plenty of both. In the real world, security managers must juggle between many priorities. We recommend that emergency procedure training becomes one of those priorities.
9. Test. Learn. Improve.
How do you know if your emergency procedures work? You could wait for a crisis to happen and see how things go. Or, you could test them ahead of time, discover what works and what doesn't, and then adjust accordingly. We can confidently recommend the second approach.
Maybe you need better procedures. Maybe you need more training. You might even learn that some of your people are just not up to snuff, and that they need to be replaced. Discovering this before an actual emergency, and taking appropriate corrective action, is infinitely preferable to the alternative.
Call them audits, tests or whatever you want to. Do them planned or unannounced. But if you don't regularly check your emergency procedures, then you don't know if they are effective.
The new normal: Planning for emergencies must be a routine part of hotel security
Emergency response planning for hotel security used to be "nice to have", not "need to have". Our reality today is different. Given the risk environment we now operate in, hotel operators – and their security managers – have a duty of care to ensure we are ready to respond to real threats rapidly and effectively, whenever and wherever needed.
This is a huge subject, and we cannot, of course, cover everything in one article. The takeaway, however, is simple. Security managers need to develop routines to deal with emergency situations. They need to think things all the way through, plan procedures down to the finest resolution, and keep asking "What then?"
Until you're satisfied that the answers to your questions are good, keep asking.
