Security Consulting

Fourth Edition

CHARLES A. SENNEWALD

Table of Contents

Cover image

Title page

Copyright

Dedication

Acknowledgments

Preface

Introduction

Chapter 1. Security Consulting as a Profession

Comparison of the Security Executive and the Consultant

The Consultant’s Daily Work

Chapter 2. Qualifications of a Professional Security Consultant

Experience

Education

Professional Credentials

Personal and Interpersonal Skills

Chapter 3. The Ten Most Common Questions Asked about Entering the Profession

Question 1: Of All the Things One Should Do to Be Successful, Which Is the Most Important?

Question 2: How Much Time and Money Are Required to Open a Consultancy?

Question 3: How Does One Know One Can Make a Living by Being a Security Consultant?

Question 4: How Does One Go about Marketing One”s Consulting Skills?

Question 5: Is Prior Law Enforcement Experience Valuable?

Question 6: Is It a Good Idea to Find Work in Another Management Consulting Organization before Trying to Break into Independent Security Consulting?

Question 7: Where Can One You Find Security Consulting Standards to Ensure One is Operating in the Mainstream?

Question 8: How Can Fledgling Consultants Measure Their Worth?

Question 9: Does One You Have to Maintain a Parallel Career in Academia or Business to Keep Abreast of Industry Advances?

Question 10: Is There an Average Period of Time over Which One Must Practice before Realizing Professional Recognition and Financial Success?

Chapter 4. Starting the Business

Geographic Location of the Business

Specific Location of the Office

Personal Computer and Website

Telephone Service

Telephone Equipment

Answering the Phone

Naming the Business

Press Release

Bank Account

Business Record Keeping

Daily Business Journal

Financial Journal

Office Equipment

Stationery

Insurance

Chapter 5. The Need for Effective Consulting Websites

The Home Page

The Services Page

The Experience Page

Social Networking

Blogs

Mobile Versions

Final Thoughts Regarding Content

Chapter 6. Bumps in the Road New Consultants Will Face

First Thing’s First—Money

Forming Your Business

What Kind of Consultant Do You Want to Be?

A Question of Independence

Forensic Consulting

Seek Knowledge from Those Who Have Traveled the Road Before You

Marketing Your Business

Pro Bono Work

Spend Your Money Wisely

Brochures, Books, and Articles

Setting Your Fee Rate—Yet Another Bump

Professional Memberships and Certifications

Keep This Book Handy

Chapter 7. Marketing

Prepare a Marketing Plan

Creating Your Marketing Strategy

Marketing Quick Tips

Chapter 8. The Proposal and Contract

The Enterprise Recognizes the Need for Consultation

The Enterprise Requests A Proposal

The Consultant Submits a Proposal for Services

The Enterprise Accepts the Proposal and Contracts for Services

Chapter 9. The Survey

The Preliminary Survey

The Survey Itself

Chapter 10. The Consultant’s Report

Components of the Report

An Alternative Report Strategy

The Oral Survey

Chapter 11. Fees and Expenses

Field: Office Billing Formula

Travel Time

Advances

Retainers

Billing Periods

Expenses

The Invoice

Collection Problems

Chapter 12. Technical Security Consulting

Schematic Design Overview

Detailed Design and Construction Documents Overview

Field Device Data Gathering

Development of Device Schedules

Development of Floor Plans

Preparation of a Riser Diagram

Installation Typical Details

Updating the Cost Estimate

Initiating the Specifications

Bidding and Award Matters

Construction and Closeout

Final Thoughts and Considerations

Chapter 13. Information Security Consulting

Ad-Hoc Security

Five Steps to Intruding

Teams at Risk

Teams That Use Outside Players

Managing the Team’s Risks

Assessing the Team’s Risks

Planning the Team’s Risks

Risk Treatment Plan

Assessing the Team’s Security

Balancing the Team’s Access and Risks

Chapter 14. Forensic Consulting

The Need for Security Consultants in Legal Cases

The Process of Forensic Consulting

Examples of the Types of Cases That Can Involve Security Consultants

Chapter 15. Liability and Insurance Considerations

Professional Liability

Insurance Considerations

Use of Contract Clauses

Chapter 16. The Need for Professional Growth

The Origin of the International Association of Professional Security Consultants

Institute of Management Consultants

Pro Bono Work as a Source of Professional Growth

Chapter 17. Ethics in Consulting

General Standards for Consultants

Standards for Forensic Consulting

Appendix A. Consulting Contract

Consulting Contract

Exhibit A: Scope of Services

Exhibit B: Rate of Payment

Appendix B. Professional Services Agreement

Professional Services Agreement

Appendix C. Confidential Information Agreement

Confidential Information Agreement

Appendix D. Security Survey Work Sheets

General Questions before Starting the Survey

Number of Employees

Normal Shift Schedule and Break Times

Cafeteria

Credit Union

Custodial Service

Company Store

Petty Cash or Funds on Hand

Classified Operations

Theft Experience

Appendix E. Best Practice #1: Detaining Shoplifting Suspects

May 1999

Appendix F. Best Practice #2: Forensic Methodology

Table of Contents

Position Statement

Evidence Review—The Process

Risk Assessment

Threat Assessment

Vulnerability Assessment/Security Survey

Analysis and Opinions

Bibliography

Appendix G. Best Practice #3: Use of Force by Security Personnel

Table of Contents

Position Statement

Best Practice Committee Members

Document History

Addendums

Further reading

Appendix H. A Timeless Message

Appendix I. Outline of the IAPSC’s Successful Security Consulting Program

Course Description

Session 1: SSC Introduction, Overview, and Objectives

Session 2: The Business of Security Consulting

Session 3: Defining and Marketing Your Services

Session 4: Developing and Submitting Winning Proposals

Session 5: Completing the Consulting Assignment

Session 6: Conducting Security Audits and Assessments

Session 7: The Business of Expert Witnessing

Session 8: Preparing a Responsive, High-Impact Consultant’s Report

Session 9: Money: The Good, the Bad, and the Ugly

Session 10: Project Teaming and Business Planning

Session 11: Back-of-the-House Mechanics

Session 12: Convergence Consulting

Bibliography

Index

Copyright

Acquiring Editor: Mary Jane Peluso

Development Editor: Amber Hodge

Project Manager: Anitha Kittusamy Ramasamy

Designer: Alan Studholme

Butterworth-Heinemann is an imprint of Elsevier

225 Wyman Street, Waltham, MA 02451, USA

The Boulevard, Langford Lane, Kidlington, Oxford, OX5 1GB, UK

© 2013 Elsevier, Inc. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.

This book and the individual contributions contained in it are protected under copyright by the Publisher(other than as may be noted herein).

Notices

Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods, professional practices, or medical treatment may become necessary.

Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information, methods, compounds, or experiments described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility.

To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein.

Library of Congress Cataloging-in-Publication Data

Application submitted

British Library Cataloguing-in-Publication Data

A catalogue record for this book is available from the British Library.

ISBN: 978-0-12-398500-2

Printed in the United States of America

13 14 15 16 10 9 8 7 6 5 4 3 2 1

For information on all BH publications visit our website at www.elsevierdirect.com/

Dedication

Thanks to my wife, Connie (Precious), who has had the patience and endurance to see me through this, my 20th book.

Acknowledgments

This fourth edition is made possible by the assistance and contributions of the following:

• Elliot Boxerbaum, MA, CPP, CSC—Columbus, Ohio

• Curtis Baillie, CSC—West Chester, Pennsylvania

• Norman Bates, Esq.—Bolton, Massachusetts

• Kenneth Braunstein, CSC—Reno, Nevada

• Lance Foster, CPP, CSC—Tampa, Florida

• Harold Gillens, PSP, CFC, CHS-III, Summerville, South Carolina

• Richard Grassie, CPP—Plymouth, Massachusetts

• Brian Gouin, PSP, CSC—Portland, Connecticut

• James Kelton, CISA, CRISC, CGEIT, CDP—Costa Mesa, California

• Kevin Murray, CPP, CISM, CFE, BCFE, MPSC—Old Wick, New Jersey

• Robert O. Murphy, CPP—Notre Dame, Indiana

• Frank Pisciotta, MPA, CSC—Raleigh, North Carolina

• Michael Silva, CPP—Covington, Washington

• Karim Vellani, CPP, CSC—Sugarland, Texas

• Linda Watson, MA, CPP, CSC, CHS-V—Charlton, Massachusetts

• Ralph Witherspoon, CPP, CSC—Cleveland, Ohio

• Pam Chester, Acquisitions Editor, Butterworth-Heinemann Security Books

• Amber Hodge, Senior Editorial Project Manager, Butterworth-Heinemann Security Books

• The Holy Spirit

To you all, I’m grateful. Thank you!

Preface

Security consulting had flourished by the mid-1980s, becoming an integral, necessary discipline within the security industry. Professionals engaging in consulting prior to the 1980s were few and far between. Notable among this group were such pioneers as Timothy Walsh, Philip Schiedermayer, Don Darling, Bob Curtis, Thad Weber, David Berger, Roy Wesley, and Steve Carlson.

The practice of consulting came of age in 1984 through the founding of its own professional organization, the International Association of Professional Security Consultants (IAPSC). That organization, in addition to creating a forum for communication among consultants, defined consulting, set certain standards, and developed a professional code of ethics. The principles of a speech I delivered at that organization’s first meeting on February 11, 1985, in Clearwater Beach, Florida, still apply:

I hold the minutes of a meeting held at the Waldorf-Astoria in New York on September 20, 1972. The heading reads: First Organizational Meeting of Professional Protection Consultants.

In attendance were nine practicing consultants. They developed a constitution and came up with a name: the American Academy of Protection Consultants. They had expectations, but for whatever reasons, the Academy didn’t fly. The time just wasn’t right.

But the time now is right. We are re-gathered here, and we too have expectations, and we are already airborne. And we will grow. As the security industry continues in maturation and sophistication, so will the needs grow for professional guidance and counseling.

Let me take a look down the road, to focus on two long-range goals and one new opportunity.

The first goal is to reshape the image and reputation of the security consultant. We must take positive steps to legitimize that term and discourage abuse of that title by anybody who merely wants to call themselves a security consultant without earning the title.

The second goal is to create a better understanding among ourselves as to our real role as consultants. One of our problems, believe it or not, is that very title—security consultant. Why? Too much emphasis is placed on the word security.

It should go without saying that we have expertise in the security field. But our orientation should be as professional consultants; we should be consultants first and security experts second.

How many have hung out their security consultant’s shingle, only to fail? Many failures could be attributed to a lack of consulting skills, not a deficiency in security knowledge.

A new opportunity exists in forensic consulting, which includes expert testimony. There’s a growing demand for security experts to assess the adequacy or inadequacy of security in a given setting and subsequently provide testimonial support for that assessment. No one other than a qualified expert is permitted the privilege of expressing an opinion in our judicial system.

And so, the time for the security consultant finally has come. We are few, but we are of good quality and we follow the highest standards. To live up to our worthy goals and new opportunities, we must at all times be responsible professionals.

I’m proud to be a part of this new consulting field. To those who have played a role in making this a reality, we are all grateful. To those who join us for the first time, or those who are seriously considering entering this profession and to those who are new to this exciting profession of consulting, I welcome you.

So this book is a compilation of ideas, strategies, and practical advice reflecting the thinking of some of my colleagues as well as myself. Put another way, I’m a better consultant today through my association with my professional peers, and I pass along their contributions to you.

I have been asked, “Aren’t you concerned about overcrowding the consulting business by welcoming newcomers and sharing ideas that could lead to their success and more competition?” My answer is, “On the contrary, I welcome qualified new colleagues who will enhance our profession.”

This book is meant not only to offer insight into methods and procedures for successful consulting but also to infuse this exciting new field with its own sense of identity as well as standards for professionalism. A new dimension to this concept (and reality) of “identity” and “standards for professionalism” has matured into the creation of the professional designation of certified security consultant (CSC) based on a clearly defined body of knowledge that didn’t exist when the IAPSC was founded. Today, IAPSC members as well as nonmembers may complete a test administered by an independent professional testing board for that designation.

Security consultants have traveled a long bumpy road, spanning 42 years, from pioneers to professionally recognized certified security consultants. Welcome aboard!

Chuck Sennewald, CSC, CPP, CPO

Escondido, San Diego County, California

Introduction

There are four types or categories of security consultants:

• Security management consultants, who focus on the classic managerial arena such as organization design, budgeting, policy development, and procedural development; in our case, this pertains to the security, loss prevention, and protection of assets strategies.

• Security technical or engineering consultants, whose expertise lies, obviously, in the technical arena—that is, technical specifications, designing systems, specifying equipment and hardware, and the like, all to augment, enhance, or otherwise facilitate the security of a given building or facility.

• Information security consultants, who specialize in protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording, or destruction.

• Forensic security consultants, who may be consultants of any of the three specialty areas identified above. Some gravitate their practice more toward this litigation-oriented work than their original specialty. That’s to say, they direct their energy and talents to forensic assignments—namely, they assist in the discovery and analysis of the evidence revealed in lawsuits with the intention of determining liability or not and serving, if appropriate, as expert witnesses in our state and federal courts of law (or any other formal tribunal or commission, e.g., Congress, a state legislature, or a labor board).

This book addresses, in some measure, all four “disciplines.”

Chapter 1

Security Consulting as a Profession

The growth of security management consulting as a profession parallels that of the entire industry of protection in the private sector, whose products and services have dramatically expanded since the 1990s. The increasing demand for consulting services comes as no surprise given the heightened need for security following 9/11, along with corporate downsizing, outsourcing, and technological advances. Up until the Trade Tower attacks of September 2001, security consulting was a specialized niche, and not many security practitioners recognized the opportunities it presented.

Now the need for independent advice and guidance is a given, and the consultant has come of age. No longer is consulting a niche in the protection industry.

Security consulting offers the most exciting new career opportunity within our industry. Indeed, it represents the freshest and most rewarding new career path since security management. There was a time was when senior positions represented the “hot button” in the protection industry. Those executive posts are still highly desirable, but now security consulting is equally attractive—indeed, even more so, for a variety of reasons that will be discussed in this work.

Comparison of the Security Executive and the Consultant

As a full-time, salaried employee, the security executive of a given corporation serves in some measure as a proprietary or in-house consultant to senior-level management. He or she recommends appropriate and cost-effective strategies to achieve a wide variety of security objectives, loss control, crime prevention, and investigative goals. Certainly a rewarding dimension of that work is the chance to manage and oversee the implementation of the plan and experience the success of the strategy. That is no small reward. Additionally, the company security executive enjoys many employee benefits, including job security.

The security consultant, as an independent operator, gives up such job security and company-provided benefits. More often than not, the consultant has little to do with the organizational activity of the company and the follow-up implementation of recommended programs. Hence, job satisfaction does not derive from the sense of being an organizational team player. The professional consultant’s rewards vastly differ from those of the in-house executive. They include the following:

• Control over each assignment

• Diversity of tasks

• Control over one’s time

• Freedom to be creative

• Freedom to disagree and criticize

• Freedom to live and work where one chooses

This list deserves closer examination, point by point.

Control over Each Assignment

The corporate employee has little if any control over assignments and tasks mandated by management, even if the employee disagrees with the need or merits of such an assignment. Tasks trickle down the hierarchy in response to imagined or real organizational needs and must be tackled promptly and accordingly. Rare is the security executive who has not grit his or her teeth in frustration over dead-end, unproductive, or unnecessary assignments.

The consultant, as an independent professional, obviously is not so obliged. He or she may decide not to accept an assignment, and the rejection of a specific task need not jeopardize the relationship with that client. If a consultant, for example, personally objects to spending time conducting statistical evaluations, she or he is free to reject such work and recommend someone else with appropriate skills to do it, and do it more efficiently and at a lesser cost, or the task can be subcontracted to another.

That kind of control over one’s work is, in and of itself, rewarding.

Diversity of Tasks

The security executive of a given firm devotes years to focusing on one organization—or a given number of specific organizations, if the employer is a corporate or holding company. Put another way, the executive’s view is limited, and such limitations tend to narrow one’s perspective. Only so much tinkering, so much organizational realignment, so much security manual updating can occur. And a company’s security mission rarely if ever dramatically changes.

The security consultant’s work is virtually limitless, even if the area of specialization is narrow. Suppose a consultant specializes in retail security exclusively. The diversity in retail operations is staggering and includes the following criteria:

• Type of merchandise being sold

• Number of stores

• Size of stores

• Location of stores

• Number of company employees

• Size and organizational design of the security or loss prevention department

• Mission of security department (apprehension or prevention)

• Warehouse and distribution system

• Inventory shrinkage performance history

• Known history of litigation problems

My own consulting practice is not restricted to retail, but in just that one specialty I have consulted a range of clients:

• A membership department store with seven stores, all located within 150 miles of each other

• An international mass-merchandiser

• A university’s student store operation

• An exclusive Beverly Hills high-fashion retailer with only one store

• A drugstore chain in northern Mexico

• A fashion department store’s regional division

• A Midwest discount chain with stores in several states

• A national shoe store firm

• A military post exchange

• A hardware store chain

Each of those retail consulting assignments had a different mission. Here are a few examples:

• One client had no formal or structured security department, so my task was to design one from the ground up, write a security manual, and outline job descriptions.

• One client wanted a structured training program for agents who specialized in the detection and apprehension of shoplifters.

• One retailer wanted an audiovisual program for all employees to convey the message that security is everyone’s responsibility.

• Another retailer limited the scope of my work to analyzing the company’s distribution system for what management suspected was a faulty system that facilitated internal theft.

• Several retailers wanted to reduce inventory shrinkage without implementing major organizational changes.

Thus the diversity represented in the needs of each consultant’s client makes for new challenges on an ongoing basis. Nothing becomes routine. There’s no chance for burnout to occur. The horizons are limitless. The adventure of each day is the daily motivator. And the day’s adventure proves to be the day’s reward, the professional reward.

Control over One’s Time

Rare is the person who does not count the days until vacation time or the holiday weekend. Such counting does not indicate dissatisfaction with one’s career but rather points out our longing for personal time, time not dictated by the company enterprise. The independent consultant truly owns and controls her or his own time. One of my colleagues simply refuses to schedule work one week each month; that week allows personal time for him and his family.

I do not so strictly regiment my time each month, but when a job involves travel, I do set aside extra days to visit friends and relatives, to enjoy warm beaches or golf courses, and to replenish my own wellspring of life.

Freedom to Be Creative

Certainly, creative freedom varies from organization to organization. To suggest that security executives never enjoy such freedom would be erroneous. Yet one cannot deny that more constraints exist within a given corporate culture, and employees can be inhibited about applying new ideas in solving old problems. Typically, the outside professional consultant is not influenced by those corporate constraints.

Management generally will consider recommendations and ideas from a consultant that would be rejected off-hand if suggested by members of the company’s own staff. This is a phenomenon I do not fully understand, but it does happen.

Let us say that a consultant perceives that a company’s line supervisors do not understand the role of security and do not support the protection program. Everyone, including the firm’s security director, knows that supervisory support tends to bring about line employee acceptance of company programs. The objective, then, is to get the supervisors’ support. Whereas the security director would not dare suggest that supervisors from various departments be included as observers in actual security investigations (to better understand the consequence of good security), the consultant could suggest such a radical idea. And that creative approach could be met with acceptance and implementation.

If senior managers did not seek new, creative, dynamic suggestions and alternative ideas, they would not call in a consultant. If they had the solution to their problems in hand, they would not need a consultant.

The corporate security executive, no matter how talented he or she may be, runs out of new ideas over time, not because of a lack of imagination but because of the limitations automatically imposed by the confines of the corporate entity. And many executives have learned that the conservative approach bears fewer risks of exposing oneself to ridicule or rejection. The consultant is new to the corporate entity and its problems or challenges, and that freshness inspires new solutions. Furthermore, the consultant need not fear exposure or rejection, because a certain percentage of a consultant’s work is rejected (recommendations not accepted or followed) in virtually every assignment.

This creativity is not limited to recommendations to clients. How the consultant manages her or his practice allows for the expression of a distinct personality and sense of creativity. That includes how books and records are maintained, how the work product (the consultant’s final report) is packaged, and how projects are proposed. All facets of the professional approach can reflect the individual businessperson. Security consulting is a new enough field that there are no wheel ruts in the road left by those who preceded us. There are, in fact, few roads.

Freedom to Disagree and Criticize

As oversimplified and perhaps trite as it may sound, executives are expected to agree and accept, whereas independent consultants are expected to disagree and criticize. The corporate executive who criticizes management and the consultant who fully accepts a client’s program will soon be headed for new career opportunities elsewhere.

This is not to suggest that consultants should seek confrontations or approach their clients as adversaries. Rather, they are obliged by virtue of their objectivity, independence, and professionalism to respond directly and honestly to a client’s challenges. Straight talk is the consultant’s privilege, right, and freedom. It is a unique and rewarding experience to warn clients that they may not be happy with your assessment of their operation while the clients still encourage you to be candid.

I have been advised, in previous assignments, to avoid confronting the chief executive officer with what was perceived as the company’s taboo topic, out of fear that my entire consulting project would be thrown out the corporate door. I have never been dissuaded from following my conscience and reporting my findings and, as sensitive as some issues have been, I have never suffered as a result of that honest commitment.

One retail firm, committed to reducing inventory shortages, retained me for guidance in that objective. One of the company-wide problems was a lack of compliance with procedural controls. Company managers talked loud and long about the need for every employee to follow shortage prevention procedures, particularly to avoid paperwork errors. My survey disclosed that the company chairperson was the worst offender of all. He would visit a store, make on-the-spot mark-down decisions, and instruct store management to bypass the price-change procedure that would ensure a balance between book accounts and physical inventory. My report cited this problem and stated that if employees were expected to follow the rules, the chairperson would have to set the example. No one else had been willing to confront the head of the company. Because of an outsider’s report, however, he did refrain from some of those impulsive price changes and helped build a new atmosphere of shortage awareness at all levels in the company. The company’s shortages have been on the decline ever since.

Another consulting project allowed me to work closely with a member of middle management who daily took exception to some of my critical observations and informal suggestions. That stalwart executive kept falling back on such statements as, “We’ve never done that before and our philosophy is to trust our employees,” in response to my concern over insufficient preemployment screening. That executive, in fact, warned me that if some of my informal comments found their way into my formal written report, any future consulting assignments for me could be jeopardized. I had the freedom (and, I believe, the obligation) to indeed include those critical observations and appropriate remedies. I was not retained for any more work for that company for a long time, but I would still do it all over again![1] Every professional consultant that I can think of would do the same, too. Surfacing and reporting findings, favorable or otherwise, is the consultant’s solemn responsibility.

Freedom to Live and Work Where One Chooses

One high mark earned by the consulting professional is the freedom to live and work anywhere one chooses. A security executive must live and work near the employer’s facilities. Location can be the overriding factor in employment choices. If one wishes to rise to the level of a vice presidency and the opportunity presents itself in New Jersey, the qualified candidate must be willing to live there and forego the warm beaches of Florida. Independent security consultants are located in various cities throughout the United States because, for whatever reason, they choose to be there.

Just imagine, if you’ve always wanted to live on a golf course in the lovely mountains of northern San Diego; you may do so and build a business, too.

The Consultant’s Daily Work

What is a consultant? The American Heritage Dictionary defines a consultant simply as (1) a person who gives expert or professional advice or (2) a person who consults another. The International Association of Professional Security Consultants (IAPSC) defines a consultant as a person who provides security advice, information, and recommendations to management and the legal profession.

To discover in more detail what distinguishes a security consultant, while once speaking to attendees at the IAPSC’s annual meeting, I asked seminar participants (who represented both practicing consultants and prospective consultants) to jot down what they do. Their answers offer some meaningful insight to the work:

• “I gather information relating to the client’s security arrangements, analyze vulnerabilities, prepare a report outlining our findings, and list recommendations to improve vulnerabilities.”

• “I provide the benefit of my expertise to clients to assist them in identifying and controlling losses and reducing risks, as well as provide expert testimony.”

• “Help corporate clients prevent crime and protect their assets...and determine if security is adequate.”

• “I see my function as a problem-solver, even to the extent of discovering a problem before the client knows one exists.”

• “Assess risks and recommend cost-conscious programs to prevent loss of life and property.”

• “Evaluate client’s existing security situation and make recommendations for improving the situation within a reasonable time frame at an acceptable expense.”

• “I develop solutions to security puzzles.”

I shared with the attendees of that same conference the story of my very first appearance before a prospective client. I was ushered into a boardroom. Seated around a large and beautiful glossy table were half a dozen senior executives, rocking to and fro in large black leather chairs with high backs. A round of introductions followed, and then I was seated. I had been called there by one of the company’s officers. I had not submitted any proposal, nor did I fully understand the company’s security needs.

The chairperson, a delightful gentleman, wasted no time and succinctly put to me one question. I shall never forget his words, “Well now, Chuck, what are you going to do for us?” Here I was, a new consultant, and I was shocked by that unexpected question!

So, I posed the same question that that chairperson put to me and asked the attendees of the consulting seminar to quickly jot down what they would say. The following are a few of those responses:

• “I will give you the benefit of my experience in protecting your personnel and assets at a cost which will speak favorably to your profits.”

• “I am going to analyze current security management practices in relationship to industry norms as I know them. I will then be in a position to verify those practices or recommend changes in your program.”

• “Work with you to define the scope of your security problem. Propose an approach for getting information to evaluate that problem or problems, and present to you a series of alternatives to address those problems.”

• “I will provide my expertise and experience to identify the existing factors of risk in your operation, analyze the risks, and provide my recommendations as to the measures to be taken to reduce, control, or transfer the risks.”

• “I will provide an objective assessment of the company’s/institution’s security arrangements with recommendations for any needed improvements.”

• “I’m going to guide you through the process of solving your problem by helping you organize available information, gather needed information, and utilize my experience in the process.”

Not bad answers at all.

Beyond the dictionary’s definition, security consulting is in every sense of the word a process, a problem-solving process in which the consultant must first identify the problem(s), gather available data pertaining to the problem(s), analyze that data, and then offer advice in the form of recommendations that will solve, cure, or otherwise minimize the problem(s). Sometimes consulting assignments do not require us to solve problems. When designing a security plan for a new enterprise, for example, a consultant will follow a problem-prevention process to guide the company into a secure future.

By the way, my response to the chairperson’s question was, “What do you want me to do?”

Other Examples of a Consultant’s Work/Tasks

Some years back while preparing for a national presentation on the topic of security consulting and what consultants do, I prepared what I called my Alphabetical Soup of Consulting.

Perhaps you’ll agree that it does offer a rather interesting insight into the kinds of things we do in this profession:

A. Advise management on what’s current—that is, state of the art

B. Build bridges between security and other departments

C. Clarify and rewrite security policies, procedures, and the like

D. Define organizational goals and mission statements

E. Expedite security projects

F. Forecast protection needs in the future

G. Guide management in its selection of personnel, equipment, and services

H. Help hire qualified security personnel, especially at the executive level

I. Identify problems

J. Judge past and present performance

K. Kindle new enthusiasm or interest

L. Launch new programs by conducting orientation meetings

M. Modify security operations when and where appropriate

N. Negotiate, on behalf of management, for optimum contracts

O. Objectively evaluate security programs, present and future

P. Present new ideas and strategies

Q. Qualify senior security candidates for management’s consideration

R. Review security budgets

S. Supplement the security management staff on a temporary basis

T. Train security employees

U. Uncover unproductive policies, practices, or programs

V. Validate existing or planned activities

W. Warn management of risks and unnecessary exposure

Y. Yield unbiased and honest opinions

Z. Zealously provide the highest order of professional assistance and guidance possible to each client.

These pursuits constitute a worthy profession indeed.

[1]Several years after the warning, that corporation again retained me for another specific task. Subsequently, over a span of years, I was retained several more times and used in various parts of the country. Surely this represented an appreciation of integrity and the quality of the work product.

Chapter 2

Qualifications of a Professional Security Consultant

An attorney, accountant, teacher, or registered nurse has a clearly defined path of preparation to follow to earn that title. That is true with virtually any occupation. If a person deviated from the prescribed preparatory steps and yet claimed to be, say, an engineer, that person could be viewed as a fraud.

We live in a society in which credentials are mandated. The credentials speak for the holder. No one likely would argue with the need to ensure that one is qualified to perform as promised.

However, there is no clearly defined path that qualifies one to be a consultant. There are no college or university programs that lead to a consulting undergraduate or graduate degree. There are no governmental regulatory bodies, like a state’s board of medical examiners, to license consulting practitioners.

As a consequence, to become a consultant, all one must do is say, “I am.” And some people do just that.

Irrespective of predetermined training, qualifications do exist. The one who is truly unqualified to perform as a consultant will soon be exposed and rejected.

There are four broad areas of competence that a consultant must achieve not only to be considered qualified but to sustain one’s practice:

• Experience

• Education

• Professional credentials

• Personal and interpersonal skills

Experience

The ideal security consultant would possess work experience in three consecutive tracks: line or functional experience, supervisory experience, and managerial experience. Let us look at each of these levels, one at a time.

Line Experience

The consultant should have worked, hands on, in whatever specialty he or she claims expertise—that is, I worked in retail security, and in that field of specialty, I personally laid up in ceiling plenum chambers for hours surveilling cash registers with a history of shortages and did observe dishonest employees manipulate sales and refund transactions. Following the observed thefts, I would personally interrogate the thief. That kind of line or functional experience is invaluable when consulting with a retail firm about internal investigations.

Supervisory Experience

The supervisor is a genuine catalyst in the workforce, serving as a liaison between the line employee and management. He or she translates programs into action and, in reverse, points out problems of execution to the program designers. A consultant who has no experience in the “buffer zone” is at a disadvantage.

Another benefit of supervisory work is that one experiences personnel performance appraisal. Supervisors rate and measure the performance of employees; that type of background contributes to an overall understanding of a client’s employee productivity needs.

Managerial Experience

This kind of experience is most valuable. How can one talk to managers, understand managers, and identify with managers’ concerns and problems, unless one has been there? How can the consultant appreciate budgetary constraints and budget battles unless he or she has smelled the gunpowder of the fight?

Education

Two years of college should be the minimum amount of education required of a consultant (there are always extraordinary exceptions, of course). Those two years should include some emphasis on communication skills, writing skills, business law, accounting, and psychology. More ideally, the consultant should have a bachelor’s degree in our profession—that is, security administration, security management, administration of justice, police science for those in management consulting; electrical engineering, electrical technology, or architectural degrees in technical consulting; and management information systems (MIS) degrees for information technology (IT) consultants. Any number of other degrees would be suitable, from education, and accounting, to business administration, depending on one’s career experience before launching into a consulting career.

The value of the one’s education lies in what it represents in terms of work, commitment, and self-discipline. That speaks well for the woman or man who is advising others on how they should conduct their affairs. Also, the majority of people in managerial or executive positions in the companies for which you will work have earned degrees; right or wrong, they expect an outside consulting expert to be similarly educated.

Professional Credentials

Another dimension of professional activity exists beyond work and formal education; this I categorize as professional credentials. It includes areas such as obtaining professional certifications, membership in professional organizations, public speaking, and writing (authoring books and publishing articles).

Professional Certifications

The majority of security consultants possess one or more professional certifications. The security industry’s first certification, the certified protection professional (CPP) designation was a program launched in 1977. It followed years of research by the American Society for Industrial Security (ASIS). Like all professional certifications, this certification is based on a specific body of knowledge (books, articles, white papers, and other writings) that the applicant must study, understand, and successfully pass an examination on, similar to testing for the legal profession’s bar examination. Our security consulting industry has its own “body of knowledge” and testing program, and upon successfully passing the examination one is awarded the designation of certified security consultant (CSC). Depending on one’s career specialty and education, there’s a wide assortment of professional designations within the security consulting profession. Here is a partial list of designations owned by the consultants who helped to write this fourth edition:

• CSC: certified security consultant

• CPP: certified protection professional

• CISM: certified information security manager

• CISA: certified information systems auditor

• CFE: certified fraud examiner

• PSP: physical security professional

• CDP: certified in disaster preparedness

• CPO: certified protection officer

Membership in Professional Organizations

Membership in various professional organizations is not a measure of one’s gregarious nature but rather demonstrates an interest in what others are thinking and doing, the willingness to share with others, the involvement with activities that invariably spin off volunteer organizations, and an effort to stay current in one’s own field.

Good judgment dictates how many organizations to which one can reasonably and profitably belong. At this point in my career, I maintain membership only in the International Association of Professional Security Consultants (IAPSC) and ASIS. The former is extremely important to me because it serves my needs as a practicing consultant (it’s a consultant’s organization for consultants only), and the latter is important because it services the industry in the broadest sense. That limited membership is by personal choice; many other fine security organizations exist. As time passes, more sharply defined organizations are emerging, with more focus on special problems—for example, the International Association for Hospital Security.

The point is that the consultant cannot exist in a vacuum. Consultants can benefit, even if in small measure only, by affiliating with and sharing with peers, colleagues, and practitioners within the industry.

Another value in belonging to and participating in professional organizations is many are empowered to administer and award specific professional designations. For example, the CPO designation is administered by the International Foundation for Protection Officers. One can earn this certification through a correspondence program.

Another important certification that can be obtained in the consulting profession is that of certified management consultant (CMC), obtainable under the auspices of the Institute of Management Consultants located in New York City. A candidate for the CMC designation must take a written examination, appear before an oral board of consulting peers, and submit a list of prior clients who are queried as to the quality and effectiveness of the candidate’s work. This is the professional hallmark for consultants in all disciplines, not just security consultants. I held that designation for many years.

Public Speaking

A would-be consultant should seek out opportunities to speak publicly about security-related issues and topics. Speaking enhances one’s visibility and reputation and is one of many marketing tools to expand one’s practice. These presentations are relatively easy to arrange, with a wide variety of service organizations and professional groups constantly seeking fresh speakers with interesting topics. During the first year of my own consultancy, I relied on speaking honorariums as a source of income. However, whether or not a fee is paid remains unimportant in terms of building this base of qualifying experience that is so valuable in the consultant’s background. Volunteering to speak or sit on a seminar panel presentation within our own industry (be it local chapter programs or national seminars and meetings) is another avenue to this speaking experience.

Writing (Authoring Books and Publishing Articles)

It may be fair to say that if you cannot write you cannot consult. Rare is the consulting project that does not result in a written final report of recommendations. I do not think I know one security consultant who has not published work in one format or another, including articles in magazines or newsletters. And I’ve contended forever (it seems) that there’s a book in every consultant, and my library is living proof of that belief because the number of books authored by fellow security consultants continues to grow.

The security industry has a variety of magazines and trade publications that are most willing to publish timely and well written articles by members of our profession and even outsiders.

Although there is clear and unmistakable value in having an article published for readers within our industry, there’s even more potential benefit, more bang for the buck so to speak, in writing for journals outside our profession. Why? Security publishers usually don’t pay an honorarium for an article; many other industries do. It would be unusual to get a consulting assignment as a result of an article in security publications, whereas you stand a good chance of being contacted for possible work as a consequence of your article in a magazine that focuses on another profession. For example, I authored a relatively short article for Cleaning and Restoration (the official publication of the Association of Specialists in Cleaning and Restoration) titled “Hiring the Best, Avoiding the Rest” with the subtitle “Honest, hard-working employees will make you money. Dishonest ones will take your money. Here’s how to hire the honest ones.” I was compensated for writing it, and it brought me consulting assignments.

To be able to provide a prospective client with a bibliography of articles you’ve published goes a long way in establishing your reputation as a professional. If you are not published as you read this, set yourself a goal right now to write an article and get it published! A would-be consultant must have a demonstrated track record of effectively communicating by way of the written word before he or she hangs out that consultant’s shingle.

Personal and Interpersonal Skills

As fundamental as it is and as obvious as it may appear, there are some important factors about each of us, as human beings and as individuals, that enhance or impede the business of consulting. Those skills or qualities include the following:

• Integrity and honesty

• Demeanor

• Patience

• Persuasive powers

• Grooming

• Self-confidence

Integrity and Honesty

The man or woman who seeks a career in consulting, particularly in the security industry, must be an impeccably honest person of deep integrity. The opportunities for a wide range of unethical and dishonest practices far exceed those in most professions. It is easy to cheat on billing clients because verification is almost, if not indeed totally, impossible. Clients must have confidence that proprietary information is not shared with competitors or any outsiders. Regrettably, some consultants have failed in this area, just as other professionals have failed in theirs.

Demeanor

The consultant is invited into the true inner sanctums of business and industry, where social graces and expectations are at the highest levels. Just hours after sitting with executives in the finest of leather chairs on only the finest of Persian carpets, sipping coffee from bone china, I have found myself probing trash with janitors and line security officers. If you conduct yourself with confidence and with due respect to all concerned, you will be accepted equally by the cast of characters at both ends of the organizational spectrum.

Patience

There is a time to hustle and a time to wait, and the consultant who understands timing is a person of patience. Organizational delays are the most frustrating of all, primarily because your “meter is running” and valuable time is being wasted—not by your choice but by the organization’s.

Hence, patience is required in awaiting decisions, meetings and appointments, information and materials you need to progress in your analysis, and action promised as well as action required for the analysis. For example, one client was wasting money by hiring off-duty police officers part-time to guard cash office operations in each store. My recommendation was to eliminate those payroll expenses and physically modify and secure the cashier offices. A couple of years elapsed before management decided to incur the one-time capital expenditure to remodel the offices and do away with the exorbitant payroll costs.

Persuasive Powers

It only stands to reason that the consultant is going to suggest change. If change were not deemed a remote possibility, then a consultant would not have been called to the scene. Thus change more often than not is an inevitable consequence of the consulting process. Yet human nature being what it is, people resist change. Many decisions in an organization are the responsibility of a collective group such as the executive committee. Some members may favor the change, whereas others may oppose it. The gentle art of persuasion on the part of the consultant tends to expedite change.

Grooming

We are all guilty of the tendency to judge others based on their appearance. How we present ourselves in dress and personal grooming can make the difference between gaining or losing a contract. Conservative business suits, polished shoes, and good taste in accessories all say something positive about the person. A casual skirt or flashy tie belongs at the racetrack, not the boardroom.

Finally, all the foregoing is offered with the belief that the would-be consultant has a skill to offer, an expertise to share. That goes without saying. The independent and professional security consultant has absolutely nothing to sell or offer other than experience, advice, and good judgment. Those “commodities” are the very underpinning, the foundation, on which the consulting practice is built. This chapter has addressed the other qualifications.

Self-Confidence

I don’t know how a person could survive as a consultant if he or she lacked self-confidence. Those who seek out an expert (and that is what a consultant really is—an expert in a given area) expect the expert to be in full command of the topical area in question and to move to resolve the issue with confidence. Confidence is exuded, a quality that is discernible to those around us. If you don’t know your stuff, if you don’t feel good about yourself and what you can do, it’ll show. The lesson here: don’t take on tasks you are not qualified to handle.

Chapter 3

The Ten Most Common Questions Asked about Entering the Profession

The questions people ask concerning career opportunities in security consulting tend to become repetitive. I’ve condensed those questions into the ten most commonly or frequently asked, and here I offer some answers.

Question 1: Of All the Things One Should Do to Be Successful, Which Is the Most Important?

There’s more than one quality, characteristic, or value necessary for success. Perhaps the most important is integrity, closely followed by an impeccable quality of work. Then comes the need for calm self-confidence, even in the face of worrisome problems and obstacles, all bound together with a real dedication to succeed. And last but certainly not least, one must have the self-discipline to attack the work and get it done.

Question 2: How Much Time and Money Are Required to Open a Consultancy?

That is a good question, because time is equated with money. My understanding when I started my own business was that I should be prepared to support myself financially for one year. That arbitrary figure is misleading, however. I think my colleagues would agree that it takes longer than twelve months to become financially established and secure.

Unless you consultant begin with a handful of corporate retainers to guarantee income or unless you open the doors for business with a major contract in hand, it would be prudent to plan on building your reputation and practice for the first one and a half to two years.

Financial requirements for a new business are very subjective. Money, for the independent as well as the corporate budget, is divided into three categories:

1. Payroll (your salary)

2. Sundry expenses (stationery supplies, printing, website maintenance, telephone expenses, travel, etc.)

3. Capital expenditures (desk, personal computer, printer, copy machine, file cabinets, etc.).

Operating out of one’s home, which I do, reduces costs considerably. I started with odds and ends and one typewriter, and I was off and running with an initial investment, including my printing costs, of less than $2,000. Today, with a personal computer, probably $6,000 to $7,000 is more realistic. Then you must stay afloat until the cash flow exceeds your former income level. Your most immediate goal is to generate a net income that matches the salary of your previous job.

How do you stay afloat? You should be prepared to bankroll or support yourself for about eighteen months. If you were earning $90,000 as a security executive, retired federal agent, or law enforcement official, you should have at least that amount, and probably half again that much, on which to draw. You will hope not to use it up, but it must be available in one form or another as a cash reserve. Certainly one advantage of that reserve has to do with a sense of financial security, an important psychological factor, particularly in view of the probable fact that you have always had a salary to count on and now you do not.

Question 3: How Does One Know One Can Make a Living by Being a Security Consultant?

Others do it, so why can’t you? The only way to really know is to try it. Surely there are indicators your career that from suggest the likelihood of your success. Have you solved problems that brought you recognition? Have you developed a plan or program that earned you a reputation as an innovator or achiever? Have others seen you as a leader, a risk taker, or a creative manager?

The successful consultant of today has probably demonstrated such qualities while serving as a practitioner.

Question 4: How Does One Go about Marketing One”s Consulting Skills?

Chapter 7 is devoted to this topic.

Question 5: Is Prior Law Enforcement Experience Valuable?

Law enforcement is but one of six major professions for dealing with crime in society:

1. The criminologist, who studies the causation of crime

2. The security specialist, who attempts to prevent crime from occurring

3. The police specialist, who enforces criminal law, including the detection and apprehension of the person who commits the crime

4. The judiciary, who deals with the innocence and guilt of suspected criminal offenders

5. The correctional specialist, who deals with the incarceration of the criminal

6. Probation and parole people, who deal with offenders on a post-release basis

Although these players share one common target—crime—they each have totally different missions. A person who excels in one of these fields will not be guaranteed the same level of success in another.

In truth, these crime-related experiences really aren’t necessary in information consulting and technical consulting. Rather, activities such as mechanical or electrical engineering and management information experience are far more appropriate for prospective consultants who will focus in those specialties.

The bottom line is that law enforcement would be of some benefit to those in management consulting and, in some measure, in forensic consulting.

Question 6: Is It a Good Idea to Find Work in Another Management Consulting Organization before Trying to Break into Independent Security Consulting?

Certainly any consulting experience will help, but it seems to me that such a strategy defeats the purpose of entering into an independent consultancy. One of the major attractions to being a consultant is the independence and freedom it affords.

Question 7: Where Can One You Find Security Consulting Standards to Ensure One is Operating in the Mainstream?

There are no published consulting standards as such. There is a growing body of “custom and practice” guidelines, best accessed through the International Association of Professional Security Consultants (IAPSC). Membership, attendance at the annual meeting, and personal contacts and friendships plug one into what is happening in the business. That association has published a code of ethics that can serve, in some measure, as a guideline (see Chapter 17).

There simply is no substitute for personal contacts and the exchange of ideas. As an independent consultant, I found myself alone and in need of colleagues and their thoughts, hence my founding of the IAPSC. To this day, I seek out the advice or good counsel of other consultants, even if only to reaffirm something I am doing or thinking of doing.

The Institute of Management Consultants USA also has published a code of professional conduct and offers a certification program for management consultants.

Question 8: How Can Fledgling Consultants Measure Their Worth?

The late Howard L. Shenson, known as the consultants’ consultant, has provided the best formula, in my judgment. In essence, your fee should be based on the following factors:

1. Direct labor (the value of your service)

2. Overhead (about 45 percent of your labor cost, including benefits)

3. Profit (about 15 percent of your labor and overhead)

Let us look more closely at each of these three components of the fee:

Direct Labor (the Value of Your Service)

• You just left a position that paid $90,000.

• You worked 241 days (3 weeks’ vacation, 6 holidays, and weekends off).

• Divide your salary of $90,000 by 241 working days and the value of each day worked is $373.

• Add benefits of at least 30% to the daily worth, or $112, because benefits were part of the compensation package although not reflected in your previous salary figure. Note that you are now responsible for fully paying for your retirement plan (401k or other), medical insurance, and the like.

Hence, $373 + $112 = $485 per day.

That was your daily worth when working 241 days a year. But you are not going to work every day as a consultant!

• Estimate the number of days you will work for a fee in the coming year. Use 140 days as a (good) example.

• Divide your former salary of $90,000 by 140 days, which amounts to $643, plus the 30 percent ($192 per day) benefit amount.

Hence, $643 + $192 = $835 per day.

In order to maintain the same income and work only 140 days, your daily value is $835.

But it costs you money to conduct your own business, so you must charge those costs, known as overhead, to your personal daily worth or value.

Overhead

A sampling of overhead costs looks like this:

Monthly

Annually

Clerical assistant (part-time)

400

4,800

Phone and computer

300

3,600

Travel (uncompensated)

600

7,200

Insurance

300

3,600

Postage/shipping/supplies

150

1,800

Marketing

700

8,400

Entertainment

100

1,200

Dues, subscriptions, meetings

250

3,000

Legal and accounting

175

2,100

Miscellaneous

100

1,200

Totals

$3,075

$36,900

• Divide the annual overhead costs by the number of days you expect to work—that is, $36,900 divided by 140 days equals $263 for daily overhead (cost of your daily service).

Direct daily labor

835

Overhead

263

Total labor and overhead

1,098

Profit to build your business @ 15%

165

Total

$1,263

• Your daily fee as a fledgling consultant = $1,263. (However, for quotes or billing purposes, rates in $25 increments are often used. Always round up; in this case your daily rate would be $1,275, or $160 per hour.)

These numbers are hypothetical and do not necessarily reflect a given consultant’s operating circumstances. Also note the absence of office rent or janitorial service, two expenses that must be considered if the office is not in your home. But the formula does give a rough guideline in response to the question.

I’ve talked to many new consultants, and typically they are charging too low a fee, a fee that sooner or later will force them out of business.

For your information, security consultants’ fees currently range between $1,400 and $2,800 per day, with most professionals charging between $1,700 and $2,400.

It is a fact that there are security consultants whose income is even substantially higher than $2,800 per day, but they are the exception.

Question 9: Does One You Have to Maintain a Parallel Career in Academia or Business to Keep Abreast of Industry Advances?

I lectured on a part-time basis for thirteen years at California State University at Los Angeles, but when I embarked on a consulting career I could not continue at the university because of the uncertainties of my weekly availability. It was not possible to make a commitment to teach every Wednesday evening when I was, at the same time, advertising myself as prepared to work anywhere in the world for any client at any time.

Teaching or working part-time in a security-related business is not how one keeps abreast of industry advances. That is accomplished by reading the trade journals; participating in appropriate associations; communicating with practitioners, colleagues, and peers; and reading the books published for our security industry.

Question 10: Is There an Average Period of Time over Which One Must Practice before Realizing Professional Recognition and Financial Success?

That’s a tough one! I am sure some of my established colleagues have various opinions on the definition of recognition and success. My best answer is that the first one to three years are the leanest. They represent the building years, the time one struggles not only for client acceptance but also for recognition within the industry. My experience and the experience of some of my closest friends in this business indicate that the curve is on an ever upward incline. I commenced my consulting practice in 1979 and my business grew every single year up to a couple years ago when I made the decision to drastically reduce my workload and focused on writing and enjoying semiretirement.

Recognition comes when someone you met at an IAPSC meeting or through other professional networks phones you for advice or refers a prospective client to you. Financial success is perhaps the most difficult to adequately define. This is subjectively interpreted. I can say that I know security consultants whose income exceeds the highest paid security executives in the country. That being the case, at what point between commencing the consultancy and this maximum financial achievement can you say you are successful? Everyone must determine his or her own standards.

Chapter 4

Starting the Business

Once you decide to become an independent consultant, the second decision is whether to incorporate, operate as a sole proprietor, or form a limited liability company (LLC). The LLC will be explained in more detail in the next chapter.

I and the majority of consultants I know chose the sole practitioner route, principally because it’s the least cumbersome, the easiest, and the least expensive. I consulted with an attorney friend at the outset about incorporating, and he assured me there was no particular advantage in doing so. Each year thereafter I again would broach the subject, and his position remained the same: “Why bother? You don’t need to and you don’t want to!” I listened to his advice. In your future, you’ll hope your clients listen to yours. In any event, if you have questions about which way to go, consult with an attorney.

I encourage you to approach this entrepreneurial venture as a sole practitioner with no staff, at least at the outset. As your business grows, you may wish to add a secretary, research assistant, or even another consultant, if you choose. On the other hand, I was a practicing consultant for over 30 years, was recognized as being quite successful, and remained unincorporated with no employees. After all, I left an excellent management position to be free and independent; to add staff would only put me back into a management position again.

With that aside, let’s now consider a host of other decisions and actions that, when completed, will allow you to open your doors for business:

• Geographic location of the business

• Specific location of the office

• Personal computer and website

• Telephone service

• Naming the business

• Press release

• Bank account

• Business record keeping

• Office equipment

• Stationery

• Insurance

We will examine these areas one at a time.

Geographic Location of the Business

Most of us consultants started our businesses in the cities in which we live, probably for two reasons. First, we assumed that a significant percentage of our business would come from within that community. Second, the trauma of this radical career change along with the trauma of relocating to a strange community would be too much to ask of oneself, let alone one’s family.

It would not hurt to consider relocating to a city that could serve more effectively as a hub of operations for your work. If your specialty happens to be in the security of petroleum refineries, oil drilling site security, and the transportation of petroleum or crude, it would not make a lot of sense to open an office in New York.

However, my office is in San Diego County, California, and I have relatively few clients in San Diego. As a matter of fact, I seriously considered moving to Omaha, Nebraska early in my consulting career because it simply made more sense to be there in the center of the country than in one corner, but my heart overrode my good sense and I stayed in southern California. Surely some potential clients opted not to hire me because of travel costs, but I have survived those losses. In fact, in the later years of my practice I spent an inordinate amount of time working in Hawaii, and clients were willing to pay the added costs for travel time and airfare.

There is something to be said about being close to your market and something to be said about living and working from exactly where you want to live. Corporate employees do not have that luxury!

Specific Location of the Office

If you can spare a room in your home and convert it into an office, that is a prudent way to begin. One obvious advantage is convenience. Plus, this option reduces your operating costs (overhead). Also, the Internal Revenue Service permits the businessperson who has an office in the home to write off a portion of the home rental or mortgage payment as an office expense.

A caution is in order here: you must have a great deal of self-discipline to operate out of your home because of constant distractions and temptations to wander away from the office into another part of the house. The convenience of the office in the home is a two-edged sword. I always have operated from my home, and from the first day I have kept business hours of 9 a.m. to 5 p.m. minimum, religiously, Monday through Friday. More often than not, I am at my desk before 8 a.m.

For those who opt for a more formal office arrangement, two common strategies exist. First, you could rent office space in a building where not only work space but typical office amenities are included, such as a receptionist who, among other tasks, answers your phone in your absence. This receptionist serves a pod or grouping of offices. This sort of office typically has access to a small conference room where you can meet with clients. Other amenities of this rental agreement might include copying and scanning services, wifi access, janitorial service, and office security. All in all, it is a neat package that certainly gives the consultant the appearance of success and professionalism.

The other option is the renting or leasing of the more traditional office, in which you hire your own secretary/receptionist who serves you exclusively. This is the most cumbersome option for the new sole proprietor and certainly is the most expensive.

Personal Computer and Website

Later in this book is an entire chapter devoted to the computer and the website as a tool for the contemporary security consultant. But a word or two here is appropriate because when security consulting was in its infancy in the 1970s, the personal PC was fairly new and its use was seen as an option, if not a luxury. Today the computer is essential for communication, marketing, research file and record retention, file and report preparation, and research. I cannot imagine a consultant without this vital tool. For starters, a consultant should have a website that displays his or her existence, describes the services offered, and is the vehicle by which the prospective client can initially assess/compare your services and expertise against those of competitors as well as make inquiries. There was a time when services were researched and sought via the telephone directory yellow pages, but those days are ancient history.

Telephone Service

The office telephone is a vital tool of your business because without a phone you are out of touch and unavailable to anyone who may be seeking your counsel, other than by e-mail. There are those of us who know full well that on occasion a prospective client launches into a frenzied search for a consultant and will go down a list and retain the first one who answers the phone. Indeed, the phone could be considered more important than the office. That’s why the smartPhone has surged onto the business scene, because these devices are virtually an office in your pocket.

In earlier editions of this book I talked about listing your business number with the local phone company and placing your consulting ad in their yellow pages, but I did caution that the consultant could be “lost” in the midst of security guard and patrol service, security control equipment, and systems and security systems consultants (typically fire and burglar alarm companies). I feel even more inclined to avoid the yellow pages today. There’s no harm in advertising in the yellow pages, but over the many years of my service I have never been retained by a caller using the yellow pages.

Telephone Equipment

If the office is in your home, you will need a separate landline or a cell phone devoted exclusively to business. If you choose to have a landline, depending on the size and layout of the house, you may wish to have a second extension to signal your business calls when you are in another area of the house. A cordless phone will let you sit by the pool or on the front deck and still deal with calls coming in on the business line (as well as a cell phone). And an office speakerphone lets you engage in phone conversations with your hands free.

Additionally, I have call waiting on my landline, so that while I am engaged in a phone conversation with one party, I will know if another call is coming in. This efficient, low-cost service is worth its weight in gold because it allows you to conduct business with only one business line yet accept incoming calls as though you had multiple lines.

I also use call forwarding to send incoming calls into my voice mail when I’m not in the office or unable to answer my phone. It works like a charm!

Smartphones incorporate all of these elements into a single device, with the added convenience of access to e-mail and the internet. Smartphones are usually compatible with Bluetooth, which allows you to talk hands-free while working or traveling. While I don’t personally send text messages, many consultants find them a useful way to communicate. The important thing is to find the tools that work best for you.

Although the fax machine is still a viable piece of office equipment today, I prefer to use a scanner and attach the document to an e-mail message.

Answering the Phone

Unless you have a secretary or other employee dedicated to answering the telephone every business day throughout the year, you can subscribe to your phone carrier’s automated answering service or utilize an answering machine. Both have their drawbacks.

The telephone answering machine answers your incoming calls with your prerecorded message. You can remotely access the messages if you are out of town. This system does work, and a number of my colleagues use such equipment. I personally had the frustration of a mechanical failure and lost some messages, so I changed over to an answering service.

Answering services provide their own peculiar frustrations for their subscribers, such as transposing phone numbers, neglecting to give you your messages when you call in for them, and misunderstanding the sound of the caller’s name. For example, the answering service informs you of a call from a Ms. Betcurns. You call Ms. Betcurns and the receptionist tells you that no such person is at that number. You tell her you are returning a call taken by your answering service, which tends to misunderstand the phonetics of names. The receptionist understands, and the two of you conclude that the call must have emanated from Ms. Betty Karens of their office. The answering service is, nonetheless, a bargain, and some operate quite professionally.

I’ve used the answering machine as well as a professional answering service, but today I use my phone company’s voicemail service. In a sense, it’s a combination of the other two options with the following advantage: the phone company’s equipment is professional and won’t fail, and I feel the consultant’s own message, assuming he or she has a good speaking voice, actually has a positive influence on the caller. Don’t use a prerecorded canned greeting.

Naming the Business

Three options are available for naming a new consulting business. The first is simply to use your own name:

Option 1

LOUIS T. STEFANO, INCORPORATED.

STRAUCHS, LLC

The second option is to include your name with some description of the business:

Option 2

SILVA CONSULTANTS

WITHERSPOON SECURITY CONSULTING

The last option is when the consultant names the business with a descriptive title that suggests the specific nature of the consultancy:

Option 3

LOSS PREVENTION AND SAFETY MANAGEMENT, LLC

RISK DECISIONS

LOSS MANAGEMENT CONSULTANTS, INC.

State and local laws apply to establishing and conducting business. The authorities will provide direction and outline the nominal legal requirements.

I elected to name my business Charles A. Sennewald & Associates because I had established somewhat of a reputation prior to entering the consulting profession. The reputation was based on having authored a successful security book (Effective Security Management), plus I had been actively engaged in lecturing in national seminars across the country. Hence, I sought to maximize my name. It worked for me, but in retrospect, I denied myself the opportunity of ever selling my practice. I built a business around Chuck Sennewald and no one can take over for me. That means I have no equity in my consultancy. This is very important. It suggests that the best long-term strategy could very well be to name your business something you can sell in the future, if you so desire. I could conceivably sell to a reader of this book a business titled SECURITY CONSULTING PLUS, but no one is going to buy Charles A. Sennewald & Associates.

Press Release

The formation of a new business requires some form of announcement. You may purchase institutional advertisement space in trade journals, request free exposure in trade journals, send a formal printed announcement to prospective clients around the country, and garner some free publicity in your local newspaper.

A typical free announcement found in Security Management magazine’s “Around the Industry” section under the “Security Observer” heading might read as follows:

Ellen L. Smith, CPP, has formed a security management consultant practice called Security Management Guidance Services, Inc., and will serve as its president. The company will be located at 4000 Hilldrop Dr., Los Angeles, CA 90017. The phone number is 213-555–2020.

Perhaps more importantly, place an announcement in your own local newspaper. The objective, of course, is to let people know that you have established a consulting practice and are now available.

Bank Account

Establish a checking account under the firm’s name. Many banks will not extract a checking service charge if you maintain an agreed on minimum balance. And some banks, not many, will pay interest on your average balance. Thus you can write checks for free and earn interest at the same time. Only business-related expenses, including your own draw (salary), should be written against this account.

Business Record Keeping

I maintain two sets of records: a daily business journal and a financial journal.

Daily Business Journal

I have a 300-page, 10-by-12-inch bound book in which I make daily notations about business activities. These activities can also be noted in a document or spreadsheet on your computer or on other electronic devices. Here is a sample entry for a day in January:

Made a half-hour Retail Loss Prevention presentation to the winter International Consumer Electronic Show at the Las Vegas Convention Center for the agreed upon flat fee of $500.00.

This is not a required business activity, but I have found it useful for experiential and historical reference. I also use it to record my automobile mileage—a suitable record in the event of an audit by the Internal Revenue Service (IRS).

Financial Journal

I enter all of my financial transactions, disbursements, and receipts in a 24-column journal, as depicted in Figure 4.1. This is the classic, old-fashioned way to keep financial records. More modern methods and software programs are available for one’s personal computer. This detailed record is vital to one’s business.

Figure 4.1   Financial transactions, disbursement, and receipts recorded in a 24-column journal.

As indicated in Figure 4.1, every entry is made at least twice—that is, as a bank deposit or withdrawal and where that particular debit or credit belongs as a defined expense or type of income. Each column is totaled at the end of each month. Monthly totals can be recorded and compared for trends.

Because I had maintained these hand-entry journals for so many years, I wasn’t inclined to convert them to new computer software programs, which are easy to maintain. But new programs are out there and should be part of the record-keeping system in a new consultant’s business.

These records are indispensable in the preparation of your taxes and would be valuable documents in the event of an audit by the IRS (supported by the source’s document, i.e., invoice or bill).

Office Equipment

Here is a list of equipment recommended for starting a consulting business:

• Personal computer (desktop and/or laptop)

• Printer and scanner

• Smart phone

• Copier

• Legal size four-drawer filing cabinet

• Video and digital camera and recorder

• Desk (with side bar to accommodate a computer) with chairs

• Bookshelves to hold a security industry library

• Small audio recorder

• Fax machine

• Internet-connected phone

Stationery

Once the name of your firm has been established, a graphic artist can develop an appropriate logo, should you desire one, for you to include on your letterhead and advertising materials. Or if you choose not to have a logo, a graphic specialist can recommend a professional layout for your letterhead and business card.

Care must be taken in this seemingly simple task, because your stationery says something about you and your service. Tasteful layout of the letterhead and quality paper and printing all suggest a top-notch business.

Insurance

I asked a respected colleague what advice he would give to a person considering establishing a consulting practice, especially about insurance. His response, generally speaking:

• Bear in mind, the insurance covers the legal fees associated with one’s defense.

• A new consultant (or anyone for that matter) should set up a liability limited business (e.g., LLC, LLP, etc.). The type of organizational structure will differ slightly from state to state, so one needs to consult with local counsel.

• Many consulting clients require proof of insurance in order to qualify for the project.

• Otherwise, I’d recommend a million dollar policy. The gross revenues of the business will affect the rate for the policy. The more you make, the larger the premium.

The significance of his comments seems clear, in this litigious 21st-century society, because they encourage the new consultant to seek professional guidance in the process of establishing a security consulting practice. (Chapter 15 focuses on the question of liability and insurance in depth).

Chapter 5

The Need for Effective Consulting Websites

Karim H. Vellani, CPP, CSC

A consultant’s website is often the first contact a prospective client has with the consultant. The prospective client should be engaged by the substance of the website and should be able to quickly navigate to specific content of interest. Websites can drive business, but they can also drive business away. Websites that have an outdated feel, are difficult to navigate, or lack substance are often closed quickly, with the consultant dropped from consideration. Alternatively, well designed websites that have tie-ins with social networks, blogs, or other forms of rapid and frequent communication can peak interest from prospective clients. Many books are on the market today that describe the elements of a good website. After culling through those books and online tutorials on website design, one might narrow down the key elements for creating a good website:

1. Compelling content

2. Visually pleasing

3. Simple navigation

Clearly, aesthetics and navigation play a significant role in creating a good website. However, like tax preparation and contract writing, some things are better left to the experts. Internet technology changes at a rapid pace, and small businesses often struggle to stay current. A website can go from cutting edge to obsolete in a short time frame. For most consultants, it is more effective and certainly more efficient to outsource the design (including navigation) of their website to a professional web designer. Website designers, however, are not experts in security or security consulting and will not be able to develop the initial content for the consultant’s website nor add new content that is ultimately of interest to prospective clients. As such, the remainder of this chapter focuses on website content.

Website content may vary significantly among consultant websites; however, the minimum content typically consists of a home page, a services page that describes the services offered by the consultant, and an experience page that articulates the consultant’s past consulting or business history. Each of these unique pages is examined in greater detail in the following sections.

The Home Page

The home page is often the first page a prospective client navigates to, either directly or via a search engine (Figure 5.1). With current search engine technology, it is possible for a prospective client to navigate directly to a page matching their search results that is not the home page; however, the home page is still the most frequent starting point based on website analytics software. The home page should have a brief overview of the website or a welcome message to the website’s visitors. Often, the overview is provided by way of navigation tabs, links, or other technology that visitors will use to access other web pages on the site. The welcome message may be brief and simply identify the website as belonging to a consultant or consulting firm. Sophisticated consultants and larger consulting firms will sometimes have some degree of branding such as a company logo. The single most important element of a good home page is contact information to allow the prospective client to get in touch with the consultant. This usually includes both a telephone number and an e-mail address. Sometimes, a website contact form serves as the primary method for contacting the consultant. Prospective clients may have a preferred method for contacting a consultant, whether it is via telephone, e-mail, or contact form. All should be provided to give the potential client a comfortable means of contact and to increase the likelihood that contact will occur. Geography also plays a role in client selection, so a physical address should be included somewhere on the website.

Figure 5.1   Example of a home page, courtesy of Threat Analysis Group, LLC. (From www.threatanalysis.com.)

In some cases, the website may provide a secure portal for client access only. The secured portal leads to nonpublic web pages that are accessed via a user name and password. Clients can log in and access, for example, past security risk assessment reports, security designs, or other client-specific data.

The Services Page

The services page of a website identifies the various or specialized types of offerings that the consultant is engaged in (Figure 5.2). This can include services provided directly by the consultant as well as other services provided via partnering agreements with other consultants who possess complementary skills or who subcontract. The services page may provide limited details regarding the services offered or alternatively may provide extensive details including methodologies used, past clients, and example projects.

Figure 5.2   Example of services offered on a home page, courtesy of Security Consulting Strategies, LLC. (From www.securityconsultingstrategies.com.)

Information may be on a single page or spread across multiple pages by category or market. There is no right answer regarding the level of detail needed to identify the offered services, but it should be enough to capture the interest of the reader and provide a general idea of the consultant’s offerings. The services page may also list the types of industries served or focus on one specific strength (Figure 5.3).

Figure 5.3   For example, business protection specialists identify some of the challenges specific markets face and how their services will resolve these issues. (From www.securingpeople.com.)

The Experience Page

The experience page is likely to be of utmost interest to a prospective client. Clients often want a consultant who understands their industry (i.e., vertical market); however, overstating one’s experience is not advisable. Experience may be demonstrated via a consultant’s biography, a list of projects worked on in the past, or simply by identifying the general category of industries served (Figure 5.4).

Figure 5.4   Example of an experience page, courtesy Quintech Security Consultants, Inc. (From www.quintechengineering.com/about-us.)

Experience can also be demonstrated by providing website visitors with case studies of past projects. Case studies should help potential consulting clients understand the consulting process and demonstrate the consulting approach or methodology. Most importantly, case studies demonstrate how the consultant arrived at an appropriate solution to the unique challenge. Some lengthier case studies include solutions that were rejected and the logic behind accepting and rejecting certain solutions. Case studies such as these are an opportunity to educate the client. Figure 5.5 is an example of a website that incorporates case studies.

Figure 5.5   Example of a case study, courtesy of SRMC, Inc. (From www.SRMC.com.)

In addition to case studies to demonstrate experience, consultants may also link to their own publications and research reports or post them directly on the website. Works that the consultant has published demonstrate his or her depth of knowledge on a particular topic, commitment to a particular industry, and writing abilities (sometimes a key factor in consultant selection).

Experience can also be demonstrated with publications, research reports, and studies. One of the more common approaches is to have a publications page that lists books for sale, for download, or that can be accessed by linking to online booksellers. Figure 5.6, for example, shows a book that is available for sale directly from the author and on bookstore websites.

Figure 5.6   Example of a publications page, courtesy of Charles A. Sennewald. (From www.shoplifting.com.)

Social Networking

Beyond the home, services, and experience pages, a consultant’s website may also include the integration of blogs and social networks. In fact, more and more websites now incorporate social functionality. Today, the most common social websites include Google+, LinkedIn, Twitter, and Facebook. While LinkedIn has always focused its attention on business, Google+ and Facebook are also now catering to businesses. By the time this edition of the book hits its one-year anniversary, it’s likely that a dominant social website will be missing from the preceding list. Currently, social networking websites are free for basic features, though some have advanced features available for a fee.

Links to Popular Social Networking Websites

Google+

https://plus.google.com

LinkedIn

www.linkedin.com

Facebook

www.facebook.com

Twitter

https://twitter.com

Social networking is not for everyone. It requires a firm commitment from the consultant to actively engage on a regular basis directly with the social networking website(s) or through the consultant’s own website, which is integrated with social components. For example, if a consultant’s website links to the consultant’s Google+ page, the Google+ page needs to be updated often and provide good information to those visiting. Substance is of paramount importance. If the information provided on the Google+, Facebook, or LinkedIn page is not relevant to the target audience (i.e., potential clients), the page does not add any value to the consultant. Similarly, blog posts and tweets (Twitter posts) must serve their intended audience. The information posted in the blog or “tweeted” should be timely, relevant, and interesting.

One of the more interesting social networking websites currently is Quora. Quora caters to people seeking information directly from specialists in a particular field, such as security consulting. As an example, a Quora user may ask about the best deterrents to burglars. Other users and specialists may answer the question. Quora’s unique feature, which other websites are rapidly copying, is the ability for Quora’s users to vote up or vote down an answer. This feature forces good responses (as voted on by users) to rise to the top of a question-and-answer exchange. A security consultant can increase his or her online brand by providing a thoughtful response. Readers (or potential clients) who find the answer to be of value can learn more about the author via the author’s Quora profile.

Link to Quora, a Professional Social Networking Site

Quora

www.quora.com

Blogs

Blog is short for web log. Blogs started as personal journal entries posted on the Internet for private viewing or for public consumption. In the 1990s, blogs evolved into a business tool that allows those selling products or services to market their wares. Marketing via blogs can be direct or indirect. Direct marketing via a blog occurs when a business, via its website or a separate blogging website, promotes its services or products. Indirect marketing with a blog entails the posting of articles, research studies, or links to other sources of information that are of interest to a potential client but may not discuss the business posting the information itself (Figure 5.7). Both indirect and direct marketing efforts via a blog have proven successful for generating business, and like a website, blog content is crucial.

Figure 5.7   Example of a blog, courtesy of Threat Analysis Group, LLC. (From www.threatanalysis.com/blog.)

There are many players in the blogging software field. Some of the more pervasive blogging software today includes Blogger, WordPress, and TypePad. Like social networking websites, most of the blogging software is free for basic features and some even include free downloadable software that can be installed directly on the consultant’s website (see the example from Threat Analysis Group, LLC). Moreover, there is a tremendous level of crowd-sourced support, wherein other users provide help and some even customize the blogging software.

Links to Popular Blogging Software

Blogger

www.blogger.com

WordPress

www.wordpress.com

TypePad

www.typepad.com

One of the more compelling blogging software functions today is the integrated RSS feeds. RSS stands for really simple syndication. RSS is a function that allows a blog’s core content (or other content site) to be accessed by other applications such as an RSS reader that one might find on a desktop, smart phone, or tablet computer. This allows subscribers of an RSS feed to access the blog using their preferred method and increases the likelihood that the consultant’s content is read. RSS feeds can also be used to stream the blog content to the consultant’s website or other websites. Security Consulting Strategies, LLC’s.

Mobile Versions

Increasingly, people are using mobile devices such as smart phones and tablet computers for productive work, including searching for consultants. Some websites, however, are not optimized for mobile access and may be difficult to read and navigate on mobile devices. Simplicity in website design is a significant benefit when considering the myriad ways in which potential clients locate information. More complex websites are usually more difficult to view on a mobile browser, particularly those that incorporate advanced Internet technologies that may not be available on mobile browsers. If the consultant desires a website with advanced technologies, a good path is to create both a desktop version and a mobile version of the website. Browsers automatically redirect to the appropriate version of the website. As discussed at the outset, the website’s accessibility on a mobile browser should be left to a professional web designer during the conceptual phase of the website’s creation.

Final Thoughts Regarding Content

Keeping a website fresh is critical to search engine ranking and audience participation. A website’s aesthetics and design need to be refreshed from time to time to maintain interest and to keep up with rapidly improving Internet technology. Websites with an outdated design and content are of little assistance in generating business for a consultant. No matter how good a consultant is, a prospective client’s interest may decline quickly when confronted with clearly outdated information. Websites with general content may not need to be updated often. Websites with more specific content require more frequent updates. A good rule of thumb is to review all website content at least once per quarter to ensure that content is accurate and current. Blogs and social networking, on the other hand, require frequent updates. Experience has shown that a new blog post every two weeks at minimum can drive website traffic up significantly. Social networking websites should have more frequent updates. Some consultants choose to update their status multiple times per day, whereas others opt for weekly updates. Active participation in online forums, such as LinkedIn’s groups, which are then linked to the consultant’s website, also enhances the consultant’s online presence. An informative and interactive web presence can drive substantial business to a consultant. A poor online presence can drive business away.

Chapter 6

Bumps in the Road New Consultants Will Face

Curtis Baillie, CSC

I’m a relatively new security consultant and because of that, Chuck Sennewald challenged me to contribute to this book by sharing some of my experiences and perspectives of launching into a whole new world—that of hanging up a shingle and holding myself out as a security consultant.

He suggested I simply identify the “bumps in the road” I experienced in making the transition from the corporate world to the world of an independent entrepreneur. Bumps in the road! There certainly are many, and how you plan for them has a direct effect on how successful your business will be. One of the smartest things I did while planning my consulting practice was to purchase the third edition of this book. I know it helped me get over many of the bumps in the road I faced. I still frequently refer to this publication to guide me over some of the unforeseen bumps I still run into in my consulting practice.

First Thing’s First—Money

The first major bump in the road and one that may derail your consulting endeavors is money. I’m aware of consultants who struggled early on in their businesses due to finances. They were hanging on by a string because they had expected customers to beat down their door from the very start and later found they should have paid more attention to financial matters. Some of them have simply closed their businesses and returned to the corporate sector. It’s not that they were incompetent in their field of expertise; rather they failed to financially plan for their business success.

Many startup business books will tell you that you should have eighteen months of income when you start your business. Others suggest that you have income for one year. Unless you have a handful of consulting contracts waiting for you when you start your business or have retainers in hand and can hit the ground running, you may find getting started very hard indeed. Some consultants start their businesses while they are still employed in the corporate business world, others wait until they retire and have retirement income or other sources of income to draw from. Others jump headfirst into their practice and try to financially piecemeal the business together as they go forward. I don’t recommend this latter method, as there are many financial pressures along the way, not to mention your personal bills still need to be paid.

I recommend a three-year business plan, even if you have hit the lottery and have no money worries. A well defined business plan lays out your goals and objectives, which may be adjusted along the way. If you anticipate needing a business loan to get started, a business plan is mandatory.

Forming Your Business

You will need to decide what kind of company you want to form. Do you want a corporation, a sole proprietorship, or maybe a limited liability company (LLC)? Each entity has its own advantages; this will be one of the first of your major decisions and it is one of the most important decisions you will make. This is the time to talk with an attorney or an accountant, who can advise you as to what type of company best suits your needs. The Small Business Association (SBA) office in my area gave a four-hour class on starting a small business, and those four hours, along with a small registration fee, was one of my better business decisions.

I chose to form an LLC, as it best fit the business model I wanted to create. I didn’t want any employees, although I know of many limited liability companies who have large numbers of employees and operate very well as an LLC. The benefits derived from an LLC for me were the “flow-through” income, tax advantages, and the fact that my personal assets are protected in the event that someone sues the business. Whatever you do, examine all of the entities available to you, and above all seek advice from a professional. Do not be penny foolish in these matters.

Setting up an LLC is easy. If you choose to do it yourself check your state’s corporation commission or secretary of state’s website, where you will find the necessary forms and instructions on how to complete them; it is a very easy process. I chose to have an online company, for a nominal fee, set up my LLC for me. The company filed all of the legal documents for me and the whole process took less than an hour. In about thirty days, my LLC registration was approved and filed with the secretary of state and I was ready for business. Don’t forget to file for your federal employer identification number (EIN) for tax reasons. All of this can be done on the Internet—it’s that easy.

What Kind of Consultant Do You Want to Be?

Do you want to be a “generalist,” or do you want to specialize in a certain field? From my point of view, you should pick and concentrate on a certain area, one that you have based your career on. This makes sense, doesn’t it? A generalist is someone who consults in all areas of the security industry. I have some expertise in numerous disciplines, including nuclear security, guard force, and law enforcement operations, but I could not successfully consult entirely within those disciplines. Pick one or two disciplines in which you have expertise and excel. Maximize your strengths.

A Question of Independence

Another consideration is the subject of independence. Many people in the security industry call themselves “security consultants,” and technically speaking, they are. They work in the security industry, selling alarm systems, locks, and other related hardware, whereas others provide executive protection or private investigations.

I am not labeling this side of the security industry as being insignificant, as there is a great demand for security products worldwide and there are many respected vendors in the product-affiliated side of the business, but they are not independent consultants and the consulting decisions they make for their clients are guided by the products or services they sell. From the start, I made the decision to be an independent security consultant. Independent consultants are not product affiliated and do not sell any security products or services such as executive protection, background checks, or security guard services. As an independent consultant, the only products you sell are your time and expertise, and you can make an excellent living doing so.

I put a lot of thought into what discipline of security consulting I wanted to work in. I knew I wanted to be to be a security management consultant as that is the capacity in which I had worked for so many years. I had limited experience in security design or information technology (IT) security. I chose to become a retail security management consultant because the majority of my experience was in the realm of retail security or loss prevention. When I thought about it, I had more than 20 years of experience, and although I had never viewed myself as a “consultant” when working in the corporate sector, that was exactly what I was, an “internal consultant.” I was the go-to person for whatever company I was working for at the time. I had expertise in developing policy and procedures, supervising large loss prevention staffs, and considered myself well versed in all phases of the industry.

Forensic Consulting

My next “bump” came when I thought about performing expert witness work. This was a scary thought, but the author of this book convinced me to enter the field. When I examined my background, I realized I had knowledge in the areas of due diligence and litigation avoidance, and I had dealt with civil lawsuits for my employers. After all, I had years of law enforcement and private security courtroom experience, writing extensive policies and procedures, and working in all areas of the retail security industry. After entering into the expert witness field, I looked back and decided I was making more of it than I needed to. My point is that if you are even considering becoming a security consultant, there must be something you have done in your career well enough to make you consider a career change. Do not hold yourself back, and consider all of the possibilities.

Seek Knowledge from Those Who Have Traveled the Road Before You

During my initial planning phase, I sought out those who consulted in my area of expertise. I was aware, but not yet a member, of the International Association of Professional Security Consultants (IAPSC). I went to the website (www.IAPSC.org) and called many of the consultants listed on the site. Everyone I contacted freely discussed their consulting business, openly shared forms with me, and gave me excellent advice.

I have never found anyone in the consulting business who was reluctant to discuss the bumps in the road they faced and how they resolved their issues. Everyone openly discussed their business and willingly furnished me copies of their forms. Over the years, I have maintained a relationship with these consummate professionals and today count them all as my friends.

To help smooth one of my early bumps, I attended one of the IAPSC’s Successful Security Consulting seminars. The price of admission was well worth it. What I learned from the expert instructors convinced me I was on the right path, and along with the classroom instruction and the binder full of information I took home with me, how could I fail? Currently, the IAPSC annually conducts this seminar prior to and in conjunction with the annual American Society of Industrial Security (ASIS) conference and exposition. I highly recommend taking the course. If you do and you are honest with yourself, you will walk away knowing whether or not you can succeed in this business.

Marketing Your Business

Kevin Murray, who in my view is the true expert when it comes to marketing, wrote Chapter 7. Mr. Murray is one of the consultants I contacted for advice early on. Giving way to his expert knowledge, I will say that marketing is truly one of the most important areas and can be a major bump in the road.

Some consultants will tell you that you need to spend about 25% of your time marketing your business. It will be much more than this, especially at the beginning. I found, at the start, I was devoting about 75% of my time to marketing. There are many ways to do this.

For me the number one way was to create a website, and I did this before I opened for business. I published my site on the day I opened the virtual doors. (Chapter 5 is dedicated to the “consultant’s website”) My websites (I now have two) have generated most of my business. I know this because I ask all of my prospective clients, including attorneys, how they found me. By asking this simple question, I can more accurately plan my marketing strategy. Because I revealed my number one way I generate business, you may be asking what the second best way is—it’s word of mouth and referrals.

Pro Bono Work

I am familiar with numerous consultants who perform pro bono work. This is simply performing free work for worthy organizations that may not be able to hire the services of a professional, qualified consultant. Providing pro bono services makes good business sense and is a way to give something back to the community. Remember, I said free is good, and one of the top ways I get customers is word of mouth. One of the fastest ways for the word to travel is by performing competent pro bono work. Many business leaders in the community work within charitable organizations and will notice the work you have done, and therefore you’re apt to gain business because of your pro bono work. I put the same effort into my pro bono work as I do for my paying customers—that’s to say the same time, talent, and energy.

Spend Your Money Wisely

On the litigation support or expert witness side of the business, I know fellow consultants who spend thousands of dollars every year on paid expert listing sites. I recently asked a very well respected consultant how much business he received from attorneys who found him on these paid sites. He replied that he did not know because he never asks. Early on, I listed with some paid expert listing services, but I never once received any benefit from doing so; your experience, however, may very well be different from mine. I currently list my expert witness services with several free listing sites. As with the paid sites, I have never received any business from the free sites, but then they are free and at least I’m not out any money.

As part of my overall membership with the IAPSC, consulting clients and litigation attorneys regularly find and retain me through my IAPSC profile. This may be considered an expert listing service, but the IAPSC provides many more benefits than just my listing, so I do not view it as solely as such.

Brochures, Books, and Articles

I know a consultant who spent several thousand dollars to have a professional brochure made and sent to prospective clients. He followed up on every brochure mailed and received no business for his efforts. He will tell you today he wished he had that money back. Now, does that mean you will not be successful in your efforts? Not at all. I’m giving you perspective from my knowledge and experiences.

My marketing strategy includes writing for publication, including this book, and authoring articles directly related to my expertise. These articles are published in books, print magazines, professional online security sites, and a security blog sponsored by an internationally recognized online security magazine. I also publish security articles on my website and speak before various civic groups and at industry-related conferences, seminars, and on radio programs. All this costs me nothing, and on occasion I am paid. I have received business as a direct result of my publications and speaking engagements; remember, I asked, “How did you find me?” People are interested in hearing about what you have to say, and you cannot beat free advertising. Again, free is good!

Setting Your Fee Rate—Yet Another Bump

Because fees and expenses are covered in detail in Chapter 11, I will write briefly regarding this “bump” in the road. Fee setting can have a significant impact on your business. Set your fees too low and you will experience what I did at the start of my practice. Because I was new to the business of independent security consulting and even though I attended the Successful Security Consulting course, I severely undervalued my experience. I wrongly thought my experience was less worthy than it actually. That was a mistake, as I soon learned that I needed more income to sustain my existence and grow the business at the same time. There were consultants working in my field who were less experienced and charging far more than I was. I adjusted my rates and soon discovered that my business increased dramatically. Another consultant offered one possible explanation—prospective clients may have wondered why I charged so much less than other consultants and attributed it to a lack of experience. There may be some reasoning to that theory. The moral here: don’t under- or overestimate your true worth. It’s a fine line.

Different Rate Levels

I set my rate of fees at two different levels. I do not charge the same rate for my retail consulting business as I do for the expert witness side. There are those who charge the same hourly rate for consulting and litigation support work, their theory being their time is just as valuable no matter what service they are performing. They are not wrong, nor is my fee schedule wrong; it’s a matter of preference.

The same goes for client travel. I charge half my hourly rate for travel by auto or plane. Some of my colleagues charge their full rate, based on the same theory I explained earlier. Others charge their full rate when working on client business on an airplane. I have found that it is difficult for me to work on business while traveling on a plane. I travel coach class and the space is just too tight for my 6’3” frame. Again, neither of us is wrong—it is just a matter of personal preference.

Professional Memberships and Certifications

When starting to plan my consulting practice, I realized that I needed to obtain membership in professional organizations such as the IAPSC. My consulting clients frequently asked what organization(s) I belonged to and what levels of participation I had within the organization. During the first telephone conference, many litigation clients were particularly interested in gauging my credibility. I also learned early on that I needed to obtain certification if I was to form expert opinions or testify at deposition or trial. I looked to the IAPSC for its certified security consultant (CSC) certification (you do not need to be a member of this organization to obtain this certification). I studied, took and passed the exam, and was awarded the certification I sought. Note that if you want to obtain this certification, you need to study hard because the exam covers many areas of security consulting, not just your particular area of expertise. The course materials direct you to the resources you need to review or study in preparation for the exam.

There are other professional organizations, such as ASIS, which has a course of study and examination for a number of certifications. These include certified protection professional (CPP), professional certified investigator (PCI), and physical security professional (PSP)—all worthy certifications that can help you gain credibility in your field of expertise.

Keep This Book Handy

My goal in writing this chapter was to try to alert you to some of the bumps in the road you will face. I have tried to include not only what I think I did right, but also what I did wrong and was able to correct. I mentioned before that the third edition of Security Consulting has been a constant source of information and guidance during my career. If you’re considering entering the consulting profession or you are new to security consulting, you have smoothed the first bump in the road—you are reading this book. You’re on your way! Congratulations, and I wish you success.

Chapter 7

Marketing

Kevin D. Murray, CPP, CISM, CFE, BCFE, MPSC

Let’s correct a common misconception: “I’ll be successful in my own business because I am really great at what I do!” (Klaxon sound.) Wrong. You’ll be successful if you can train your brain to have these three knowledge centers:

1. Knowledge of your specialty

2. Knowledge of the business of doing business

3. Knowledge of marketing.

You probably have number 1 nailed down, since you are considering selling what you know. For some great tips on number 2, the business of doing business, just download Murray’s BizWiz from www.spybusters.com/BizWiz.html (Figure 7.1). You will really be glad you did.

Figure 7.1   Murray’s BizWiz—business tips they do not teach in business schools.

This chapter, however, is about marketing. It contains a full one-third of what you need to know to be successful.

“You can be great at your job and running your business, but without marketing, no one will ever know.”

With this epiphany in mind, let’s tackle another business misconception: “Advertising and marketing are interchangeable terms.” (Klaxon sound.) Wrong. No, they are not. Marketing can include advertising, but advertising is not marketing.

Here are two simple equations to help you remember this concept:

GM = $ :) Good marketing will bring in much business and fill your coffers.

AA = $ :(Advertising alone will not bring in much business and will drain your coffers.

Prepare a Marketing Plan

1. Define your services.

2. Identify your customers.

3. Determine how you will reach those customers.

Define Your Services

You do not do what you do the same way everyone else does. You are unique. There are reasons people should choose you instead of the other consultant. Sum yourself up so others can easily see and understand who you are, and what you can do for them—things that no one else can do as well. In the promotions biz, this is called branding, and it works.

Why do you buy a particular type of beer, for example? Did you do a taste test of all beers? Or do you think the “Stay thirsty, my friends,” dude is cool, and his beer tastes pretty good? Make your business “charm so contagious, vaccines were created for it.” Define your services correctly, create a unique brand, and you will be on the right road.

The following are actual statements of services offered by well-known, established consultants. Their prospective customer base is listed following each example. The definitions of their services are very much to the point, factual, and informative. They work in almost any situation.

Now, put yourself into a client’s shoes, and add a desire to knock their socks off. Is there anything you could add to your statement (honestly and safely) to make you “the most interesting consultant in the world?” Think about this as you are reading through the following descriptions of services.

Consultant 1. Survey of existing protection programs. Analysis of needs in development of corporate security, domestic and multinational. Vulnerability assessment of existing facilities; conceptual plans for new construction. Advisors in protection of trade secret information as well as for classified programs. Key personnel protection including risk recognition and scenario preparation for crisis management exercises. Guidance in litigation avoidance. Prospective clients: architects and designers; manufacturing and distribution; financial, educational, and health care institutions; utilities and military services energy sources; data-processing centers.

Consultant 2. Security/loss prevention audits and surveys. Implementation of loss-control programs. Security/loss prevention seminars for frontline supervisors, including awareness programs. Specializes in consulting for firms who do not employ full-time security professionals. Expert witness for security-related litigation. Prospective clients: transportation, warehousing, distribution, industrial, hotels, and restaurants.

Consultant 3. Conducts a comprehensive study of an organization’s security arrangements and equipment, including operations of the security department. Objective is to identify vulnerabilities and recommend a level of security protective of people and property. Also provided are security seminars for bank employees. Prospective clients: financial, health care, and educational institutions; businesses and industrial firms.

Consultant 4. Specializes in safety, emergency management, and disaster recovery planning and training. Produces special studies, audits, hazard analyses, risk assessments, emergency response and disaster recovery programs, crisis management guidelines and training for executives, emergency response procedures, and employee training. Industrial mutual aid management training and plan reviews by government agencies are also produced. Prospective clients: corporations, governments, and nonprofit organizations.

Consultant 5. Conducts in-depth security surveys; reviews existing security operation and defines needs to the unique infrastructure of the organization surveyed; develops recommendations to facilitate loss prevention. Cost reduction “value surveys.” Specializes in design and specification of computer-based alarm/access control systems and security training and policy development. Considerable clientele of architects and other consultants. Extensive experience in museum, historic property, corporate art collections, and operations/training manuals. Firm includes fire protection and electrical engineers and other associates. Prospective clients: corporate security; museums, libraries, archives, historic properties; colleges and universities; hotels, condominiums; special services to architects and engineers; extensive computer data file of specifications/bid documents for all types of security equipment.

Consultant 6. Conducts security surveys to identify organizational strengths and weaknesses in protection and loss-prevention programs and makes cost-effective recommendations to cure or reduce deficiencies and maximize committed resources. Has proven track record of reducing inventory shrinkage in both common stock inventory and individual store accountability in inventory operations. Prospective clients: retailers, manufacturing facilities; office/high-rise buildings, parking facilities (surface, subterranean, multilevel ramps), and security organizations (departments) in any environment.

Defining one’s services should be brief and accurate. But it should also include why you are uniquely the best choice. Give customers a special reason to choose you over everyone else who is offering a similar service.

For example, suppose you offered a money-back guarantee where your client pays a percentage (in a range of 50% to 150%) based on satisfaction. If you word your presentation correctly, it will speak paragraphs about your confidence and track record. It will also stick in your client’s mind because it is not the same old hackneyed “100% money-back guarantee.” Your guarantee is different! Realistically, you will end up with a normal contract at a fixed fee. But you will end up with the contract, not someone else. Why? Because you did something that caught the client’s eye and made them think about you.

Tip

Want to be remembered? Dare to be different (but not so different that you scare the clients).

Identify Your Customer

Rule 1: Not everyone is a potential customer. Target market.

Put your marketing energy and resources where they will do the most good. Stay focused. Pick the aspects of consulting you really like. With rare exception, these will also be your strongest points—what you can do better than anyone else. Then, identify the customer base that needs these services the most. Target market to those potential customers.

This does not rule out being aware of new opportunities and emerging markets, reinventing yourself when necessary, or changing horses when bored. It means, the best rewards come from picking the right mountain and mining the heck out of it without distraction.

Expand Your Target Market Wisely

Let us say as a new consultant you have skills in retail drugstore security. Future customers will be drugstores, from major chains to single-store operators. Everything you do, once your customer is identified, sells your consulting service to that specific market. As a natural consequence of servicing that small segment of the whole retail market, the consulting practice could then broaden to include other retailers, such as the following:

• Specialty stores

• Grocery stores

• Drugstores

• Convenience stores

• Mass merchandisers and other front-end retailers

• Department stores

• Big-box stores

The long-term strategy is to grow your expertise in drugstore retail security to retail security. How do you do that? Seek out or create visibility by participating in retail loss prevention workshops for shopping center merchants associations or chambers of commerce, local college-sponsored programs for merchants, state retail association annual seminars, and other locally sponsored programs that offer a speaker’s honorarium (or do it pro bono—free). After all, the problem of shoplifting is a common phenomenon among all retailers; hence, a drugstore loss prevention executive has credibility on a topic that is universal. This exposure will invariably lead to one’s professional growth and consulting assignments.

Marketing will get your foot in the door. Your business will naturally expand as you establish yourself as a competent professional who indeed can bring the client viable solutions to security problems. The trick is to stay focused in the beginning, and expand horizons as you can, without diluting your core business.

Hard work enables one to transcend the original focus or market and grow. An accomplished retail security consultant, for example, could land a small assignment in a local hospital’s gift shop. That job could lead to a request by hospital administrators to survey their food service and commissary operation. Then the contract grows to a full survey of the hospital’s security department and facility loss-prevention effort. That hospital consulting assignment leads to another local hospital assignment. And so it goes.

Determine How You Will Reach Your Customers

How to reach the decision makers in your industry isn’t the hard part. Marketing consultants, directories, mailing lists abound. Rather, your most challenging task will be to decide what message to send to potential clients. The message is paramount.

Why would a retail executive opt to hire a security consultant—particularly if the organization already has a security manager or director? Good question.

Management will spend money for one principal reason: to increase profitability. Retailers can increase profits by reducing inventory shrinkage or reducing operating costs. Hence, your marketing message to the retail executive must positively motivate that person to act, because you will increase the organization’s profitability through a loss-prevention awareness strategy. Conversely, you could negatively motivate the decision maker to act, because the erosion of company profits will only worsen unless positive changes are made under the guidance and assistance of a professional consultant. This strategy applies regardless of the area of specialty.

Hardly a day goes by without news of a security failure somewhere. These stories can provide good material for the consultant’s message to prospective clients. They can also be leads to people who need your expertise.

Develop a message that assures potential clients of all benefits that they will realize when they retain your services. Then, using a variety of continuing marketing efforts, keep these benefits and your name unforgettably visible. You always want to be positioned near the top of their minds when they decide to take action.

The benefit in retailing is increased profits. The benefit in museums or art galleries is the preservation of works of art. The benefit in defense research and development is the protection of classified and proprietary data. The benefit in a given corporate or institutional building, such as a post office, is the protection of people—employees and visitors. Determine the unique benefits only you can deliver. Keep your message simple. Dare to be different.

An axiom of consulting is that most security consulting assignments are incident driven. That is to say, something has happened within the organization that motivates senior management to incur the expense of bringing in an outside expert to cause some change that would be viewed as beneficial. Organizational “happenings” could include a significant change in top executives; an accident; a major criminal incident; an internal scandal; a civil lawsuit; the mysterious disappearance of equipment, property or inventory; the loss of a key employee; a suspected bomb or anthrax scare; and so on. Any of these kinds of incidents can make an organization a prospective client.

So how does one reach these prospective clients? Marketing!

My favorite marketing guru, Denny Hatch, has a saying he is fond of: “Customers don’t have needs, they have wants.” Bob Hacker, another marketing guru, has his pet saying, too: “The emotional hot buttons that make people act are fear, greed, guilt, anger, exclusivity, salvation, flattery, patriotism. If your copy isn’t dripping with one or more of these, tear it up and start over.” Both are excellent pieces of advice. As proof, think of how these motivators work on you. What did you buy recently? Were any of these emotions involved in your decision to purchase? Keep these words of wisdom in mind as you create your marketing strategy.

Creating Your Marketing Strategy

Websites

A professionally designed website that puts you and your services on display on the Internet is of paramount importance. Your nephew can’t do this for you. Even if your website is going to be simple, this is too important to leave to an amateur. Bite the bullet and hire a professional. Shop for someone who is savvy about marketing and graphic design rather than a super html code monkey.

Tip

Create your website with the primary goal of marketing your services. Search engine optimization (SEO), although important, is a secondary consideration. Do not become an SEO zombie. It may make you the first hit on Google, but you will look like a sleaze who is gaming the system instead of a professional security consultant offering quality services. If you market your specialty and uniqueness correctly, you will likely be a top 5 search engine hit anyway.

Advertising

Traditional advertising strategies in our industry include classified and display ads in (1) security journals and (2) trade publications within your targeted market. The primary advantage of ads in security journals is that they keep your name and availability as a security consultant alive. This is called institutional advertising. Trade publications, such as Stores magazine, a journal for retail executives, expose your service and availability directly to that targeted industry. Display advertising, which is substantially more expensive than classified ads, must convey a clear message.

Pick the right advertising venue for your specialty. Plan on advertising like clockwork. Consistency is the key here. Do not expect direct results from the ad itself. It basically has trust-building cumulative value, keeps your name in the potential customer’s mind, and acts as a permanent place where customers can obtain your contact information—when they need it. Your ad does not have to be large and flashy, just clear, reliable, and consistently there.

Another form of advertising, thanks to the computer and Internet, is registering with websites that offer consultant services, typically by professional category. These are used primarily by law firms looking for experts to assist in litigation matters. The fees for posting your photo and your services are most reasonable, and the fee is recovered in spades with a single retention.

A common question asked by those starting up new businesses has to do with how much one should spend on advertising. Steve McKee, president of McKee Wallwork Cleveland, offers this advice for marketing consulting firms that specialize in helping struggling companies rekindle growth:

You might want to start at 5% and then adjust your projected spending up or down based on the size of your market, the cost of media, what you can learn about how much your competitors are spending, and the speed at which you’d like to grow.... Depending on the size of your company and the business you’re in, advertising might not be the right (and certainly not the only) tool for you.

A professional services company like my own is a good case in point. While we serve a national clientele, we are much too small to effectively advertise on a national scale. As a result, we don’t purchase paid media advertising. But we do have an aggressive marketing program built around tactics like direct mail, online marketing, and public relations. For a variety of reasons, paid advertising might not be right for your company either, but events, vehicle wraps, point-of-sale displays, or other tactics certainly could be.

Given this advice, your advertising budget should actually be called a marketing budget, which will include website development, printed materials, advertising and promotional items, and costs. Much of the cost will occur during the first year, so the budget should be averaged over the first several years.

Brochures

A high-quality company brochure, preferably in color, has unquestionable impact on many potential buyers of consulting services. Brochures must be prepared by professional public relations or advertising artists. They must include the following elements:

• Qualifications of your principal consultant (and associates, if any)

• Experience as a consultant and practitioner

• Range of consulting services offered—for example, surveys, training sessions, security manuals

• Length of time your consulting service has been in existence

• Industries served

• And above all, the benefits of your service, and how you satisfy the wants of the people who hire you

There are definitely two schools of thought about listing previous clients. Some believe it inappropriate to advertise the fact that their former clients required consulting services. Others disagree with this philosophy and wish to disclose former clients. Just remember that if you choose to list clients, you must have their written consent.

Brochures can be costly to produce, and care must be taken in their distribution. Because each brochure has value to you, direct your postal efforts so that the brochure gets into the hands of the firm’s decision maker only.

Also, post web versions of your brochures as pdf files. The following links lead to examples of three different styles of online marketing brochures that I created:

• www.spybusters.com/brochurepdf.html

• www.spybusters.com/countering_electronic_espionage.html

• www.spybusters.com/pdf/CLEAR%20Brochure.pdf

You can hire an advertising agency to create your brochures (recommended), or if your brochure is simple and you have the talent, you can economically create them yourself and send them to the printer directly. Online printing services like www.printplace.com and www.printingcenterusa.com have “help centers,” which provide excellent free education on how to do this.

Public Appearances

One of the most effective business developers is the public appearance. Letting people get to know you, without any work or obligation on their part, has been known to lead to consulting assignments on the spot.

Seek speaking or panel slots on programs within your targeted market. Initially, those appearances may not pay a stipend; however, the important thing is to gain the exposure. Have something to contribute other than the same old meat and potatoes so frequently offered at industry seminars. Be creative, be thoughtful, be provocative, be original, be a presenter who stimulates the attendees’ imagination. (Again, dare to be different.)

Seek the opportunity to guest on early-morning radio talk shows or local television programs. The security industry is a source of fascination to many people, and you never know who is out in the audience who may contract you for a new project. Many radio talk show “appearances” don’t require you to be in a studio; you can do the show from your office, on the phone, with your feet on the desk.

Tip

Get on the Help A Reporter Out (HARO) e-mail list. www.helpareporter.com. Three times each day, an e-mail goes out with reporters’ requests for experts to help them with topics they are working on. Their media may be newspapers, magazines, radio, TV, Internet media, or even a book in the making. This type of publicity not only conveys veracity, it doesn’t affect your marketing budget.

So how does one do this? Volunteer to address local civic and business groups for luncheon and dinner presentations. If you are dynamic you will be remembered and called on again, and eventually those appearances will lead to consulting assignments.

Stationery and Business Cards

Stationery and business cards for consultants must be of the highest quality, printing, and layout. Avoid Internet “custom stationery” design sites. This is something you do once, it lasts a long time, and it is important. Work with a professional graphic artist who specializes in designing stationery, logos, and the like. Check the artist’s portfolio and have a talk with him or her to see if the two of you are a compatible match before signing a contract.

Bad stationery is the equivalent of having a mullet haircut. “From the desk of:” is not a professional security consultant’s style. It may not be fair, but stationery can and does say a great deal about you, your professionalism, and your attention to details. There is an old saying, “Good stationery design is sometimes ignored, but bad stationery design is always noticed.” Visit http://bad-graphics.blogspot.com/ for further proof. Care to learn how to do it yourself? Visit www.bamagazine.com.

Of course, personally sign all your letters. Treat your card with respect. Present it properly. Do not give out a card that is marred or bent. Do not make a correction such as writing a new phone number or address on a card. Do not use your card for making notes.

Direct Mail

American Business Lists in Omaha, Nebraska, has lists of 10 million businesses in this country. The magazine it sells that lists the various businesses is an eye-opener. Let’s say you have an interest in conducting security surveys for various religious facilities (I don’t know of any colleague who does that). According to this Nebraska firm, it has the names and addresses of 1,070 convents and monasteries. Therefore, one could obtain such a list and directly mail a personalized letter or a professionally prepared flyer, soliciting their business.

Direct mailings can be handled by professional marketing people who are working in your behalf, because they know the ins and outs of that strategy. However, it is also something the individual consultant can do on his or her own.

Target marketing begins with deciding whom you want as a client. You can buy a specific list as mentioned earlier, or you can create your own list by researching the exact person in the company who has the ability to hire you. Mass mailings handled by a professional mailing service are easy but expensive. Custom mailings take time and effort but can pay off quickly.

If you custom mail, plan on sending out three to five letters every day. Make it part of your routine. Even when work comes in, continue. This way you will avoid the common feast or famine problem that often confronts consultants.

• Research your target company. Get the name and correct mailing address of the person with whom you would like an appointment.

• Using your top-quality stationery (a marketing expense), write short letter of introduction.

• Make the opening sentence a punch in the nose. Remember, “The emotional hot buttons that make people act are fear, greed, guilt, anger, exclusivity, salvation, flattery, patriotism. If your copy isn’t dripping with one or more of these, tear it up and start over.” Your first sentence will either hook them or lose them.

One letter I wrote, which markets my electronic eavesdropping detection services, has a miniature electronic component glued to it. The opening sentence, “This one electronic component, when properly placed inside your telephone, will turn it into a room eavesdropping device.” I then introduced myself and mentioned that my company was a small business surveillance detection consultancy employed mostly by savvy executives from Fortune 1000 companies. We provide privacy and a safe atmosphere where people can conduct their business without fear of spying. The hot buttons in this letter are fear, salvation, exclusivity, and flattery, by virtue of being selected to receive a personal letter about the subject.

Another way to market is with postcards or e-mail. These require repetition to be effective. Plan on a campaign (weekly, bimonthly, or monthly). Create a theme that is consistent throughout your campaign. Provide content that is welcoming and that clients will indeed look forward to. Perhaps offer a security tip each week.

The following two services make this kind of marketing easy:

• Constant Contact (for e-mail), www.constantcontact.com

• Amazing Mail (for postcards), www.amazingmail.com

Promotional Sundries

Be careful with this one. Like stationary, if not done correctly, give-aways can do more harm than good. Here are some things to avoid:

• Cheap pens with your name on it. Cheap is a bad association, especially when it leaks or doesn’t work. And nobody really wants a pen with someone else’s name on it.

• Yearly paper calendars and appointment books. No one uses them anymore.

• Rulers, little magnifiers, cheap multitools, plastic coffee cups, and anything useless that bothers you when it clutters your desk, or when you toss in the garbage.

Instead, aim for class, cool, inventive, clever, fun, and status. Here are a few ideas:

• Spy coins with your company brochure stored on the hidden micro SD memory card (Figures 7.2 and 7.3). You don’t have to be a counterespionage consultant to use something like this. You are in security, and that’s close enough. Everyone likes spy gadgets. Various sources include http://fossler.com (label), www.papermart.com (case), www.spy-coins.com (coin), http://tinyurl.com/microSDlot (micro SD), and http://casecad.com (custom foam insert).

Figure 7.2   Spy coin atop presentation tin.

Figure 7.3   Open spy coin showing micro SD card hidden inside.

• Presentation bone china teacups with a medal emblem attached (Figure 7.4). Something like this will always be kept visible. Custom designing your own cup gives you the opportunity to be creative. Say your specialty is forensic work and most of your clients are attorneys. Put “I Hate Losing” in gold, bold, dramatic lettering on the front... “and I rarely do because of experts like [your name / company name here].” Or “My Expert Can Beat Up Your Expert.” You get the idea. Also, it is important to print your phone number and URL on the bottom. When your customers lose everything else you gave them, they will look here.

Figure 7.4   Front and rear views of a presentation teacup. Badge applied using double-sided foam tape. (From www.dunoonmugs.co.uk.)

• If you have written a book, include a unique bookmark/business card (Figure 7.5).

Figure 7.5   Stainless-steel bookmark with snap-off business card. (From www.aculineetch.com.)

• Cool sticky note pads (Figure 7.6). Very economical. Easy to give often. Appreciated. Drop one into everything you mail to clients, prospects, and colleagues who might recommend your services. Hey, want some of these top-secret notepads? Call me!

Figure 7.6   Custom-designed sticky notes are cost effective. Give two whenever you present a business card, and include them with reports, invoices, and newsletter mailings. Source: www.garrettspecialties.com.

• And sometimes it’s money that gets you remembered. We printed our name tastefully on the back, but don’t worry. This is a defunct (but highly collectable) currency (Figure 7.7). The money was attached to the inside of a greeting card, covering a key part of the message (Figure 7.8). When the money is removed, the words when stolen appear (Figure 7.9). Point made.

Figure 7.7   Money is one advertising message that nobody throws away. (From eBay.com. Marketing blurb printed in-house.)

Figure 7.8   Front of greeting card.

Figure 7.9   Interior of card. When the money is removed, the when stolen message is revealed. Interactive. Fun. Different!

The goal is to get your message across. If you cannot be there to charm prospects yourself, your materials must do it for you. Make your messengers you: interactive, intelligent, classy, and memorable.

Your great promotional materials will cost more than the fifty cent leaky pens your competition is giving away. On the other hand, you won’t be handing them out by the hundreds at trade shows either. If your client is worth taking to dinner, then that client is worth a decent gift.

Your promotional items are most often going to be presented to specific prospects. You will also use them as thank-you gifts; presented to clients after a big assignment, and to the people who were instrumental in getting you the assignment. Try to select gifts that have a high perceived value, like an unusual clock (www.chronoart.com) with your customer’s name on it, or a book you authored and autographed with a sincere inscription.

There is one caveat: check on the employer’s gift policy before presenting any gift. Many companies have a $25 value limit. Most of the suggestions mentioned here fit into this category. Some organizations (usually the press, police, etc.) do not allow any gifts. Others allow items like books, but nothing more. Respect the policy, and show your appreciation some other way, like with a sincere, handwritten, thank-you letter.

Authorship

Publishing articles can expose you to any market, primarily because of the never-ending need for articles in trade publications. Besides, people have a natural interest in and curiosity about the topic of security and crime.

Consider writing a book on the topic you know best. This is not as hard as you think. There are plenty of people and websites out there to help you. Start with something simple like www.fastpencil.com, then move on to a publisher who can give your work professional polish and marketing, like www.greenleafbookgroup.com. This is the path that launched my book, Is My Cell Phone Bugged?

Give your book an unusual slant and a memorable title. If you start off writing articles for trade magazines, think ahead. Write each article as if it could eventually be a chapter in a book. The sooner you do this in your career as a security consultant, the better. Not only does it build credibility, it satisfies many professional recertification requirements.

Newsletters

Your own newsletter can be an effective marketing tool. Just make sure you are providing information that readers are interested in. Be respectful of their time; no fluff, no puff. Newsletters are not hard to write. The contents can be a distillation of what has been published in other periodicals or what’s happening in the consultant’s field of specialization and can be advisory in nature. The real value lies in the promotional impact it has on prospective clients. The author is seen as professional, authoritative, credible, current, and available!

Some newsletters are published for revenue purposes, but even nonsubscription newsletters have great marketing value. Distribution may be via a printed mailing, via e-mail distribution, or both. Your particular security specialty and type of client base will determine what will work best for you.

Blogs

According to Wikipedia, “a blog (a portmanteau of the term web log) is a personal journal published on the World Wide Web consisting of discrete entries (“posts”) typically displayed in reverse chronological order so the most recent post appears first. Blogs are usually the work of a single individual, occasionally of a small group, and often are themed on a single subject. Blog can also be used as a verb, meaning to maintain or add content to a blog.”

Today, Internet blogging and e-mail are the best delivery tools for a marketing your services most economically. Companies like www.constantcontact.com and www.feedblitz.com make the process of writing, mass e-mailing, and keeping mailing lists clean and easy. Consider taking a few minutes each day to write in a blog, and then create a monthly “best of” edition to send via an e-mailed newsletter. Be sure to stay close to your core topic, and be consistent with both the frequency and the style of your posts.

Blogging is easy, fun, and free using services like www.blogger.com or http://wordpress.com. Mass e-mailing newsletters is not free, but it is fun and very economical.

For example, consider the blog known as Kevin’s Security Scrapbook (http://spybusters.blogspot.com). It has been running online since 2006, and in other iterations long before that, as e-mail, fax, and postal mailing. Today’s cost: $0.00. It also contains an opt-in link so that readers can have a daily digest e-mailed to them automatically. The cost for this service (feedblitz.com) $9.95 per month. The amount of effort you have to contribute to get this done each day: Zero. feedblitz.com automatically reads your blog each day and sends formatted e-mails for you. The site also automatically handles sign-ups and cancellations and keeps your mailing list clean. Once a month, a “best of” edition is sent as a target e-mailed to clients and specific potential customers via constantcontact.com. For the average security consultant, the cost of this service would range from $10 to $30 per month depending on the number of e-mail addresses.There is one caveat, however: try to create your e-mailing list based on opting-in, with an easy opt-out feature. If this is not practical, explain yourself immediately in your e-mail. You do not want to be viewed as a spammer.

Refer to Figure 7.10 for a sample e-mail newsletter.

Figure 7.10   The best blog entries of the month are packaged into a monthly e-mail newsletter—double exposure for some readers, a condensed digest for others. (From http://spybusters.blogspot.com.)

“Social Networking”

This is a controversial topic and a misleading term. Some people will tell you it’s the hottest, must-do thing since the home cappuccino machine. Others will grunt and call it “social not-working.” In my experience, the truth is in the middle. Test the waters and decide for yourself. Here is what I have found.

facebook.com

According to the company’s description, “Facebook helps you connect and share with the people in your life.” Right. This is social networking. What you want is business networking, professional business networking, not some time-sucking vortex where your status depends on some middle-school value system based on being “liked.” Pass.

But don’t take my word for it. Will Dymott, head of e-commerce for Lyle & Scott (a large retail clothing business started in 1874) had this to say about the company’s Facebook experience: “It has been a bit of a damp squib to be honest. ... People are not in buying mode when on Facebook. Sales are so small that we would be better advised to spend time and money improving our e-mail or search marketing than plowing more money onto f-commerce.” http://tinyurl.com/89zrebb And, this is a major retailer. Imagine how a security consultant would fare.

linkedin.com/

“The company is publicly held and has a diversified business model with revenues coming from hiring solutions, marketing solutions, and premium subscriptions.” Hmm, sounds like they mean business. This is worthwhile. You should have a profile here. LinkedIn is the de facto, online business directory. Business people do search for other business people using LinkedIn. Just don’t get sucked into all the group chitchat—unless you have something worthwhile to add and it helps market you.

twitter.com

“Twitter is a real-time information network that connects you to the latest stories, ideas, opinions and news about what you find interesting. Simply find the accounts you find most compelling and follow the conversations.” We’ll give this a half-good. Don’t waste your time being a follower. Don’t waste your time tweeting your personal life either. There are a few exceptions: provision your blog to automatically tweet your posts, and have your tweets or blog posts automatically display on your LinkedIn page and website. Cross-pollination of business networking strategies produces synergistic results.

google.com/+

“Google+ makes connecting on the web more like connecting in the real world. Share your thoughts, links and photos with the right circles.” A Google version of Facebook? The jury is still out on this relatively young service. Several security consultants (including myself) are currently experimenting with this new venue.

As with any new tool, cautiously test it yourself. See if it has potential. If it seems like a time waster, move on.

Pro Bono Work

The Latin term pro bono means “for the public good.” In our society it means providing professional services for some good cause without charging a fee: professional voluntary service on a specific assignment. Reference was made earlier in this chapter to a hypothetical consulting assignment in a hospital gift shop that could lead to expanded assignments. That very example could well be started as a pro bono effort.

Marketing Quick Tips

Sales Letters

• Keep it brief.

• Leave plenty of white space.

• Use color, sparingly.

• Use an appropriate, pleasing typeface.

• Have an attention-getting opening sentence.

• Quickly expand on the benefit.

• Appeal to reader’s emotions (fear, greed, guilt, anger, exclusivity, salvation, flattery, patriotism).

• Emphasize the benefits.

• Have a single key theme. (Confuse ‘em, lose ‘em.)

• Write in a conversational tone. Sound human. No jargon.

• Avoid hype and unsubstantiated claims.

• Include believable testimonials, if possible.

• Offer some type of guarantee.

• Make it visually pleasing and organized.

• Ask for the business.

• Proofread.

• Include a snappy, compelling P.S. (They will always read the P.S.)

Pricing

• Base your prices on the value you deliver. (That’s all you need to know.)

The Top Six Reasons You Will Lose Clients

• 1% will die.

• 3% will move on or retire.

• 5% will develop other friendships.

• 9% will cite competitive reasons.

• 14% will be dissatisfied and never tell you.

• 68% will detect your attitude of indifference toward them.

The good news: you have complete control over 82% of these reasons.

Imperatives

• Always spell a person’s name correctly.

• Never say, “it’s good enough.”

• Engage is public speaking. (Stop your hand wringing. Just learn to do it well. The more you do it, the easier it gets.)

• Always give your people the credit that is rightfully theirs. To do otherwise is both morally and ethically dishonest.

• Be courteous to everyone. Have a genuine consideration for other people’s feelings, problems, and aspirations.

• Never tamper with the truth. Don’t rationalize. What you might like to be the truth is not necessarily the truth.

• Be generous. Remember that it is the productivity of others that makes your success possible.

• Be enthusiastic. Smile a lot. Stay healthy. Dress smartly. Keep up with what’s happening in the world.

• Always give a bit more than your client expects. It is cheaper to give a little extra than it is to find new clients.

• Answer all e-mails and voice mails with shocking speed.

Truisms

There is no secret formula for marketing a security consulting business, but there are some truisms to follow:

• Be someone you would hire.

• Make your mantra, “I solve my client’s problems and concerns.”

• Never forget, you only get one chance to make a good first impression. Everything about your presentation must inspire confidence. Everything. It is not fair, but your presentation is one of the few ways a client has to evaluate you. Presentation includes your initial contact, stationery, website, dress, personal hygiene, speaking voice, background sounds when you are on the phone, promptness in returning calls and arriving at meetings, reports, methods of communication, vocabulary, listening ability, rate of speech, small talk topics, obvious interest in solving your client’s concerns, posture, choice of music-on-hold, eating habits at business lunches, and more. You must sell yourself first. Hopefully, the clients will become impressed with your knowledge and capabilities after they have worked with you for a while, but “getting your foot in the door requires a well-polished shoe.”

• Create a sexy business card. Hey, you’re in security; it’s easy. One of the best I ever saw was a solid black fold-over card. The small white letters on the front just said, “Walsh of the CIA.” When you opened it up, and it became a double-sized card where one learned that Mr. Walsh was the director of the Carteret Industrial Association. Walsh presented his card to me (with an appropriate amount of panache) in 1975. I never forgot it. Now, that’s impact.

• Our latest card is stainless steel, comes with a lock pick set attached to it, and mails in a regular-sized business envelope (Figure 7.11). We include a small beaded chain, so when clients break it apart (interactivity) they can string all the parts on the chain. (It is only borderline functional as a pick set, but it does get the point across.)

Figure 7.11   Snap apart stainless steel allows for many creative advertising possibilities. Be sure to put your web address on each piece so they remain effective even when separated.

• Have some of your business cards laminated with magnetic backs. I guarantee the recipient will stick it on something, especially if it has some of that sexy security cachet. Most business cards get tossed or lost in a drawer. Dare to be different.

• You can also have your card printed as a Rolodex card or combo postcard mailer with Rolodex card tear-off. Yes, lots of secretaries still use Rolodex files. Our own card has a stick-up tab that just says, “Counterespionage.” Secretaries love it.

• Create a theme that flows through all your printed materials: logo, colors, type style, layout, tag line, and so on.

• Send a small, memorable thank-you gift to clients upon the completion of your work. Then communicate with them often, especially when you are not actively working on an assignment. I use a free useful newsletter, limited-edition custom bone china tea cups, weird desk clocks, and a series of artistic “Season’s Greetings” cards, which can later be framed.

• Never send a cheesy business-gift-catalog item that says, “With compliments of...” Be different! Shop for the unusual. Be remembered, favorably. Send something you would really like to receive. Respect company rules if gifts are not allowed.

• Create and promote some unusual policy. Mine is “Call here first.” This is an open offer to anyone needing an answer to any security or forensic question. If I cannot provide an excellent answer immediately, I research it or find the right person with whom the customer can talk with. Our contact file is impressive and saves clients (and future clients) hours of search time.

• My other offer—“Try us once”—has built a loyal client family with some relationships stretching back over three decades. Note the “client family” reference. Think of your clients as a family you protect and help grow.

• Experiment with communications. Postcards can be extremely effective. Imagine a series featuring 12 security tips, mailed twice a month, for six months, to the top 1,000 companies you want in your client family. You, of course, include your web address and smiling face each time. In six months, they will feel like they know you personally; 12,000 (5.5” 8.5”) postcards with standard postage will cost approximately $9,960. Even with a 1% rate of return, that’s ten new clients. If you are good enough to have them give you repeat business each year—say, $10,000 per year for three years—your ad budget will be about 4% of the $300,000 you will bill. Compile your own mailing list, and your mileage could be spectacularly better.

• Other relatively low-cost direct marketing options include website videos, newsletters, and personal direct mail letters with interesting one-page fact sheets.

• For no-cost mass marketing communications, give talks, write stuff (as I am doing now), guest-appear on radio talk shows (you can do this from your office), get yourself on media editors’ contact lists, send press releases, volunteer as a technical consultant for TV shows and movies, and most important...

The Number One Mandatory Marketing Maneuver

• Create a decent website. (Repeated, because it is that important.)

Your website is your electronic storefront for distributing information about you and your firm and for answering your potential client’s burning question: “What can you do for me?”

Tip

Everyone can smell a high-school-kid-created web mess from three desks away. Pay for the best proven professional assistance you can afford.

Now that you have a marketing road map, hit the streets and get noticed!

Chapter 8

The Proposal and Contract

Every consulting assignment requires a consultant’s proposal to provide such service. The proposal is usually in writing and is typically submitted in response to a prospective client’s request, commonly referred to in our industry as the request for proposal (RFP). The steps in the process are as follows (Figure 8.1).

Figure 8.1   Request for proposal process.

The Enterprise Recognizes the Need for Consultation

As I’ve indicated before, a corporate entity must be motivated to bring in outside expertise to assess a known concern and offer advice on how to solve the problem. That motivation must be of such a magnitude that it has senior management’s attention and organizational priority.

For example, in a retail company the motivation could be that the recently calculated annual inventory reflects an extremely high shrinkage—with a near disastrous impact on profitability. A health-care administrator could be prompted by a recent sexual assault on a bedridden patient to review the security program. A security officer for a corporation could have arrested and assaulted a party, resulting in a punishing lawsuit against the organization, so that now management is anxious to avoid another similar experience. Whatever the type of enterprise or problem, consulting services appear to company managers to offer professional and objective advice and recommendations.

The Enterprise Requests A Proposal

Typically, the organization will delegate to a senior member the task of identifying qualified consultants and obtaining proposals for evaluation. Once consultants are identified, the request for a proposal is made. The request may be accomplished via a telephone conversation or during a preliminary meeting. Or the request for the proposal may come in written format, from a simple letter to a lengthy formal request for proposal. The direction is usually clear: the prospective client wants a proposal that identifies the following:

1. What you will do

2. How you will do it

3. Who specifically will do it

4. Where you will do it

5. When you will do it

6. How much you will charge to do it

7. Your credentials and qualifications to perform the task

These seven points encompass what a proposal is all about.

The Consultant Submits a Proposal for Services

How a proposal is written directly affects the results. A poorly written and hastily prepared proposal may make you lose your prospective assignment, whereas a professionally prepared proposal may land you the job. Why? The proposal works as a preview of coming attractions; it provides a window through which the prospective client can see how you organize work, how you articulate and communicate, how you grasp problems and see connections that lead to probable solutions. Such conclusions, true or false, are indeed drawn from the presentation of your proposal.

To best demonstrate what properly prepared proposals could or should look like, I’m including two actual models with dramatically different format, style, and content for comparison purposes. Each model was prepared by a professional and talented security management consultant. Model #1 is the proposal only (Figure 8.2). The costs, a part of the proposal, is not included in this book.

Figure 8.2   Model #1. This proposal was prepared and submitted by Richard Grassie, to a facility whose name has been changed for confidentiality.

Model #2 is the more simplified proposal, which includes the response from the prospective client, along with further discussion about this issue of proposals and the acceptance of the same (Figure 8.3). The reader will note that the comparison of the two proposals is remarkably dissimilar, particularly in terms of detail. The lesson here is that there is no one right formula or model; the mission is to give prospective clients the information they want and need to make an informed decision to retain or not to retain you.

Figure 8.3   Model #2. This proposal was prepared and submitted by Robert O. Murphy, to a hospital whose name has been changed for confidentiality.

Like the management team of the Cleveland Site in Model #1, Blue Memorial Hospital administrators, who perceived the need for security consulting services in the form of an assessment, now had in hand at least one proposal to provide such services. One can’t help but note how both prospective clients have a proposal before them as to what the consulting service would do and essentially how the service would do the job and, although we don’t see it here, they know how much it’s going to cost them (i.e., what they’re going to get for their money).

The Enterprise Accepts the Proposal and Contracts for Services

The hospital favorably responded to Murphy’s proposal (Figure 8.4).

Figure 8.4   Example of a letter of acceptance of the consultant’s proposal.

The letter not only represents the acceptance of the proposal but also serves as the contract for the consulting assignment. No other written documents, except the report of the assessment and invoice, are required in this relationship. And this is the norm in the independent security consulting field. Typically, the contract is in the form of a letter from the client who accepts the proposal, spells out conditions and expectations, and authorizes you to perform the services. The acceptance letter serves in every sense of the word as a contract. If you fail to perform, the client will not pay and a court of law would compare your performance to this contractual letter. If you do perform and the client does not pay, again, the judicial system would look to the letter as the agreement between the two parties.

That is not to say that formally prepared and signed contracts are never used. Occasionally they may be required, and if so, the requirement derives from the client, not the consultant. Appendix A includes a consulting contract that serves as a basic model. Appendix B shows another example of a contract, taken from the Protection of Assets manual.

The Letter of Understanding

This contract in the form of a letter of acceptance of the consultant’s proposal listed specific tasks to be undertaken. The acceptance letter from the hospital complements Murphy’s proposal in terms of understanding the conditions of the business relationship. Sometimes, as in a letter written by a client after a proposal meeting, the letter is the only written instrument that spells out the venture, and it is best described as a letter of understanding. Such a letter, as does a proposal, spells out the who, what, where, how, when, and how much. There are times, too, when the consultant initiates the letter of understanding (Figure 8.5).

Figure 8.5   A sample letter of understanding I directed to the president of an over-the-road freight carrier.

I had offered a verbal proposal, and the firm’s president was satisfied and asked me to proceed with the project. However, I did not want to undertake that project (or any project) without some form of contract or written agreement. I chose not to ask company personnel to prepare the letter of agreement; I saw that as my chore. My letter, then, spelled out the required who, what, where, how, when, and how much and, hence, served as our contract.

The consultant must have some form of written documentation or contract, be it a letter of proposal acceptance, a written agreement, or a letter of understanding (initiated by either party) to refer back to in the event of any downstream misunderstanding or disagreement as to the project.

Not all consulting assignments are for one specific project. Some consulting relationships span an ongoing period of time, often referred to as a retainer. Most retainer relationships are for an agreed upon minimum fee, usually represented in the form of a minimum number of hours per month with compensation for those numbers of hours, even if no work is performed. For example, a consultant can agree to service a company for one half-day per month (four hours) at $150 per hour, or $600 a month. Typically the hourly rate is sharply discounted only because it is a retainer relationship. The client may require service that entails less than that much time, yet the consultant is paid for the four hours. If the hours exceed the minimum, however, the consultant will be compensated for all hours worked, but only at the discounted rate. This agreement, too, must be evidenced in writing. I personally avoided retainers because I didn’t care to be compensated for nothing and, more important, I didn’t want to work for a discounted rate. However, retainers are common, and I suspect they’ve kept some consultants afloat.

Similarly, an ongoing relationship can exist without an actual retainer agreement and with no fixed times or fees. Normally that kind of relationship must also be outlined in some form of writing, if for no other reason than to avoid any future misunderstanding. Figure 8.6 is a letter of understanding I sent to a new client whom I subsequently served for several years. It should be noted that, had there been an ongoing retainer arrangement, the terms and conditions would easily have been enumerated in the letter of understanding.

Figure 8.6   A letter of understanding I sent to a new client whom I subsequently served for several years.

Confidentiality Contracts

Some clients may require the consultant to sign an agreement of confidentiality or nondisclosure agreement, wherein the consultant agrees not to use or disclose information obtained from the client to competitors or anyone else not privy to the organization’s proprietary data. For an example of a nondisclosure agreement, see Appendix C. This is a reasonable expectation and requirement. Regardless of any such written promise, however, the confidentiality of information should be the unwritten guideline and philosophy of every responsible and professional security consultant.

A Word of Caution about Proposals

There are occasions when a prospective client sends out RFPs when they already know who will get the consulting assignment. This is done because there’s a requirement that the contract be put out to bid or there is this need, for whatever reason, to give the appearance that the process was competitive. I’ve been a victim of this practice, and there’s really not much one can do other than check around with other consultants to see what information exists about the upcoming project and then act accordingly.

Another risk lies in detailed proposals being used as a guide or blueprint for someone else to follow—that is, you’ve laid out a consulting program to solve the problem and the prospective client has its own security executive follow your outline.

These bumps in the road need not discourage the new consultant. Submitting proposals is a way of life in this business. It’s just better to be forewarned and be wary as to how much time and detail you invest in a given proposal.

Chapter 9

The Survey

The consultant’s task is usually that of assessing a client’s existing security situation and recommending positive change. Change is not inevitable; some conditions may not, in the consultant’s opinion, warrant change. But typically, some modifications to the existing company’s strategy or program are required. Recommended changes are based on the consultant’s evaluation of existing conditions. That evaluation is inherently judgmental.

The primary vehicle used in a security assessment is the survey. The survey is the process whereby one gathers data that reflects the who, what, how, where, when, and why of the client’s existing operation. The survey is the fact-finding process. The assessment is the final appraisal, the conclusion drawn from those facts and recommendations for improvement/change.

The breadth and depth of an initial survey and the resulting assessment are limited by what is called the scope of the work, which must be determined at the outset of the consulting assignment. Sometimes the client has predetermined the exact scope of the work; other times, the consultant must provide guidance or otherwise assist the client in defining the scope of the work. The retailer in Chapter 3 who wanted me to assess only the merchandise distribution system was defining a narrow scope of work. That scope was determined prior to contacting me. The scope of work in this project was narrow indeed! Imagine: it excluded almost everything one associates with retail security, such as shoplifting detection policies and procedures, shoplifting detection training, documentation, and recording. It excluded dishonest employee investigation policies and procedures, interrogation, and interviewing practices. But the well defined scope of the work—to assess the company’s policies and procedures pertaining to the receiving, distribution, and transfer of merchandise from a security perspective—was a logical objective. The consulting project proceeded efficiently because the scope of the project allowed for a methodical plan of attack, because the direction was so narrowly focused and defined.

In a contrasting situation I met with a chief executive officer who had decided he wanted a security survey but did not understand what that could entail. I could not commence the project until I had determined what he wanted and what he did not want—the scope of the work. Because it was clear to me that he had not thought through his options, I led the CEO through the following conversation:

CEO:

We’ve experienced significant losses despite a rather expensive security program and need you to simply do what you must to give us some guidance on tightening up and maximizing our present security expenditures.

Consultant:

You have another facility across the state line. Do you want me to include that in my survey?

CEO:

Oh, no. Just this site. We have a different situation over there. What you see and do here we can apply there, so please don’t bother with them.

Consultant:

I note you’re using a contract security service. Are you interested in the possibility of setting up a proprietary force?

CEO:

No. In fact, don’t worry about changing the guard force. For our own reasons we must continue with that service. With that in mind, look at that force in terms of the quality of people they’re sending us, the training they receive, the duties they perform, and whether they are doing what they should be doing. You know—are we getting our money’s worth?

Consultant:

Who supervises these security officers?

CEO:

That’s a problem area. I know who is supposed to oversee the guards and their work, but I suspect there’s some competition there [among my own staff], to the detriment of the program.

Consultant:

All right, so you want an assessment of the existing security staff and their function and supervision. And as you indicated earlier, you want me to look at the physical aspects of security, here at this main site. That would include access control, alarm systems, fencing and other barriers, lighting, the key control system, access to the computer room, and ...

CEO:

Please do not include the computer operation in your work. We recently had a computer expert out here and he’s already given us direction in that area, so anything you do there would be redundant.

Note how this brief conversation refined and defined the scope of the project and excluded areas that, had they not been identified, would have wasted time and expense to the dissatisfaction of the client. It is incumbent on the consultant to ensure that the expectations of the client are clarified.

Yet as careful as one may be in defining this scope of the work, problems invariably surface. Security consultant James Broder and I collaborated on a major hospital assignment. We had clearly defined the scope of the work. Some days into the project we discovered, to our amazement, that the hospital had two offsite clinics, both some miles away from the main hospital campus. We had no choice but to add those sites to our survey—additional work not included in our estimate.

The Preliminary Survey

The example of dialogue between the consultant and client is a part of what is called the preliminary survey. The preliminary survey may be composed of four parts:

• Initial meeting with management

• Tour of the facility

• Meetings with key managerial personnel

• Final meeting with management to agree on the scope of the work

These four steps are not mandatory but rather are ideal. Depending on many circumstances, the entire preliminary survey may be restricted to the initial meeting with management. That initial meeting might include a brief facility tour; later, key personnel could be invited to sit in and answer questions posed by the consultant; this way, the scope of the work gets finalized before that one meeting adjourns.

Naturally, this truncated version of the preliminary survey cannot reveal as much information as would the four separate steps. The client’s budget for the consulting assignment may constrain preliminary activities to a single management meeting. Yet if the project involves aspects that are relatively unfamiliar to the consultant, the four steps might be essential.

Let us examine more closely the four phases of the preliminary survey.

Step 1: Initial Meeting with Management

This initial meeting gives managers their first opportunity to articulate their real concerns about security and to spell out what their expectations are. This initial meeting also catalyzes the development of the consulting game plan. Part of any consulting strategy requires the complete cooperation of all members of the management team. To achieve that kind of organizational cooperation, the chairperson or chief executive officer should affix his or her signature to a management memorandum that does the following:

1. Announces the company’s decision and commitment to undertake the consulting relationship

2. Asks every executive to completely cooperate with and assist the consultant(s)

3. Authorizes the release or divulgence of company records and information not normally shared with others

4. Introduces the consultant by name, including a brief biographical sketch

Another decision at this initial meeting is the appointment of a manager to work with the consultant. This person schedules appointments, makes introductions, and assists the consultant in every way possible, “opening doors” to expedite the consultant’s work. Finally, the timetable for the process is set. This may include the setting of a midpoint when senior management may expect a progress briefing by the consultant, as well as the due date for completion of the project and report.

Step 2: Tour of the Facility

If you are contemplating remodeling a building, you should see the building in its entirety as it currently exists. So it is also with the consultant who is about to survey a regional shopping center or major hotel. You need to walk through the property for orientation, for the magnitude of the site, and for general impressions regarding the demographics and clientele. The totality of that experience makes for an important frame of reference during subsequent work on the project. For example, if you note graffiti on the walls of the building, you might later question the frequency and routing of patrols, the presence or absence of lighting, or the required reports by patrolling officers.

Step 3: Meetings with Key Managerial Personnel

Discussions with key managerial personnel are critical to the consulting process for the following two reasons:

1. To allow managers to express their concerns about security in the corporation, from their own perspective, and for whatever benefit those observations may have in and of themselves.

2. To include managers in the consulting process so that they have ownership in some measure in the outcome of the consultation. If they are not included in the interviewing, if the consultant fails to elicit their input, managers tend to distance themselves from the program and the final recommendations. They may be more likely to criticize the changes that occur.

Note the word key. Every manager considers herself or himself “key,” right? Thus, the more people included, the more ownership you will have in your work product. Realistically, you may not reach them all. But do what you can.

Step 4: Final Meeting with Management to Agree on the Scope of the Work

This is the pouring of concrete regarding the objectives and scope of the consulting assignment. If indeed this fourth step occurs, as such, it provides an excellent opportunity for the consultant to share with senior management some initial impressions and observations. This, too, is the time to retrace the consulting strategy and timetable.

The Survey Itself

The survey is no more nor less than an information-gathering, fact-finding process that is accomplished in three ways:

1. Interviewing. Talking with knowledgeable people to gather information via the spoken word

2. Observation. Viewing of physical features such as fences, lights, officers’ uniforms, and locking systems to gather information via the power of visual observation

3. Research. Examining records, policies, files, organizational charts, and job descriptions to gather information via the written word.

All three of these fact-finding processes may apply to one problem. Take this hypothetical question: how does a company’s access control program work on Sundays and holidays? To answer that question the consultant would interview security officers who work on Sundays and holidays and employees who enter the facility on those days; the consultant would examine the entry door used as well as the remote control or card reader and view the closed-circuit television (CCTV) camera and monitor used to surveil that access point; and the consultant would review the hard-copy reports generated on those days as well as the policy and procedure manual that spells out what should happen. The result of that fact-gathering process will suggest to the consultant what change or modification is appropriate, if any.

Other surveys may require just one fact-gathering process, such as interviewing security officers as to their understanding of the department’s mission in cases in which there is no printed mission statement. The same interview is important even if there is a printed mission statement because it could well bring to light that officers don’t know it or have never heard of it. That’s revealing! Whatever the scope of the work, the survey will focus on four component parts of a security program. The sum total of these four component parts equals the security program:

Any problems in the security program must exist within one or more of the component parts:

In the format of an equation, it would look like this:

or

The p− in the equation represents a shortcoming, failure, or deficiency that militates against a balanced and healthy program. These component parts allow us to form compartments for a closer scrutiny of the consulting process. Let us examine these parts.

First P Is for Policy

The key word in understanding policy is what. Policy represents what management wants, what management expects. For example, the policy in one retail firm is to detect, apprehend, and prosecute every shoplifter. Now, if company leaders verbally agree to adopt that policy yet release some shoplifters for various reasons, the inconsistency of practice against policy could be the source of a significant litigation. If it is deemed reasonable to release some shoplifters because of factors of health or age or the amount of the theft, then those exceptions should be reflected in the policy. Other policy areas could include the following:

1. What is the policy regarding escorting female employees to their cars in the parking lot after dark?

2. What is the policy regarding employees possessing alcoholic beverages or drugs on the company premises?

3. What is the policy for coping with an employee who refuses to be interviewed by a security investigator regarding missing supplies?

4. What is the policy regarding the arming of security officers?

5. What is the policy regarding disciplinary action—for example, against an employee with 25 years’ service who has been detected in a $5 theft?

Policy is fundamental to security. If a company has an internal theft problem and has no consistent stand on the consequences of being caught stealing, the internal theft problem cannot effectively be addressed, let alone reduced.

Second P Is for Procedure

The key word in understanding procedure is how. Procedure represents how management wants things done. For example, a retail firm’s policy may be to detect, apprehend, and prosecute shoplifters. But the retailer does not want the apprehending security agent to use excessive force—the application of only a reasonable level of force to restrain the offender until the police arrive is permissible. That is how management wants apprehensions to be conducted. Procedures usually are outlined in written format, but sometimes you will find procedures reflected in custom and practice.

The consultant will focus on procedures essential to the scope of the work. If, for example, the scope includes the problems of litigation and public complaint concerning the treatment (or alleged mistreatment) of shoplifters, the preservation of evidence in defense of possible lawsuits, and the deportment of the shoplifting security agents, the consultant would probably scrutinize the following procedures:

• Recruiting for shoplifting agents

• Interviewing shoplifting agent candidates

• Verifying candidates’ work history and references

• Ensuring that potential employees do not have a propensity for or history of violence

• Training for shoplifting security agents

• Monitoring and reviewing security agents’ work

• Preserving shoplifting evidence

• Monitoring the status of court cases for continued preservation of evidence; authorization to return evidence to stock because the case has been closed

When operating procedures are unclear, undocumented, contrary to industry custom and practice, or illegal or wasteful, the consultant will recommend correction and documentation in the form of written guidelines or an operating procedural manual.

Third P Is for Physical Plant and Equipment

Rare would be the security survey that does not examine the physical aspects of protection. This component part of the security program could include the following:

• The building configuration, including doors, windows, roof access, and subterranean access

• Access controls

• Fencing

• Lighting

• Key controls and lock hardware

• CCTV

• Alarm systems

• Communication system

• Patrol supervisory systems

• Patrol vehicles

• Uniforms

Each of these subcategories prompts a host of questions and concerns that would necessarily be included in the survey. Take, as an example, fences:

1. Does the fence completely enclose the property when the gates are closed?

2. Does the fence meet industry standards?

3. Does the fence have a protective topping? Should it?

4. Is there evidence the fence has been scaled?

5. Can the fence line be penetrated through holes in the fencing itself, or can it be easily crawled under?

6. When the gates are secured, is there still room to slip through and enter the property?

7. Are there trees next to the fence that would facilitate climbing over the fence?

8. Is the fence line cleared of shrubs, weeds, or other obstructions that would permit the hiding of persons or materials?

9. Can vehicles drive up to the fence line?

10. Is lighting required along the fence?

11. If buildings constitute part of the perimeter, are windows secured so penetration of persons or materials is restricted?

12. If buildings constitute part of the perimeter and conjoin the perimeter fence or wall, do they form a vulnerable point in the protective enclosure?

13. Are the gates secured with padlocks to which keys can be purchased at the local hardware store? Who controls keys, and where are they kept?

As the consultant moves through her or his survey of the physical plant, noting the answers to these concerns, any failures, omissions, and needed corrections will be duly noted and subsequently reflected in the final report. (For a more comprehensive example of how to prepare and conduct a security survey, see Appendix D).

Fourth P Is for Personnel

Because security is every employee’s responsibility, all personnel make up this category—not just security employees. Such concerns as hiring, screening, and selection practices; new employee induction/orientation programs; employee participation in safety/security committees; and general loss-prevention awareness programs, or their absence, are of interest to the consultant.

Moreover, the individual officer’s perceptions of role and mission, his or her impression of the boss’s expectations, and idiosyncratic likes and dislikes can be revealed through the interview. You could ask the following questions:

1. Why are you in security work?

2. Where do you go from here?

3. What do you like most about your job?

4. What do you like least about your job? Why?

5. What is the mission of this security department?

6. If you could make changes in how the security department goes about its tasks, what would you change?

7. What does security do that you consider a waste of time? Why?

8. What is security not doing that it should?

9. Does the director of security know what you do? How do you know? Do you think she or he cares?

10. Do you have the tools to do what is expected of you? If not, what do you need?

11. What kind of training did you receive when you first came here? Was it sufficient?

12. Do you receive any ongoing training?

13. What kind of training do you think you need?

14. Do you feel security is respected in this company?

15. When were you last evaluated or told how you rated against your peers?

16. Do you feel free to make suggestions?

A company that seeks to reduce losses and increase profitability must rely, in some measure, on the goodwill of its employees. Employees, including security people, who do not understand or share the firm’s goals tend to impede progress toward those goals. Conversely, the staff who identifies with management goals and the employee who sees those goals as his or her own tend to support the procedures and policies that move toward the enterprise’s objectives. If they see themselves as part of the process and can measure their growth and recognition along with the firm’s, then an attack against the company is an attack against them.

Employees breathe life into policy and procedure and make physical safeguards function or fail. Thus the consultant’s survey delves into this component—an arena that management frequently ignores.

Now the consultant has completed the initial gathering of factual information by way of the survey. Interviewing, observing, and researching have brought data to enable the security consultant to inform, judge, evaluate, and recommend in the form of the final report.

Chapter 10

The Consultant’s Report

Whereas the survey is the means to identify the client’s existing condition and needs, the consultant’s report is the end, the work product itself. The report, which reflects the consultant’s findings and recommendations, is what consulting is all about. Everything preceding the report is merely incidental in contrast to the ultimate value of the finished report. Consequently, in the aftermath of this document, the fortunes of the consultant rise or fall. An experienced, bright expert who produces a poor report probably will not last long as a consultant. Conversely, the man or woman who produces a quality report will earn an established reputation, and clients and prospective clients will overlook small distractions, such as personality traits, because of the consultant’s reputation for quality work. And is this not how it should be? How else can one measure or grade a consultant’s work? The quality of the consultant’s work equals the quality of the final report.

Components of the Report

The report typically is presented in a bound-booklet format. The cover may be as simple as one purchased from a stationery store to a customized, photo-enhanced product generated on the computer. As a matter of style and practice, I like to use the client’s logo on the cover and a clear acetate over that to give the booklet a glossy appearance (Figure 10.1). The first page inside the heavy cover is a cover letter or title page (Figure 10.2), followed by the table of contents.

Figure 10.1   Security report cover displaying the client’s logo. The title of the document is optional.

Figure 10.2   Typical title page for a security report.

Figure 10.3 is an actual table of contents from a 43-page report on the survey of a major hospital. Note how the work is divided and presented in seven major categories:

• Executive summary

• Introduction

• Scope

• Findings

• Conclusions

• Recommendations

• Attachments

Figure 10.3   Table of contents from an actual report.

The breakdown of these components of the report represents the logical division of the overall effort and the consultant’s findings. Such division in the report format makes the work more comprehensible for the client. Let us examine each of these categories for content.

The Executive Summary

A standard communication technique in management is to condense and highlight the contents of the report itself. Key, salient points are the highlights of this abbreviated version of the report, which provides the busy executive with an overview of the project. The following is the complete executive summary for a report to a hospital.

The field portion of this survey was conducted in May and June, 20 ___. The main purpose of the survey was to identify and evaluate security-related risk and the protection of hospital personnel, resources, and assets from the threat of internal and external criminal exposure. A secondary purpose was to review the Hospital Security Department’s practices as they relate to and impact all departments of the Hospital, for all shifts.

Interviews of senior executives, administrative personnel, department managers, uniformed security officers, and other hospital personnel were conducted. Emphasis was focused on the main building complex; selected off-site locations (clinics and the warehouse complex) were also inspected. Hospital policies and procedures that addressed security and the protection of assets were reviewed and analyzed.

The findings of the survey team were generally positive. Most significant was the absence of recent, serious crime on or near the Hospital.

Some of the major areas audited during the survey that produced items requiring management’s attention were as follows:

• The Hospital needs to establish and publish a comprehensive security policy with procedural guidelines to improve the effectiveness of the security operations.

• Background investigations can he accomplished more quickly and cost effectively if done in-house.

• The Security Department is understaffed. Officers need more formalized supervision and training.

• Controls need to be implemented (they are already established) to further reduce the opportunity for employee pilferage and theft. The employee and visitor identification badge system used to control the flow of people is excellent.

• Parking lots are well protected and, for the most part, adequately lighted and frequently patrolled by uniform security officers, both day and night. This combination is undoubtedly responsible for the low level of security-related incidents on the streets and in the parking lots at and near the Hospital.

• Lock and key control needs to be formalized with a new written policy and procedural guidelines that address current practices for buildings both on- and off-site.

• Security, special-purpose alarms, closed-circuit TV cameras, and monitors need to be consolidated and centralized in a dedicated, client-owned and -operated, central alarm monitoring station. Installed security hardware should be programmed to complement other aspects of the security program.

• Property control procedures (with the exception of the Engineering Department) were found to be functional and, with minor adjustment, can be improved to further reduce opportunity for theft.

Security at the Hospital historically has operated in a reactive mode. We found evidence that suggests a desire by management to shift to a proactive security mode.

The full report runs 43 pages, yet the summary does provide the reader with meaningful insight into the project, does it not? In fact, if the balance of the report was unavailable, the points reflected in this summary provide suffficient direction for change?.

The Introduction

The introduction is a one-paragraph statement explaining who authorized the consulting project:

This survey and report were authorized by Ms. Constance Koskovich, Vice President Administration, Petersburg Hospital Medical Center (PHMC).

It also spells out the purpose of the consulting project:

The primary purpose of the survey was to identify and evaluate security-related risk and the protection of the institution’s personnel, resources, and assets from the threat of internal and external criminal exposure. A secondary purpose was to review the hospital security department’s practices as they relate to and impact the institution as a whole.

The introduction, then, really is more or less a recapitulation of the project’s charter—the contract or agreement letter.

The Scope

Scope, in the context of the final report, refers to the range of employees interviewed, the physical locations included in the survey, and the source documents reviewed. For example, under the category employees interviewed you might write:

The survey consisted of interviews with senior executives, administrative personnel, department managers, uniformed security officers, and other personnel employed in various departments of the hospital.

Under documents reviewed:

Some of the documents made available for our review and analysis were:

• Security incident reports

• Administrative policy manual

• Security job descriptions

• Employee handbook

• I.D. badge policy and procedures

This category reviews the data you collected through the interviewing, observing, and researching of the survey.

The Findings

The findings portion of the security report reflects the existing conditions as revealed through the survey. These conditions may be satisfactory or not. Many times the condition speaks for itself, once such a condition is highlighted by the findings. This kind of glaring problem is reflected in the findings of the hospital security department’s procedures, as reflected in the report:

C. PROCEDURES

The security procedures we found to exist were fragmented, poorly written, and outdated. A comprehensive Security Policy and Procedures Manual does not exist. There are no written post orders to which a security officer might refer for guidance in the event of a questionable situation or an emergency. The Director of Safety and Security regards the necessity for developing written procedures and posted orders as a high priority.

An example of a serious procedural situation that must be avoided in the future is the manner in which security officers make arrests. We were advised of a situation in which two Petersburg security officers pursued a reported thief beyond hospital grounds, made an arrest, and handcuffed the prisoner; they returned him to the hospital before calling the municipal police. The legality of the arrest was questionable. The crime reportedly was a misdemeanor not committed in the presence of the person making the arrest, as required by law.

In the absence of procedural guidelines and training concerning arrests and the proper methods of handling similar situations, judgment errors such as the one described could recur. Such errors expose the hospital to not only embarrassment but civil litigation.

Note that this findings category only reports the condition; it does not pursue the obvious solutions. The recommendations section of the report will offer solutions to this deficiency. This sample consultant’s report includes sixteen sections and numerous subsections under findings. The extract fom the procedures section came from a subsection under the topic security organization. For every project, the consultant must divide the work logically through the sections of survey and again when orally presenting the finished product to the client.

Look again at the table of contents for the hospital report. Not only is the work logically organized, but contents are paginated for easy referencing for a given subject or area of concern. That is, parking lots are addressed on page 12:

6. Parking lots

There are six parking lots located in, near, or adjacent to the main building complex at PHMC. All of the lots are protected by barrier fencing and gates that are sufficiently high (up to 8 feet) to discourage climbing. The only parking lots open 24 hours per day are lots #1 and #3. Parking lot #1 is located inside the main building complex. This lot was observed to be frequently patrolled by uniformed security officers, both day and night. Lot #3, where the majority of evening and night employees park, is provided with the continuous presence of a security officer. Lot #5, also used for employee parking in the evening, is closed at midnight and on weekends. It is frequently patrolled during the hours of darkness.

Employees on the night shifts stated that the physical presence of security officers and the K-9 patrol gave them a sense of well-being when leaving the hospital en route to their cars. One nurse stated that, at first glance, the hospital might look like an armed camp, but she felt the consensus of opinion of night employees was that security was responsible for the low level of criminal incidents. She stated this was especially significant in comparison to other hospitals with which she was familiar.

Not all findings in the survey reflect deficient or inadequate conditions. The findings reflect, objectively, all security-related conditions, good as well as bad, because in reality, more things are being done correctly than incorrectly. Hence, part of the consultant’s findings support the existing program and tend to encourage management to continue in areas that are on track and then to correct areas that fail to meet the desired standard.

The Conclusions

This optional section may be omitted from the report without detracting from a report’s professionalism. When included, it serves as a summation or retrospective overview of the survey’s findings. Following are the conclusions offered in the sample hospital report:

The security program at this hospital is best described as suffering from growing pains. The program in place today is seen as a developmental process that has occurred over a period of years. Procedures, hardware, and staffing were established and implemented on an “as needed” basis—that is, to solve perceived problems as they arose. Little thought was given to long-range planning or the establishment of a solid foundation on which to build an effective security organization. Notwithstanding, the security program that exists today has effectively prevented any major criminal incident common to other hospitals in this area.

There is also evidence to suggest that management now desires to make a dramatic shift in emphasis from a reactive to a proactive security mode. This survey is one example of management’s interest in identifying problems—past, present, and future—that could adversely affect the institution. Implementation of the recommendations, which follow, will be another.

The Recommendations

This is truly the heart of the report. Certainly managers want to know what is being done correctly and what needs to be changed, especially what the consultant recommends as the fix or cure.

Recommendations for change can have monumental consequences throughout the organization. Imagine the impact on a retailer who is experiencing high inventory shortages when a consultant recommends a full interim physical inventory. Inventories are not only costly, but they generally disrupt the normal flow and operation of the business itself. Additionally, imagine the impact if a consultant recommends that employees detected in acts of theft and fraud against the employer be processed through the criminal justice system. Prior to the consultant’s survey and recommendation, no employee had ever been prosecuted, only terminated. Certainly the consequences of that strategic change in the organization’s policies and procedures could send some ripples through the ranks. Therefore, the consultant’s recommendations must be well conceived, prudent, reasonable, and based on sound evidence. The cure should not hurt worse than the illness. Solutions should be cost effective and operationally feasible.

Each recommendation should be numerically identified for reference. This identity of a recommendation is most important, because not all recommendations will be implemented or acted on immediately. The recommendation coding works this way:

Some recommendations may be shelved for the next budget period and some may be controversial enough to be shelved indefinitely. Recommendations must be as succinct as possible. Also, they should be presented in the same sequence as the findings (as reflected in the table of contents). For example, in the sample model report, the first area addressed in the findings was General, followed by Policy. The first recommendation was as follows:

Other selected recommendations include:

The Attachments

It is not uncommon for a consultant to include attachments that support the report. The hospital model report included attachments such as a new security department organizational chart, a suggested simplified security incident report form, and a suggested policy statement.

If there are no attachments, then this section need not be included in the report.

An Alternative Report Strategy

Another report format that I have used when a report does not exceed two dozen pages deletes the executive summary and condenses the introduction, scope, and table of contents into one page. Experience shows that an executive summary is unnecessary in short reports or when an ongoing dialogue with senior executives has kept them aware of the bulk of the consultant’s work. Figure 10.4 represents this condensed version, which immediately precedes the actual findings and recommendations (Figure 10.5).

Figure 10.4   Condensed introduction and scope.

Figure 10.5   Sample page from a security survey report.

Again, note the logical division of the report into “Areas of Concern.” How the work is divided is up to the individual consultant. One could easily regroup the areas of concern, in other ways, such as the following:

1. The Security Department

2. Physical Aspects of Security

3. Nonsecurity Operations

4. Policies and Procedures

5. Human Resources Management

6. Security Programs

Another characteristic of this alternative report is that whereas in the standard report the findings and subsequent recommendations constitute distinctly separate sections of the report, in the alternative approach each finding is immediately followed by its related recommendation. I tend to prefer this technique of offering the solutions to the problems as I go along, rather than to wait and offer them in a group.

Whatever report format the security consultant adopts, the presentation of the work must be professional: word-processed, error-free, clear, and easy and pleasing to read. Make your report a work product your client would not hesitate to pass on to an executive in another firm. Bear in mind, too, that this document will be referred to over a span of years. Thus, it could potentially be used in a future civil lawsuit in which reasonable and adequate security may be the central issue, and you are accountable for your professional recommendations.

The Oral Survey

Occasionally, a client opts not to have the consultant prepare a written report of findings and recommendations, primarily to reduce consulting costs.

Additionally, a client may wish to hear what measures a professional would recommend but does not want to be bound by those recommendations. If the consultant, for example, recommends a uniformed security officer be on duty twenty-four hours a day as a deterrent to muggings in the parking lot and management disagrees with that recommendation because of the expense of the guard, and a mugging does indeed subsequently occur, management would have a liability exposure. If a written security consultant’s report exists, that document is discoverable in litigation. A written recommendation that was not followed tends to indict management. Thus managers have become wary of being burdened with recommendations that could come home to haunt them.

Some consultants today offer, as a service option, an “oral survey”—that is, they provide the benefit of a professional assessment without it being reduced to writing by the consultant. I have done these types of surveys in the following fashion: I require a company representative to accompany me every step of the way through the survey and every moment on the site, and that person makes on-the-spot notes of my observations and recommendations. For example, I might observe that the seal number on a trailer being received from a distribution center is not being compared with or recorded on the transfer document. I would advise the company representative to change the procedure to require that modification. The company representative would so note that observation and my suggestion for change. Later, in my absence, those notes would be transcribed into an internal report of my survey, and I may or may not be asked to review and correct them.

Chapter 11

Fees and Expenses

Fees and expenses have a critical impact on the consulting profession. Realistically, one’s survival as a consultant relates to one’s fee structure. If you understate or undercharge for your services, the slim margin or actual absence of profit eventually will bring about a financial crisis. If, however, your fees are too high, prospective clients can afford only a limited amount, if any, of your services, and the ultimate result is, again, a financial crisis.

This means that your fees must be competitively balanced; they should fall within the range, albeit broad, of those acceptably charged within the security industry. In 1988 my informal survey of members of the International Association of Professional Security Consultants (IAPSC) reflected a range of fees from $75 per hour to $175 per hour. I’ve attempted to keep track since then and found, in the mid-1990s, that the low was $100 and the high was $250. Now in the twenty-first century, we still find a few who are as low as $100, but the upper end of the scale is $325 or more. The variance in range obviously reflects such factors as expertise, experience, and reputation. Not long ago I was talking with someone who was new to the profession with no knowledge about proper fees or rates. He was charging $75 per hour and felt he was charging on the high side, if not overcharging! That’s because he was comparing his rate with the hourly rate of private investigators. With all due respect to investigators, there’s a substantial difference between the skills that are required between the two disciplines; plus, investigators are in abundance, whereas there are few consultants in comparison. Certainly, nonmembers’ fees probably range all over the board, particularly on the low side. This is because many so-called consultants have other sources of income, such as the sale of security-related hardware. This suggests a relationship between one’s fees for services and the quality of those services: within general parameters, clients get what they pay for.

As important as is the hourly rate (all consulting work must ultimately be broken down to an hourly unit of time), the fee should be based on the actual amount of time required to do the consulting task. I have lost work bids to consultants and consulting firms who charge low and work slow. Perhaps the strategy of “charge low and work slow” is intentional—that is, it prolongs the project and hence increases the billing. Or perhaps it is a question of competency; slow work could appear to be thoroughness, but it may simply shield mediocrity.

The problem here is, how does the individual consultant win bids despite the tendency of many prospective clients to accept the lowest bidder? There is no one answer. This timeless irony is best expressed in the Latin phrase caveat emptor, let the buyer beware! Yet we who charge higher fees have survived, apparently because we have confidence in our work, confidence in ourselves, and a reputation for quality in our work.

This in no way is meant to denigrate those who charge low fees. Some choose to maintain relatively lower fees to be more sharply competitive. Others may opt to be busy at a lower rate rather than to have dead time. A few augment their low consulting fees with a retirement income.

For whatever reasons, the independent consultant will establish a fee that will thereafter set boundaries for all work. Whatever the hourly rate, a range of elements determines when and how to apply that rate. Next, we will consider such items as the following:

• Field: office billing formula

• Travel time

• Advances

• Retainers

• Billing periods

• Expenses

• The invoice

• Collection problems

Field: Office Billing Formula

New consultants often find themselves trapped in a situation in which they have bid too low because they failed to include the office time necessary to prepare the consultant’s final report. Like the speaker who fails to include in the required fee the time it takes to prepare the speech or the lecturer who fails to calculate the time necessary to design the presentation, the consultant must try to foresee all required time for a project before and after onsite work.

My formula simply applies a 1:1 ratio—that is, for each one hour on a survey or with a client, I calculate a corresponding hour back in my office to sort through the notes, arrange my thoughts and findings in an intelligent order, and prepare the finished report. As a sole practitioner, I prepare my own reports. That means I draft and compose as I proceed through my organized notes. One might say I am charging my client an exorbitant fee for clerical services—that the preparation of the report should be charged at a clerical rate. However, I end up saving the client the clerical costs because I must draft and compose anyway; this way I combine composition with word processing.

Rare is the project that cannot be completed within the 1:1 ratio. Rather, you usually can complete the project in less time than expected. That means your billing frequently comes to an amount less than the proposal, and the savings to the client, even if only an hour, is always appreciated.

Another bid option is to use the 1:1 ratio in the estimation, along with a ceiling of a not to exceed or maximum cost for the client. Early in my career, when I was billing at $150 per hour, I quoted a project survey with a report not to exceed $5,000. Exasperatingly, the operational vice president mysteriously disappeared in the midst of my field survey, and I was left stranded, unable to work. It was the vice president’s way of attempting to sabotage the consulting project, something he definitely did not want to happen. That unproductive time was reflected in my final billing as time spent on the project, and the total actual cost exceeded $5,000, yet the amount due showed as the not-to-be-exceeded figure of $5,000. The actual invoice appeared as follows:

Every hour I committed to this client was duly reflected in the accounting of time and expenses. And because I promised to perform at a maximum figure, I billed only for that amount. That kind of under-billing may cost short-term profit for the consultant, but it also tends to build goodwill and credibility with your current clientele and future clients.

Travel Time

The survey of IAPSC members reflected that most consultants bill their clients for travel time, although there were some variations, as follows:

1. Some consultants charge only for one-way travel time; that is, if it takes two hours to get to the client’s facility, the consultant charges only two hours, not the full four hours for travel in both directions.

2. Other consultants charge for all time spent traveling but at a different and lesser rate than is charged for consulting.

3. Another consultant may or may not charge, depending on the distance, the client, and the workload involved.

4. My practice has been to charge what is called “portal to portal”—that is, from the time I leave my office until I return to my office the meter is running and at my regular rate. If the trip is out of town and I must stay in a hotel, I do not charge for the time I’m in the hotel (unless I’m working, of course). I’m charging for my time, and the logic is the time traveling is time I could be otherwise productively engaged. I have made exceptions to this policy. That’s the benefit of working for yourself: you can do what you want!

The majority of IAPSC members surveyed charged the client for all time beyond what the average person spends traveling to work each day.

Advances

Most consultants require some form of advance or retainer for work to be done. An advance is a partial payment for services to be rendered. It represents good faith on the part of the purchasing client. Just yesterday I finalized an agreement over the telephone and, during that conversation, I requested one-half of the agreed on fee in advance. The executive said he would be happy to have the check cut and forwarded immediately. When I complete this project and send him the bound report, the final invoice will reflect total fees plus expenses, less the advance. Had this executive been unable to forward the advance, I might have been nervous about his firm’s ability to pay.

To obtain an advance against work to be performed certainly is optional but in some cases might be financially prudent, depending on the stability of the client, the total cost of the consulting project, the anticipated length of the project, and anticipated expenses for the project. However, one may not wish to require or even request an advance from an established former client.

Advances may range anywhere from 25 percent to 50 percent of the expected total, or the advance may reflect expenses only (airfare, food, and lodging) to avoid out-of-pocket expenditures for the consultant.

Retainers

Retainers may serve as an advance against billing but also may refer to an ongoing relationship with a given client. For a retainer fee, the consultant is available for an agreed on amount of time each month. This typically takes the form of monthly payments of a certain amount to guarantee that the consultant will be available for certain hours or days each month. The client might, for example, guarantee one day’s fee to cover the monthly needs of the client. The retainer may represent the consultant’s normal billing rate or, because it is an ongoing relationship and the consultant may or may not work on that day, the retainer fee may be at a discounted rate, even as low as 50 percent of the normal rate. Hence, the consultant with a $200 rate may be on a retainer for one day a month at half-rate, $100 per hour, which equals $800 a month. If she or he does not work, the $800 rate is still collected for the consultant standing by. If work is required that month, the first eight hours are billed at the lower rate and all subsequent hours may be billed at the regular or discounted rate, as agreed.

The consultant in some cases may allow the client to accumulate unused time for up to one year (normally at the full rate), and at the end of the year the consultant bills out, the slate is wiped clean, and the new year starts fresh. Obviously, there is room for a great deal of flexibility and creativity in retainer arrangements.

Consultants have mixed feelings regarding retainers. Some people are simply more comfortable with a dependable commitment and guaranteed (even if discounted) income than with facing the unknown. Yet this may contradict the character of the individual who opts for the independence of a consulting career vis-à-vis the security of a corporate position.

Billing Periods

Typically, the consultant bills the client at the conclusion of the consulting assignment. If the assignment spans more than one calendar month, you may bill monthly for “services rendered and expenses to date.”

Expenses

Expenses incurred by the consultant that may be billed to the client include the following:

1. Travel costs

a. Use of the consultant’s private auto at a mileage rate (e.g., 49 ¢ per mile)

b. Public transportation (planes, trains, taxis)

c. Lodging

d. Meals

e. Gratuities

2. Clerical services, telephone and telegraphic costs, parcel/package delivery, and printing/binding costs

3. Miscellaneous expenses

a. Researcher costs

b. Outside investigative costs

c. Photographic costs

Excepting individual client limitations on reimbursable expenses, and legal limitations imposed by the Internal Revenue Service (IRS), you may set your own standards. For example, I bill clients 49 ¢ a mile for the use of my private auto. Some clients may limit auto mileage reimbursement to policy limits. If indeed such a client objected to my rate, I would acquiesce to the client’s corporate guidelines. The same is true with air transportation. I fly first class only; so do a few of the IAPSC members surveyed. I had one prospective client agree to my fees and all expenses except first-class fare. When I asked, however, the client did agree to pay full coach fare. The difference between that rarely used fare and first class was $39. I paid the difference and flew first class.

Unless the client specifically asks for you to submit copies of receipts, you do not need to attach them to the invoice. However, receipts should be retained as part of the file as a sound business practice, as well as evidence in the event of an IRS audit.

Some consultants pass on to the client actual only expenses, whereas others add on a service charge of about 5 percent. Either way is proper. Of course, a 5-percent service charge would not be added if the client had made an advance against expenses.

These expenses you bill your client for end up appearing as income; for example, you bill the client $5,000 for your services plus $1,000 for such expenses as airfare, hotel, taxis, and so on. The client sends a check for $6,000, which you record as income. In a very real way the expenses you bill for “inflate” your income and at the end of the year you must deduct these expenses from the gross receipts or you’ll pay income tax on the reimbursement of your own expenses. Put another way, you have two sources of income: revenue from services provided and the legitimate deduction of expenses, because you pay tax on every dollar you don’t deduct as a legitimate expense!

The Invoice

The invoice is the document that presents your billing to the client. It serves as a demand for payment for services rendered and expenses incurred. The client carefully reviews this instrument and notes such components as the amount of time spent. If the invoice is reasonable and meets expectations, it is approved and forwarded for payment.

The invoice may appear on the consultant’s letterhead, a preprinted business form, or a computerized statement (Figure 11.1). Note how Figure 11.1 breaks the time into tenths of an hour. See Figure 11.2 for an example of an invoice log. Look at invoice #1003 in the log. The first two numbers represent the year, and the last two numbers represents the number of invoices for the year to date. I encourage the numbering of invoices because that way, an invoice log can list how many invoices you have prepared this year to date, to whom, on what date, and for what amount—and which ones are still outstanding. Figure 11.3 is another example of an invoice, which includes the consultant’s “fee schedule.” Again, in a sole proprietor’s practice, the options of what and how to conduct one’s business is strictly a matter of personal choice.

Figure 11.1   Invoice for forensic work.

Figure 11.2   The invoice log tracks the status of invoices sent—and paid.

Figure 11.3   An invoice with fewer details, although it does include the original fee schedule agreement.

Some consultants require the invoice be paid within a specified period of time (usually thirty days) and add a penalty of 1 to 1.5 percent of the invoice total if not paid within that time. Should you choose to use this strategy, you must be certain that it is clearly spelled out on the invoice itself.

Invoices should be prepared in duplicate with one copy retained for your file. In rare cases an invoice gets lost, and on request you can pull the duplicate and send a photocopy or e-mail attachment for processing. The duplicate also memorializes, for the file, your time and expenses on that client’s project. I also recommend that your IRS number (or social security number) be displayed on the invoice, in view of the IRS requirement that such payments be reported. Unless your client already has your number, its absence could cause delays in the payment. Some firms will not pay until they have the number. Others may make payment and request the number at the close of the year. Placing the number on each statement simply expedites the process.

Collection Problems

Collection problems are rare. Problems that do arise include the following:

• The client refuses to pay any amount.

• The client refuses to pay part of the amount.

• The client delays payment.

Refusal to Pay Any Amount

I know of one case wherein a major security service firm contracted a security audit, and the consultant’s survey report was of such poor quality that the client rejected the report and refused to pay. The security firm then asked if I would conduct the survey for that same client. Thus, the security firm suffered a loss in the cost of its own survey but provided another security professional to do the project for the disgruntled client.

If a client refused to pay but the consultant felt confident that the contract had been met, the only recourse available would be to collect through the courts.

Refusal to Pay Part of the Amount

I know of another case in which the client objected to the amount of time billed, because there was no explanation as to what work was performed during that period of time. To avoid such a problem, the consultant can itemize tasks for the various hours billed.

Delayed Payment

This represents the most common and irksome problem that faces consultants. Most companies pay invoices within a thirty-day period. If thirty days after the date of billing the invoice remains outstanding, you may send a copy of the original invoice with “Second Notice” stamped in red ink. You will likely be paid promptly. Personally, I prefer a telephone call to the executive with whom I worked, and that tends to resolve the problem.

A final solution to any uncollectible bill may be to enforce payment through the courts. If the amount is not too large, small claims court provide the most effective forum. Documentation, which the consultant should always keep, carries a great deal of persuasive weight in these courts. And using a small claims court helps you bypass attorneys’ or a collection agency’s fees. If the amount due exceeds the limits of the small claims court, then the most appropriate course of action could entail retaining an attorney for the filing of a lawsuit. The courts should be a last resort, after polite telephone calls and letters fail. Special note: if the small claims court filing is against an attorney who works for a law firm, the named defendant in the suit must be the name of the firm, not the attorney. If the attorney is a sole practitioner, then the named defendant is that attorney.

Chapter 12

Technical Security Consulting

Frank Pisciotta, MPA, CSC

There are myriad security solutions available to the security consultant, including policies, procedures, training in crisis management protocol, security personnel, and, finally, technology. A review of the marketplace today finds at least four categories of security consultants: the security management consultant, the forensic security consultant, the information technology (IT) security consultant, and the technical security consultant. A consultant who focuses in the area of technical security performs these tasks:

• Identifies and interprets electronic security requirements, constraints, and organizational culture into a complete system design

• Solicits owner and other stakeholder input into the work scope to identify requirements and constraints (e.g., budgetary, operational)

• Deals with clients who are often technologically challenged and who need the careful, ethical stewardship of an independent security consultant

• Must possess the skills of a security expert, architect, and engineer all in one

• Integrates people, technology, and procedures

• Introduces and manages the potential for “sticker shock” for both the technology and the engineering and consulting fees

• Assists the owner in selecting the right technology, the right bidding methodology, and the right installing contractor

• Ensures that the installing contractor is capable and prepared to meet the design intent of the project

• Represents the owner or the architect during construction

• Certifies that the installed system meets the intent derived from the project design basis

• Recognizes that, if effective, one can be paid very well for this work

• Assumes the complete blame if it goes wrong

This chapter is intended to delve into and review common processes, shed light on potential pitfalls, and generally equip the reader to perform better in the area of technical security consulting. Technical security consultants assist clients in determining how to appropriately integrate technical security systems into an overall comprehensive security program for cost effectiveness and risk reduction.

The initial phase of work is often referred to in the architectural and professional security community as the programming or risk analysis phase. This phase identifies the needs and requirements, defines the problem to be solved, and presents or may even go so far as to recommend concepts for the protection plan. The output from this initial phase of work sets the direction of the project. This chapter assumes that the appropriate risk analysis has been conducted, and that step is therefore not covered here. If this is not the case, the designer may be required to undergo some level of programming activities (assessment and agreement on the design basis) with the owner to establish the parameters and constraints of the project.

Once the design is under way, the procedure will typically flow as an iterative process with reviews at regular intervals, which may be determined by the owner, the architect, or the design budget of the project. Sometimes the project’s budget does not allow for multiple levels of design review, and one may have to issue complete documents after only two rounds of review by the client. This alternative should be reserved for projects where the scope of work is simple and the consultant has sufficient depth to avoid critical design mistakes. Typical work phases include the following:

• Schematic design: 5 to 20 percent

• Design development: 20 to ∼50 percent

• Detailed design documents: ∼50 to 95 percent

• Construction documents: 95 to 100 percent

As the design progresses through the various gates, it is vital to get written approval from the owner of the designer’s work products to avoid misunderstandings and reworking later. Nothing is more inefficient and costly to the technical security consultant than redoing work products when someone changes his or her mind long after you have turned in your work and moved on with the design.

Designs are typically supported by drawings, which help to document and communicate the requirements of the project. These are essential not only for the bid, but also to sustain and maintain the systems during postconstruction. A typical drawing package might include the following types of drawings:

• Title sheet and legend

• Site plan

• Floor plan(s)

• Communication and block diagram

• Riser

• Door and device schedule

• Camera schedule

• Installation typical details

Typically cost is updated at each design gate. It is senseless to invest in designing something that is unaffordable. Each phase should include a percentage contingency (e.g., 20 percent to start) to cover unexpected construction expenses. As the design progresses and uncertainty is reduced, the percentage of contingency should be decreased. Maintaining a relationship with manufacturers (versus integrators who sell the product to the owner and end users) is very important because they can provide the designer “list” pricing for product lines that will support the cost estimate. Usually customers are not charged list price, as the integrators buy products from the manufacturers at a discounted price, but in my experience, cost estimates must be conservative and the utilization of list pricing in your cost estimate will help to create a cushion and contingency to ensure the estimate is not low. It is better to overestimate a project cost than to fall short, providing that your estimate is not so high that the owner starts to cut scope from the project.

There can be a lot of time pressures on both the design and the designer. Experienced designers must know how to navigate these challenges and have a good grasp on the design process safety nets that are in place as the process moves from one gate to the next. Compromises are sometimes required along the way in order to meet certain deadlines, with the understanding that some uncertainties are accepted, but they must be addressed in subsequent gates.[1] Safety nets are generally present at every stage up through the acceptance of the final bid and, in some rare cases, when bid submittals are reviewed after the contract has been awarded. After that last gate, the designer is on the hook for all decisions and resulting change orders, and their reputation, livelihood, and pocketbook are at stake.

Schematic Design Overview

Schematic design is the development of graphic and written conceptual design solutions to the program for the owner’s approval. Skill sets necessary to be successful in the schematic design phase of work include the ability to develop alternative solutions to a specific problem and the ability to effectively document and present solutions to an owner for selection and approval. Typical work products in schematic design include the following:

• A narrative description of the operation of the proposed security system(s) and its relationship to the organization’s risk and design basis formulated in the programming stage of the project. Alternatives to the ideal solution proposed should be prepared in advance and ready for presentation in the event the proposed solution is rejected. Owners rightfully demand choices, and it does not enhance your credibility to have an idea rejected with no backup plan.

• A block diagram indicating the interrelationship between multiple security systems that may be associated with a particular design (as applicable).

• A rough order of magnitude cost estimate.

Although detailed drawings may not be prepared at this stage, block diagrams or other renderings are effective at communicating the system intent. In some cases, a specifications outline may be required at this stage, but it is often premature. Many believe it is best to complete all of the drawings before starting the specification, but design consultants may handle this issue with diverse approaches. Another approach is to wait for the drawings to be completed prior to investing heavily in a specification. Typically, schematic design solutions are not going to be over prescriptive as there are often multiple ways to solve a problem, many of which can be explored further in the detailed design stage of the project.

Ensure there is a formal process to solicit approval of your schematic design concept before moving to the next gate. The failure to get an approval before moving on can result in client dissatisfaction, costly rework of your design documents, and loss of profitability on your project. Work in the area of technical security requires an immense amount of demand management within the design group, with other trades, and even of the owner, encouraging him or her to review the design and provide comments in a timely fashion.

A very rough order of magnitude is typically put together for a project at this stage, with additional effort put forth in subsequent phases of design as more detail emerges and installation uncertainties are eliminated. The preliminary cost estimate gives the owner a sense of the expense of the project so that a decision can be made as to whether the project will be funded for further design and installation.

Detailed Design and Construction Documents Overview

After the schematic design concept has been approved, you will start down the road through detailed design (DD) to construction documents (CD). DD and CD are iterative processes where similar steps are repeated at both gates. For brevity, the steps of DD and CD will be combined in this section.

DD is the time to eliminate uncertainties from the project. The design safety nets are getting fewer and fewer. At my firm, we have found the following order of operations makes sense in terms of workflow, though we appreciate that every designer may have his or her own way of doing things.

Field Device Data Gathering

This step involves collecting detailed information for the scope of work (e.g., door, device, or camera details). Efficiently gathering comprehensive information on existing conditions at the work location where the security upgrades will take place contributes to a successful and efficient design. Data collection forms are recommended to standardize your data collection.

Development of Device Schedules

After data have been gathered in the field, the results must be committed to the appropriate device schedules, which will inform the design drawings such as floor plans and riser diagrams. Components of an effective device schedule may include, but not necessarily be limited to, the following:

• An interim device identifier during the preliminary design phase, which correlates to field markups of initial drawings. Often the security consultant is walking around in the field and may not necessarily have the latitude to assign a formal device identifier to each location where security devices will be installed.

• A unique identifier assigned to each device locations after development of the schedule. This is often done back at the office after the consultant has had some time to organize the data. There should be some logic to the identifier used. For example, the identifier “D-03-Adm-01” might represent the first door on the third floor of the administration building. That number can be used throughout the project in several instances (e.g., on the floor plan, in the schedule, as the wiring label for the cable in the panel).

• A unique space name that everyone will recognize during design reviews, bidding, and installation processes.

• Door, gate, or camera name so that the specific installation location is identified.

• Classification of the door, device, or camera.

• The mounting location for the device (e.g., wall, floor, ceiling).

• The technology associated with the device to be installed (e.g., iClass, IP).

• The connectivity of the device to be installed (e.g., hardwired, wireless).

• The wiring required for the security device.

• A suggested run-to location where the security device will be connected to the network.

• Power requirements.

• The source from which power will be obtained for this particular project device.

• A reference to the installation typical detail (more on this in detailed design), which is defined as a rendering of how security devices need to be installed and connected.

Development of Floor Plans

A floor plan is a scaled drawing of a horizontal section of a building that shows security devices, which may include, but not be limited to, access control, intrusion detection, or video surveillance devices. Floor plans provide a sound basis for a design as well as a means by which the owner of a project can quickly review design documents and ensure that devices are correctly placed throughout a facility (Figure 12.1). Floor plans should have a one-to-one correlation with the project device schedules and should be automated where possible such that the floor plans feed data to the project device schedules. With advances in technologies such as Revit, the quality of building construction documentation is getting more accurate. Autodesk Revit architecture, often referred to simply as Revit, is a building information modeling software program developed by Autodesk. It allows the user to design with both parametric 3D modeling and 2D drafting elements. Building information modeling is a computer-aided design (CAD) paradigm that employs intelligent 3D objects to represent real physical building components such as walls and doors. In addition, Revit’s database can contain information about a project at various stages in the building’s life cycle, from concept to construction to decommissioning. This is sometimes called 4D CAD, where time is the fourth dimension.

Figure 12.1   Example of an office floor plan.

Preparation of a Riser Diagram

A riser diagram is defined as a 2D rendering that shows the connectivity of the major items of a security system or integrated security systems (Figure 12.2). The preparation of a riser diagram is the first step in building a detailed bill of materials for a security system whether it is a video surveillance system, an intrusion detection system, or an access control system. To prepare a riser diagram, the designer needs to know something about the architecture of the proposed system or product on which the system is based. For example, in the case of an Internet protocol (IP) video surveillance system, the designer will need to know the number of cameras that will connect to each specific network data collection switch. In the case of an access control system, the design is aided by the designer’s understanding of the access control panel architecture if a system has been selected or the designer utilizes the demands of the system to assist in the selection of the product. For example, for an access control project in a building that features asbestos, it might be wise to consider an edge architecture for the panels to minimize the amount of wiring that has to be pulled through the building. Riser diagrams should feature a wiring legend, an inventory of the devices, and other various drawing notes that help to clarify the installation requirements. Often organized by network connected points, the riser provides the reader with a global view of the project and the interrelationship between systems.

Figure 12.2   Security riser diagram.

Installation Typical Details

Installation typical details present the bidders and contractors with a visual representation of the expected conditions at the installation location. Figure 12.3 shows a typical configuration of an access controlled door. The detail indicates the pathways for wiring, specifies the quantity and locations of the proposed devices, and has a unique identifier that correlates to the project door and device schedule. Installation typical details such as these are essential when multiple trades are coordinating, such as electrical and security. Both trades can use the detail: whereas the electrical contractor is informed as to how to bring wiring, back boxes, and conduit to the door, the security contractor is similarly informed as to the security requirements at the door. A typical detail would be developed for each unique installation condition of a project (e.g., door types, camera types, intrusion device types).

Figure 12.3   Installation typical detail.

Updating the Cost Estimate

After the riser diagram is complete, the consultant can refine the preliminary cost estimate for the security project. Tightening up the cost estimate will require the selection of specific security products that meet the intent of the project, even if other equivalent products will be allowed on the project. Selection of a product that meets the intent of the designer (e.g., an access control manufacturer, specific type of digital video management software or camera) establishes a basis for the DD/CD phase of the cost estimate and also provides the foundation for a specific section of the specification dedicated to products. Lastly, in some cases, design consultants can provide bidders with a sanitized copy of the DD/CD budget worksheet for inclusion with proposals. This creates some efficiency for the design consultant in reviewing bills of materials and pricing. When sanitizing these worksheets for release, the design consultant may remove pricing and quantities and allow the contractor submitting a proposal to populate these fields with his or her opinion of the quantities and costs required to meet the project intent.

Initiating the Specifications

The specification is a narrative overview of the project with cross-references to other project documents such as drawings and the owner’s general contracting conditions. One of the easiest times to write the specification is after the drawing set and DD cost estimate is finished. At this point in the design, schedules are close to being finalized (pending final detailed design review); riser diagrams and floor plans are complete; and all of the data necessary to describe the system, how it is to function, and the products that are required to make it work should be understood, making for an efficient pathway to a good specifications draft. Owners dictate when they wish to see these specifications for review, but typically the later this document can be produced, the better it is for the designer.

A strong specification will provide a good description of the system; provide clear instructions on how to respond to the bid request; establish the expectations for quality and construction; and establish test and acceptance procedures, the anticipated construction schedule, and whether or not late delivery will result in liquidated damages.

The specification provides a means to supply other key design data that the designer has collected during the DD/CD phase of work that may not appear on a drawing. One word of caution regarding the documentation of data in a design package: try to avoid duplicating data points in more than one location of a design package. That practice creates a risk for conflicts in your documents when something changes. The designer may wish to consider further protection from conflicts in the design package by including language in the specification such as “There may arise during the bid process a situation where the plans and specifications do not completely agree or coincide with respect to quality, quantities, and costs with other supporting contract documents. In the event such a discrepancy exists, the bidder shall notify the owner/design professional.” An example of a conflict in design documentation might be a card reader that does not appear on a floor plan but is listed in the device schedule. Because the card reader appears in the door and device schedule, the specification language suggested earlier entitles the owner to the card reader.

The following design features may be included in a specification:

• Power and backup

• Owner’s wiring and cabling standards

• Owner’s drawing standards

• Insurance requirements for the bidders

• Code requirements

• Warranty matters

• Maintenance and service expectations, and penalties for failing to meet minimum response times

• Other workmanship standards

The specification is also the place to delineate who will be responsible for what in the project. For example, the owner may accept responsibility for providing power, and it will be important to communicate that piece of information to the bidders for accurate bidding and cost accounting.

Specifications may be standalone (in the case of a security-focused project or retrofit) or are included in a larger project specification manual in the case of a wider scope of construction (e.g., new building construction). In the latter scenario, which tends to be a little more involved from a design effort level, the security designer will be required to coordinate with other design disciplines such as electrical or door hardware to ensure the intent of the security design is properly represented in other divisions of the specification book. Irrespective of the complexity of the project, specifications must be complete, accurate, and clear. A common format for preparing specifications is represented by the Construction Specifications Institute (CSI). A CSI-formatted specification is composed of three parts:

1. General Section 1.0, which is a description of the project and the basic parameters.

2. Products Section 2.0, which is the section that defines the acceptable products that meet the general design intent of the project.

3. Execution Section 3.0, which is intended to define the workmanship expectations, training, commissioning, and turnover requirements.

One clear objective of a specification is to achieve consistent interpretation by bidders for an apples-to-apples comparison. The specification carries the most weight and is often considered to be the controlling contractual document in the construction set. If there are any discrepancies, the specifications prevail. Typically in the case of a large scope of work where a security system is just one of many facets of the project, the security designer has a lot less influence as to who will be selected for the project as well as the criteria for selection. Bids are often awarded to the lowest bidder, and the security contractor may be several layers deep in the subcontractor cadre. However, in the case of a standalone security project, the designer has a lot of influence in the process by virtue of the procurement method and criteria that can be placed into the specification. When a proposal is requested, some of the typical information that a designer may seek from bidders to assist in standardizing the response and aiding in a fair and transparent analysis of the bids includes the following:

• Acknowledgment of all project addendums (to ensure the bid is complete).

• Technical information including a bill of materials, product data sheets, proposed installation schedule, and suggested changes to design drawings.

• Pricing and base bid information, which sometimes necessitates breaking down the project into segments to enable the owner to choose which phases of work to fund in the event of a limited budget. In some cases, a detailed breakdown of costs associated with the bill of materials is useful to ensure the contactor has included the appropriate quantity of devices. Once, when challenging a contractor’s bid for a project that had excessive equipment, my fim was told, “I often add a little extra equipment in case I am short on the labor.”

• Pricing after the warranty: the designer must think beyond the initial installation through the warranty and beyond. We typically ask for a cost for ongoing support and maintenance of the system in terms of software upkeep, annual inspection and testing of the systems, and verification of the quality of the data backup. We do not endorse the typical maintenance contract model of the security industry whereby the owner pays some percentage of the cost of construction and the installer comes in and fixes parts of the system when they break. Too often the owner is not attentive to the system and few services are performed for the fees charged. With my firm’s model, at the end of the year there is a clear correlation between what the owners pay and the services received. The other advantage is that this method ensures that the specification calls out expectations for service response times and penalties for failing to deliver on these expectations.

• Compliance affirmation: years ago, my firm started including a specific compliance affirmation form in our specifications (as an appendix), which requires the bidders to sign off on their commitment to comply with the specifications and drawings or cite any specific exceptions they are taking. This is an easy way to spot potential trouble on a project before the contract is awarded.

• Capability, project experience, and references: when evaluating a security contractor, it is obviously important to review the contractor’s experience and talk to customers. Generally, you are not going to get the name and number of a customer who is going to provide a bad reference, but it does happen. Ensuring contractors have sufficient experience will make certain they are not “cutting their teeth” on your project at your time and expense.

In the interest of fairness to the contractors, it is important not to ask for too much information as part of a proposal submission. For example, it is unreasonable to expect detailed drawings by all bidders, which would consume a lot of resources when only one will win the project.

Some other useful considerations for your specification (from years of lessons learned) include the following:

• Consult with manufacturers or additional systems experts, some of whom may have cost-effective solutions you may have not considered.

• For schedule control, consider liquidated damages on the project. My firm has been involved in projects that have dragged on way beyond everyone’s expectation because there was no leverage to get the installer to finish the job. When you start to introduce a penalty such as $250 per day for late delivery on an agreed upon schedule, you are likely to see different performance on schedule.

• Communicate to the bidders that construction site reviews will be executed to verify the workmanship and compliance with the specifications and drawings.

• Ensure that you set clear expectations for the training, including the preparation of a syllabus, provision of an appropriately qualified trainer (not a technician who may not be able to put the system’s use into a risk-based context), and provision of a proper training venue. This might include setting up some laptops or personal computers with the appropriate software so trainees can get hands-on experience.

• Clearly communicate the commissioning and closeout process.

Once again, it is important to get the owner or client to sign off on the DD work product before moving from one gate to the next and releasing bid documents to the street. Moving from DD to CD should be a fairly painless process if the designer has done a good job in the DD phase of work. The designer should have worked out all project uncertainties by this time, as the documents are finalized and the design safety nets are running out.

While the bidding phase of work provides yet another opportunity to correct problems or discrepancies that may come to your attention (via bid addendum), time is running short and the stakes are getting higher as design uncertainties are carried this far into a project. The owner must be given the opportunity (and expects) to review the bid documents before releasing them to the bidders to avoid surprises and rework by the designer (work for which you may or may not get paid).

Bidding and Award Matters

The designer should be coordinating with the owner’s purchasing department to make certain that the procurement methodologies are understood and to ensure the proper coordination between an owner’s general conditions and contracting language, which are often integrated with a designer’s technical documents when the bid package is released to the bidders. The sooner the designer can review the owner’s conditions, the easier it will be to identify potential conflicts or overlap between the technical and commercial documents associated with the bid package. Commercial terms can often slip into a designer’s technical package for those times when a standalone security package is issued for bid.

Understanding the procurement methodologies (e.g., invitation to bid [ITB] versus request for proposal [RFP]) is also important to the designer for several reasons. In a request for proposal scenario, the process tends to be a little more forgiving from a design perspective. The designer can share responsibility for some of the decisions communicated to the installer as part of the process. In terms of the analysis of the bids, the designer is going to need a system for evaluating the bids to support a recommended award and course of action for the owner. Further, this methodology typically requires the review of all proposals rather that just starting with the low bid and analyzing proposals until a responsible bid is identified; therefore, this approach can be much more time intensive. From a resource planning perspective, the consultant should understand as early as possible (preferably before the consultant’s bid for design services is submitted) which methodology will be in play.

In the invitation to bid methodology, where the lowest responsible bid is simply going to be selected, there is a lot more pressure on the designer to have an airtight design to avoid change orders, because the bidders rely on the designer’s documents as the basis of the bid. Errors or omissions in the design will result in change orders. The methodology can sometimes be faster and easier on the analysis side, but it may result in the selection of less qualified bidders who may not understand the work at hand or are intentionally submitting a low bid to win the work. Overemphasizing cost at the expense of qualifications-based selection is not recommended unless mandated by owner’s procurement policy (such as with public-sector–based projects).

Conventionally a prebid meeting is held for all interested bidders. This is an opportunity for the designer and the owner to communicate the basic parameters of the project and take interested bidders on a physical tour of the site(s) in question. At the conclusion of the prebid meeting, the designer may wish to issue a clarification report to address any issues that arose during the meeting. One widely accepted philosophy is to require all bidders to put any questions they have about the project into writing so that there are no miscommunications with verbal questions and responses. A fair and transparent way to handle requests for clarification is to provide responses to all questions to all bidders. Fairness and transparency should be highly valued in the design process. There should be no actions that create an adversarial relationship at any time during the process, and the designer should be respectful to all bidders at all times.

When planning your project timeline, you will need to consider how much time to allow for contractors to prepare the proposals. If the project is not complex and the security contractor does not need to obtain quotes from subcontractors, two weeks should be sufficient. My firm’s experience is that no matter how much time you provide, many contractors will wait until the last minute to complete a proposal. One strategy to mitigate this procrastination is to establish a clarifications deadline during the bidding period that is not really close to the bid due date. This encourages bidders to become familiar with the bidding documents in advance of the bid due date and hopefully avoids last minute questions. For larger projects that involve subcontractors to the security contractor, four weeks or more may be required.

The designer should be careful to safeguard the pricing information of bidders and other proprietary documents that may be submitted by bidders. Typically, in our firm we label documents proprietary and indicate to bidders that documents will clearly be treated as such. After a decision is made and the contract awarded, it is customary to send (or have the owner send) a thank-you letter to all of the bidders who were not awarded the contract. Bidding takes a lot of effort, and extending this courtesy and treating bidders fairly will ensure that you will have their participation in future projects.

Construction and Closeout

After the contract has been awarded, a preconstruction meeting is a good way to open the lines of communication among all parties who will participate in a project. At a minimum, this is a good time to introduce all key players to the project, exchange contact information, and clarify expectations between the owner and the installer regarding matters related to construction and closeout. The schedule for installation should be finalized, and the designer, in conjunction with the owner and the installer, should agree on the schedule, particularly the period when the construction site reviews will be conducted. Also to be discussed in this preconstruction meeting will be the expectations regarding initial technical submittals for the project. The initial submittal typically includes drawings, data sheets on products, and schedules. These documents will be submitted by the contractor, reviewed by the designer, and either approved or sent back to the contractor for revision. Once everything has been approved, the contractor will order the equipment and construction will begin.

A construction site review should be conducted early in the installation process, because frequently there are problems of workmanship that the designer needs to identify before those deficiencies are repeated in multiple locations throughout the project. An early construction site review can help the designer avoid a long punch list, reduce the construction schedule, and safeguard the installer’s profitability. Deficiencies noted during these reviews will be documented by the designer and maintained on a document generally referred to as a punch list. The contractor will be required to work off the punch list before the final payment is made.

During the construction process, there are several important matters for the designer to anticipate and facilitate between the contractor and the owner. The first is programming of the security system. The owner is going to have to live with the nomenclature that is programmed into the security system after the contractor completes the installation and goes onto the next project. The design consultant should have a firm process set up in the construction schedule for the contractor to provide and the owner to approve the programming nomenclature for the system if this was not already handled in the design phase. The next important issue is training. The contractor should be required to submit a syllabus, or the design consultant should provide one as a starting point. The design consultant should ensure that a sufficient location is set aside and equipped for the training. I have seen several instances in which a large number of people are crowded around a computer terminal in a small security office, which is not conducive to learning. Finally, the successful design consultant will have a well thought out process to transition from construction to project closeout. It is important to be forward thinking in this process.

The commissioning and closeout phase will be the point at which you will conduct the final verification that the system has delivered on the promise of the risk analysis and design process. Strategies should be employed to put the onus on the installer to prove that the system is functioning as designed before the design consultant and owner commit resources to a walk-through of an incomplete system. Stipulate to the contractor the expected level of proof and documentation to demonstrate the system’s completeness (e.g., door and alarm testing results). After the designer is satisfied that the preliminary testing by the contractor is satisfactory, a walk-through can be coordinated between the designer, the contractor, and the owner. When conducting the walk-through, ensure that effective communication devices are available (e.g., radios) and that a master key or credential is in hand so that there are no restrictions in viewing any of the areas where panels or other devices may be installed. For a video project where cameras are mounted on poles or other areas where easy access is not possible, consider inspecting these project locations while the lifting devices are on site so no additional costs are incurred at the conclusion of the project. The designer will witness the testing and document any deficiencies in performance. Either these will be added to the existing punch list or a new one will be created if there are no open items. The contractor will also be required to provide other project documentation such as operations/maintenance manuals and record drawings that will show the actual installation conditions of the project.

The designer should ensure the owner is prepared to properly maintain and test the system from an operability perspective. Typically a warranty extends for one year from the date of project acceptance. The design professional has to manage the date on which the system is accepted and reject the general tenet some contractors promote, which is called beneficial use. Beneficial use would support a situation of when the reader is powered up, the owner is getting benefit, and the contractor wants to start the warranty. There could be a situation in an extended construction schedule in which the warranty expires before the owner even signs off on the project. So the specification has to stipulate how and when the warranty will start.

As the warranty is nearing completion, my firm typically asks the contractor to conduct a complete top-to-bottom inspection of the site and make all corrective action prior to warranty expiration. This will conclude the warranty period and put the contractor into the next maintenance phase of work. As previously described, the specification should have established a level of service and software support for the postwarranty period. If the designer has followed the preceding steps, the project should be in a better place than it would have been if these steps had not been followed. The following section addresses some general actions a design professional can take to continually develop and ensure he or she can bring the best possible service level to the owner.

Final Thoughts and Considerations

• Stay current with emerging technology. This can be done in a variety of ways, such as by attending trade shows and maintaining a relationship with manufacturers who value the consulting community and dedicate resources to places on their websites and consultant-focused training programs. The major trade shows include ASIS and ISC. The International Association of Professional Security Consultants (IAPSC) conducts an annual meeting where top manufacturers gather by invitation only to present product developments and interact with design consultants.

• Be aware that the IAPSC also develops summaries of security-related academic studies through some of its member committees (e.g., the forensic committee has developed an excellent series of documents on when video surveillance can be effective and where statistically it is proven to have a limited impact on crime). Typically these studies are available to members only and represent an important membership benefit.

• Maintain relationships with other design consultants. Although there is a lot of competition among design consultants, there is also a lot of information sharing that occurs in problem-solving situation.

• Obtain and maintain certifications. Some of the certifications that will help the design consultants (some more than others) include certified protection professional (CPP), physical security professional (PSP), certified security consultant (CSC), and certified project manager (CPM).

Work in the field of technical security design can be rewarding and profitable when done well. I fully expect the demand for these services to increase in the future and encourage those with a passion for a challenging career in the security field to consider technical security design consulting.

[1]For the designer, this underscores the importance of maintaining a list of design uncertainties (e.g., network connection points, power sources) to track throughout the project. Work in subsequent phases has to focus on eliminating these uncertainties, which will enhance the quality of the design and, importantly for all parties, reduce the risk of change orders that can be embarrassing to the designer and create significant dissatisfaction with the owner.

Chapter 13

Information Security Consulting

James Kelton, CISA, CRISC, CGEIT, CHS-III

Information security is a never ending game where the playing field consists of computer networks, servers, software applications, users, and data. The information security consultant is the coach with a job of helping organizations (teams) balance two separate balls. One ball is ease of access, storing, and transmitting data. The other ball is ensuring information confidentiality, availability, and integrity. Some of the adversaries may have actually been part of the team, such as current and past employees. Other adversaries have been on an opposing team, such as competitors. Hidden adversaries, such as intruders, lie in wait. All of the adversaries want valuable data and are eager to play the game to win. What the team doesn’t know, however, is that the adversaries don’t play by the rules.

Why do intruders hack into systems? Think of information systems as an electronic maze or crossword puzzle. It’s a challenge to break in and win the game. Information systems are the game and data are the prize. The coach’s job is to help the teams win the game by keeping intruders out of their systems. Intruders win the game by breaking into information systems.

Ad-Hoc Security

Many organizations lack the staff, funding, and resources required to put into play a formal security solution. Many teams implement ad-hoc solutions that leave their systems vulnerable to an attack by the opposing team. The coach’s job is to professionally guide the team through the complex balancing of two balls: one, providing access to systems and, two, keeping information secure.

Once the information security consultant is contacted, your job as a coach is to first ask, “Why did you contact me?” Is it to provide management with peace of mind? Did the organization experience a security breach? Is it a compliance-related requirement? By identifying the business driver, the coach can better position services that add value to the team.

Teams come in all shapes and sizes. Whether the team is the world’s largest online retailer or a small mom-and-pop shop, the coach’s playbook includes the following tasks during a typical engagement:

• Plan and prepare. Become familiar with the client organization and its products and services.

• Establish objectives. Determine the project scope, services to be provided (consulting, audit, compliance, etc.), and the desired outputs and deliverables (reports, charts, plans, etc.).

• Develop a proposal. Prepare a proposal with a game plan that documents the client’s needs, the information security consultant’s services, benefits and value received by the client, and project cost. The proposal may also identify the measure by which the project is determined to be a success.

• Perform services. After client approval has been obtained, the coach performs the services as outlined in the proposal’s playbook. Change orders can be used if there is a change in project scope during the course of the engagement. In many cases, the security consultant collects evidence to support findings and recommendations.

• Create deliverables. The information security consultant summarizes findings and recommendations and delivers reports, charts, and other documents described in the proposal.

By helping the team understand security best practices, the coach is viewed as a knowledgeable resource and a trusted advisor. For independent security consultants, this means larger engagements on a more frequent basis. The coach’s proposal and deliverables can help educate the team by providing references to appropriate compliance requirements, standards, frameworks, and guidelines. These documents provide a systematic approach to securing and assessing systems and services. Standards identify requirements that must be followed. A framework is a little more general than and not as restrictive as a standard. Guidelines are recommendations but are not required. Generally, the coach uses a mix of the three to determine a benchmark of recommended best practices.

Five Steps to Intruding

Because every organization has a unique technology architecture, the actual process used by the opposing team to attack information systems will vary. I have found that most attacks use one or more of the following steps to gain access to systems:

1. Probe. Intruders often use scripts and tools to search for opportunities and vulnerabilities. One easy approach used by hackers is to wait for a vulnerability to be announced by a hardware or software vendor. For example, Microsoft may issue a security bulletin stating that a patch is needed for a Windows 2008 server that is vulnerable to information disclosure. By searching for systems that have not applied the appropriate hardware or software patch, hackers can identify potential targets. Some vendors may contribute to the problem by providing advance notification of the vulnerability even if the patch is not yet available.

2. Exploit. Once a vulnerable system has been identified, the intruder will exploit the opportunity to gain access to the system or data.

3. Enhance. In many cases, the intruder first obtains access to a system with lower-level access privileges. It then becomes a game for the intruder to find ways to get higher and higher privileges until the intruder has full system administrator rights.

4. Compromise. The intruder knows that having full system administrator rights is not sufficient. With administrator rights, the intruder can change the system configuration or read, delete, or modify software applications and data.

5. Cover tracks. Once intruders have compromised a system, they frequently cover their tracks to erase evidence. In this process, the intruder may erase log files, remove IDs, stop backup systems, and more.

What many teams don’t know is that the opposing team may install a backdoor or other tool that allows access to the compromised system. The backdoor may allow the intruder access to the information system even if the team changes the passwords on all of its accounts.

Time is on the side of the opposing team. Intruders know that teams have time and budget constraints and can’t always implement all of the security controls needed. In some cases, software updates, patches, and bug fixes are issued on a weekly basis. Imagine how difficult it is for an information technology (IT) department to ensure operating system and application software is routinely updated and tested on all servers and workstations.

Opposing teams know that most systems are only secured with an ID and password. With a simple and easy-to-guess user ID, all an intruder needs is a password. Unfortunately, teams make it easy for intruders, and this is why opposing teams love users:

• Users like simple and easy-to-remember passwords that can be found in a dictionary which provide access to all of their data. By using a brute force approach, many passwords can be obtained within a few minutes. Once one password is compromised, an intruder gains access to multiple systems.

• Users write down hard-to-remember passwords. These passwords are frequently stored near their computer system. Intruders know that by gaining physical access to the workstation, they may find passwords on Post-it Notes, under the keyboard, or somewhere else nearby.

• Users do not like to change passwords. Once a password is obtained, the intruder oftentimes has weeks or months before it expires.

As a coach, I have found that only one out of every 100 organizations has hard-to-crack passwords. Stronger user education and security awareness training is needed.

Teams at Risk

Each team faces unique threats and some are more likely than others to be a target of an attack. Large teams may be at risk because of their name recognition and status in the business community. Smaller teams may be at risk to insider attacks if they have poor employment practices or lack the security equipment or staff found at larger firms.

Coaches know that data can be at risk when they are outside the protected playing field. A bank with branch offices may not have the same types of security systems in place at the remote locations as it has at the main office. By providing remote access to data, the team presents additional opportunities for opposing teams to gain access to information systems.

In the past, a team’s IT department only had to worry about users accessing the corporate network via workstations. Now, where users access systems with smart phones and tablets, data are harder to secure. I have found that many users tend to choose functionality over security and many mobile devices do not have the traditional security protection mechanisms that include firewalls, antivirus software, and physical security controls.

Some teams install hardware and software products right out of the box. Instead of testing the systems in a nonproduction environment, the equipment is left in its default state with many features or services turned on, providing open doors for intruders to access systems and data. Information security consultants should educate clients on the following types of risks related to installing and configuring systems:

• Installations. Hardware and software vendors want a successful installation with very little configuration time. To make their products look good and to reduce installation problems, many products are shipped with all of their connectivity options turned on. Turning on product features opens additional doors for intruders.

• Defaults. Many products are shipped with default IDs, passwords, and access privileges. Intruders know to look for default configurations (e.g., administrator as the user ID).

• Connectivity. Systems are initially configured for connectivity, not security. Intruders know that many hardware and software products have features that provide additional opportunities.

• Options. Intruders know that some equipment, like a firewall, starts secure when initially shipped from the factory. To get e-mail, Internet connectivity, and file downloads to function, IT professionals change the equipment configuration. Intruders know that by changing the equipment configuration of a secure product, the IT professional has created an additional opportunity to compromise the system.

• Testing. Intruders know that most IT professionals are overworked and understaffed. They install and configure systems but do not use external organizations to audit their systems and procedures.

Opposing teams use a variety of tactics to target a team’s staff, and coaches can educate teams on these various types of risks. Intruders know to look for the weakest links in the security chain. A team’s players can represent the biggest risk:

• Phishing. Intruders know that sending fake e-mails to team members can get them to perform actions that compromise the confidentiality or integrity of information. By clicking on a link in an e-mail message, a team member may unknowingly download malicious software (malware) to her or his workstation. The malware can then launch attacks against the internal network.

• Dumpster diving. Intruders know to look in trash bins for reports that contain account numbers, user IDs, client names, and so on.

• Intimidation. Intruders use intimidation tactics on the phone to get users to volunteer confidential information. Intruders may call an accounts payable department stating that they are working on a project for management and without a certain code, they can’t meet their deadline.

• Kindness. If intimidation does not work, intruders try and kill their targets with kindness. Team players will go out of their way to help a friendly voice on the phone.

• Remote assistance. Many teams reduce costs by managing and maintaining IT systems from remote locations. Hackers know that if the IT department can administer IT systems from remote locations, doors are open to the network that may allow the systems to be compromised.

As a coach, the information security consultant can help teams identify their types of intruders and likely attacks. The more information the coach has about intruders and their types of attacks, the better can be the controls implemented to guard against the loss of data.

Teams That Use Outside Players

Many teams outsource some or all of their IT services. Although the term third-party service provider may appear to be a relatively new concept, the use of third-party service providers as outside players for hardware maintenance, contract programming, and even time sharing services has been around for decades.

As teams focus on their core competencies to be more competitive, they outsource their second string. Many teams use an outside firm to program and develop a website. If the site later gets hacked, imagine the damage to the team’s image and reputation if the site is defaced with objectionable material. What many executives (owners) don’t realize is that transferring a service or process to an outside entity does not relieve the owner of the responsibility to keep systems and information secure. In the best of all worlds, the team would engage the services of a coach prior to the site going live. By performing a web application security assessment, the team can ensure the site meets minimum security requirements; this assessment gives the team the best chance of ensuring the code was not vulnerable to an attack. Not just a one-time event, web application security assessments should be performed on a regular basis (i.e., annually) or when substantial changes are made to the site.

You may have heard the terms cloud computing, cloud storage, and cloud provider. These terms refer to outside players. What is a cloud service provider, and how is it different than a traditional data center? With a traditional data center, the equipment is likely to be owned by the team, security services are provided by the team’s staff, and only one entity has information stored on the servers. With a cloud environment, the equipment is owned by the outside player, not the customer, security mechanisms are designed and implemented by the outside player’s service provider, and the outside player serves many teams. When many teams share the same equipment, owners must be aware of the risks and additional controls needed to ensure information security.

Rapid advances in third-party services have generated many on-demand and scalable benefits. At the same time, however, the use of third-party service providers has significant and unprecedented risks related to the security of information as well as a loss of control over the IT infrastructure. Information security consultants can evaluate and educate an organization on the risks and controls related to the use of third-party service providers such as contractors, programmers, cloud computing, and related services.

Managing the Team’s Risks

Information exists in many forms and what may be sensitive or important to one team may not have the same relative value or importance to another. Industry standards specify that for information to be considered secure, it must contain the following elements:

• Confidentiality. The proprietary nature of information must be protected and only readable by authorized users or programs.

• Availability. Information is available in the required time frame. Some systems need to be up and running twenty-four hours a day, seven days a week.

• Integrity. Data can only be altered or destroyed in an authorized manner.

In my coaching experience, the teams that have effective risk management systems tend to have the strongest defenses. Risk management is the process of identifying vulnerabilities and threats to information systems. It also includes the controls that are implemented to treat risks.

Most businesses exist to provide a return to their owners, investors, and stakeholders. Although risk is inherent to all teams, the coach should make sure that an owner’s business opportunities are not missed or inefficiencies created by trying to eliminate all risk. For example, it is possible to have computer screens locked after five minutes of inactivity. However, computer users will quickly get tired of constantly logging back on and the risk is that the users may start to bypass security systems.

I am often surprised to find that many teams use an ad-hoc approach to information security. They install a firewall to protect against opposing teams and use antivirus software to protect against viruses, worms, and other forms of malware. At this point they think they are done, either because they do not have a planned approach to security or they do not have a formal security budget.

A formal approach to risk management helps managers recognize the impact on the organization should they experience a security breach. Managers are more likely to establish a budget and approve expenditures if they are aware of the potential downtime and damage to the organization’s image and reputation that a security incident can cause.

Assessing the Team’s Risks

As a coach, an information security consultant can help a team implement a formal approach to managing risks. A risk assessment is the first step in the risk management process. The risk assessment identifies and prioritizes assets that are important to the team. Information assets, whether tangible or intangible, are essential to the team’s well-being. These assets are necessary for day-to-day operations and must be protected to ensure the survival of the team and its ability to provide products and services. When identifying IT-related assets, the coach should think broader and include facilities; routers; firewalls; servers; information assets such as data and custom software; and players such as employees, contractors, and service providers. When in doubt, include the asset.

Each asset is likely to face one or more threats. The coach should identity and document natural threats such as earthquakes, fires, and floods, accidental or unintentional threats such as human error, loss of power, hardware failure, and intentional threats such as hackers, theft, and viruses.

For each of these threats, there may be one or more vulnerabilities. Vulnerabilities are weaknesses that allow a threat to be exploited. For example, software that isn’t patched is vulnerable to viruses. Human resource vulnerabilities can include ineffective security awareness and education training that puts staff at risk for social engineering (fake e-mails, false websites, etc.) attacks.

The game plan summarizes how things start to look as the risk assessment progresses. As Table 13.1 shows, there can be one or more threats per asset and one or more vulnerabilities per threat.

Table 13.1

Asset

Threats

Vulnerabilities

Laptop computer

Virus results in loss of data

Out-of-date or ineffective antivirus software

Theft results in disclosure of sensitive information

Lack of physical security controls

No password at startup

Hard drive not encrypted

Lack of effective user training

Planning the Team’s Risks

After the assets, threats, and vulnerabilities have been identified, the coach performs a risk analysis. The risk analysis identifies the impact of the various vulnerabilities on the team, its owners, customers (fans), suppliers, and business partners. It also considers the likelihood of various threats and determines the impact to the team should the confidentiality, availability, or integrity of data be compromised. The risk analysis examines the impact of the failure of a system to perform its function. Security systems, for example, may fail and allow an intruder access to financial data. The coach will want to ask the team the following questions:

• What is the impact of the failure of a security system on the organization? For example, what is the impact if the antivirus software is not updated or fails to catch viruses? What is the impact if card readers stop functioning and do not permit authorized staff access to the data center? What is the impact if the access control system permits unauthorized staff access to the data center?

• Does the impact change over time the longer the condition exists or a system isn’t operational?

• What departments or staff are impacted?

• How does the failure of a security system affect the organization’s image and reputation?

Risk Treatment Plan

Risk is related to the probability of the compromising event and the impact of the event on the team. If the probability is high and the impact is high, then the risk is likely to be high. A coach can provide an owner with an independent view of the risks faced by the team and can recommend a risk treatment plan with controls to reduce the risks. A risk treatment plan identifies and documents safeguards and controls that treat risks.

Risk treatment is a decision-making process whereby risks are treated by selecting and implementing measures to address the specific risks identified in the risk assessment and subsequent risk analysis. Risk treatment options typically include the following:

• Reduce the risk. Implement specific administrative, physical, and technical safeguards that protect data and manage information security risks.

• Transfer the risk. Use insurance, outsourcing, and the like so another party accepts the risk.

• Avoid the risk. Sometimes the risk is greater than the benefits gained by performing an activity. One of my clients decided not to keep a web server operational because it was rarely used and the maintenance costs of upgrading the server to current standards were too great. By shutting down the server, my client avoided risks.

• Accept the risk. In some instances, the potential negative impact of a vulnerability is minimal or the cost of implementing the required security controls is too high. In these situations, organizations may accept the risk but use monitoring systems to ensure the risk remains within acceptable levels.

Many teams do not have the skills or resources needed to perform the initial risk assessment, subsequent risk analysis, and preparation of a risk treatment plan. An information security consultant acting as a coach can provide the services needed as well as evaluate the organization’s level of risk tolerance and recommend security controls to treat risks.

The importance of information confidentiality and availability may vary from one team to another. Most teams find data integrity an essential element of information security. Without data integrity, information is of little value to the team. The coach helps the team win by ensuring that important assets have been identified and the controls are in place to reduce risks to acceptable levels.

Assessing the Team’s Security

Some consulting engagements include a penetration test or evaluation of a team’s network. The purpose of the penetration test is to identify possible vulnerabilities that can be exploited by the opposing team. Penetration tests have many scopes and should be defined during the initial stages of the project. Questions I frequently ask include the following:

• Is the penetration test limited to an external evaluation of network entry points?

• Should it include all public and accessible Internet addresses (public IP addresses)?

• Does the penetration test include a social engineering test of the organization’s staff?

• Should the penetration test also be performed internally in the event the external perimeter has been breached?

• Should the penetration test include an evaluation of wireless access points?

In addition to evaluating external network security, the coach should remind the owners that websites are accessible by the public. Unlike firewall appliances, every website is unique and contains a lot of custom code. This makes websites an easy target for intruders. I often have to remind firms that just because their site is hosted by an outside business does not relieve my clients of their responsibility to keep the site secure. It helps to get the point across when I ask my clients questions similar to the following:

• What is the impact to your organization if your site is defaced or unavailable?

• What is the damage to your organization’s image and reputation?

• Who is responsible for choosing the web host service provider?

Compared with external network and web application assessments, onsite security assessments tend to provide more value to a team. Onsite security assessments allow the coach to review a greater range of areas and provide more detail. Some of the areas that can be reviewed during an onsite security assessment include the following:

• Access controls

• Backups

• Business continuity (disaster recovery, communications, resumption)

• Compliance

• Electronic commerce

• Encryption

• Intrusion detection and prevention (reporting events, event management)

• Logging and monitoring systems

• Malicious code

• Media handling

• Mobile devices (laptops, tablets, smart phones)

• Network management

• Network operations documentation

• Patch management

• Physical security (data centers, server rooms, wiring closets, mobile devices)

• Policies and procedures

• Security training

• Storage systems

• System planning and acceptance

• Systems development and maintenance

• Thin clients

• Third-party service providers (consultants, vendors, cloud service providers)

• Transmitting information

• Virtualization

• Wireless networks

Balancing the Team’s Access and Risks

Information security is a broad field, providing an information security consultant the opportunity to perform a wide variety of duties. Information security consultants may review network security configurations, inform clients about recommended security best practices, perform security audits, assess service providers, and provide other similar services. Instead of providing every type of service, some information security consultants find that by specializing in a niche area, they become a well known knowledgeable resource.

Physical security and information security go hand in hand. Without physical security, information systems and the data stored on those systems cannot be secure. In many cases, I partner with a physical security consultant when working on a client project. After all, they know physical security backward and forward, and by partnering together, our team can give the clients better value for their money.

Information security consultants can help organizations balance access to information against the risks associated with providing that information. A formal and top-down approach to risk management ensures that security is properly aligned with the needs of the organization and controls are directly proportional to the importance of the asset.

Chapter 14

Forensic Consulting

The word forensic is defined in the American Heritage Dictionary as “pertaining to or employed in legal proceedings or argumentation.” Forensic consulting, therefore, involves the consultant’s services in cases of litigation. Whereas management consulting entails a proactive (beforehand) assessment of security needs in which the consultant reports to the senior management of an enterprise, forensic consulting is the reactive (after the fact) assessment of security issues as a service to a law firm representing either management (the defendant) or the complainant (the plaintiff).

Security forensic consultants assist in litigation that addresses the issue of alleged security negligence or claims of security misconduct, such as false arrest or excessive use of force. This assistance is the expert assessment of the merits of the lawsuit.

The Need for Security Consultants in Legal Cases

Lawsuits that revolve around security issues fall into two categories:

1. Third-party crimes. For example, a visitor (first party) comes to a local hospital (second party), and while walking back to her automobile in the hospital’s parking lot, she is abducted and sexually assaulted by a stranger (third party). The victim files a civil lawsuit against the hospital, claiming the security program was negligent. This kind of lawsuit addresses several questions: Was the security program adequate or inadequate? Was the hospital careless or negligent in its duty to make parking in the lot reasonably safe for visitors? Did the hospital have a duty to make the lot safe?

This kind of civil litigation has the following component parts:

• Was the incident foreseeable?

• Was there a duty to provide security?

• Was there a breach of that duty?

• If there was a breach, was this breach the proximate cause of the injury?

• As a result of the injury, was the person damaged (injured)?

The foreseeability of an event is what establishes a duty. And foreseeability or predictability is based on historical experience as well as what a reasonable person could expect in a given set of circumstances—that is, even if a new hospital is being constructed (hence, there is no onsite history of crime), we can reasonably predict that unless a certain level of security is provided in the parking lots at that facility—such as lighting, security patrols, or closed-circuit television monitoring—someone will be assaulted.

2. Torts involving alleged negligence as committed (or omitted) by the defendant. For example, a retail security agent arrests a person for shoplifting when in fact no theft was committed. The customer is subsequently released in exchange for a written admission of guilt. Depending on state law, the conduct of the agent may be challenged. Several questions may arise: Was the stopping of the customer proper, and was the obtaining of a written admission extortionate? Was the agent adequately trained? Were the arrest procedures and policies of the agent’s employer in keeping with the law as well as custom and practice in the industry?

Questions of civil liability and negligence are concerns of the legal profession. Although most security consultants are not attorneys, they must confront issues and problems such as these when dealing in the forensic field. The security consultant simply makes an assessment of all the known facts surrounding the incident in question and forms an opinion as to the adequacy or inadequacy of security or the proper or improper conduct of the security employee. Legal professionals seek advice from the security expert.

True experts know their limitations. As an example, a San Francisco law firm contacted me to ask if I could review the security program of an airline carrier. A disgruntled former airline employee had breached the program by shooting the pilot and copilot of an in-flight aircraft, causing the crash of the plane and the death of all aboard. Although security principles generally apply from industry to industry, this case was beyond my expertise, so I referred the law firm to another consultant who I knew had airline company experience and credentials specific to this case.

Consultants who accept forensic work should not approach the assignment as an advocate. Advocacy is the role for the attorney, not the professional consultant whose role is to objectively review the facts and express an opinion regarding the merits of the case, no matter who retained her or his services. Numerous times during my career was I obliged to advise my “client” (the attorney who retained me) that his or her position was not meritorious in my opinion—that is, I could not agree with or support the attorney’s theory of liability or theory of defense.

Regrettably, some consultants and so-called expert witnesses have earned the reputation of being guns for hire. These consultants will make a case to support the position represented by the law firm that retained them. Some law firms do want an expert to act as an advocate, but most want an objective opinion for guidance in their own assessment of the case. I will not assist a firm that seeks an advocate expert.

Granted, the security consultant who is retained by a plaintiff law firm to critique the program of a major firm’s security department risks, in some cases, the ire of the security chief, in-house counsel, or senior management. On the other hand, I have heard of security department directors who have privately agreed with the basis of the lawsuit, saying they knew the security program was inadequate and had requested the resources to correct it, but senior management ignored their advice and recommendations, and I suspect harbored some secret pleasure in the thumping they ended up taking in the lawsuit.

Ironically, the security industry can benefit when a significant award goes against a corporation in this type of situation. A large settlement often awakens the need to reassess the security and loss-prevention role in the corporate organization. Security negligence, as in the example of the hospital lawsuit, raises additional questions for the legal profession:

1. Did the hospital have a duty of care, a duty to protect the visitor from strangers attacking her?

2. Was the attack foreseeable (i.e., was there a history of criminal acts in the parking lots)?

3. Was management of the hospital aware of the risks to visitors in the parking lot? If not, should officials have been aware?

4. What reasonable steps did management actually take to reduce the possibility of attacks occurring in the parking lot?

The security consultant reviewing the facts in connection with this hospital case would be asked for an opinion about some if not all of these questions.

The Process of Forensic Consulting

Forensic consulting follows a rather prescribed process that typically unfolds as follows:

• The consultant is queried about whether or not he or she has the expertise and is available.

• The consultant is asked if there’s any possible conflict of interests.

• The consultant either declines or agrees to proceed.

• The consultant reviews the materials.

• The consultant reaches an opinion.

• The consultant is deposed.

• The consultant testifies at trial.

Let us review each of these components to gain insight into what each step entails.

The Consultant Is Queried about Expertise, Availability, and Possible Conflicts of Interest

The most common query comes by telephone. An attorney will call and identify the firm as representing one side or another in a lawsuit. If the consultant engages in forensic work, the attorney may identify the case style or caption—for example, John Doe v. National Oil—to determine whether there is any conflict of interest. Examples of conflict might be (1) you have already been retained by the opposite side, (2) you serve or have served as a consultant to National Oil, (3) your brother is John Doe, or (4) for any other reason you cannot or would not involve yourself in that lawsuit.

The attorney then asks if you have expertise and interest in gasoline company service stations, because the case at hand involves the robbery and shooting to death of an employee of a station leased by National Oil Company. The attorney represents the decedent’s surviving wife and family. If you feel qualified for this kind of security case and agree to have the attorney give a brief scenario, the attorney proceeds.

The attorney tells you that the theory of liability in this suit is that National Oil mandates that all leased stations must be open twenty-four hours a day, even those stations in the inner city, areas considered dangerous during night and early morning hours. Yet National Oil failed to provide promised security equipment such as cameras, bullet-resistant glass, and pass-through cashier drawers. Meanwhile, the employee was shot and killed by robbers at 3 a.m. The attorney sees National Oil’s failure to provide the equipment as negligence and sees such negligence as the proximate cause of the crime (directly related to the cause of the robbery and shooting).

Irrespective of the kind of plaintiff case the attorney has, I typically ask what the attorney’s theory of liability is (e.g., the security officer was inadequately trained, used excessive force, falsified documents, was not really on the job but was across the street in a bar drinking beer, etc.). Some theories of liability appear to be appropriate in relationship to the factual scenario, while others may lack merit.

If the attorney represents the defendant, I usually ask what the theory of defense is, as the attorney sees it (e.g.,, the attack in the parking lot was an unforeseeable event, the plaintiff was careless and placed herself in the way of harm, or the alleged security failure was not the proximate cause of the attack and injury). Some theories, again, appear reasonable and others lack merit depending, of course, on the brief factual scenario as described by the lawyer. And remember, the lawyer is obviously an advocate for his or her case.

The consultant must recognize that the so-called factual scenario does not represent all the facts of the lawsuit and that no opinions can possibly be formed at this juncture, but it should provide enough insight into the matter to enable the consultant to decline involvement or agree to review the facts.

Those just entering this field of forensic consulting should be aware of a growing belief or practice on the part of some attorneys of deliberately calling qualified consultants, discussing the case under the ruse of seriously considering them for retention, only to attempt to disqualify or “neutralize” each one on the basis that the consultant discussed the case with the attorney and therefore it would be improper for the consultant to accept the assignment for the opposing side. I personally view this practice as unethical. The very thought that an officer of the court (an attorney admitted to the bar) would intentionally contaminate available experts so his or her opponent would be denied such resources as well as create a condition that effectively denies consultants their livelihood is wrong. Don’t be trapped or inhibited by this practice.

On the other hand, the practice of an attorney actually retaining more than one consultant, especially those who are deemed top-drawer experts, is viewed as an acceptable (but expensive) practice.

The Consultant Either Declines or Agrees to Proceed

Now is decision time. The consultant either declines involvement or indicates an interest in assisting. Declining involvement usually occurs because of actual or perceived conflicts of interest, lack of the required expertise, a gut instinct that the matter lacks merit (in the consultant’s own private and professional view, albeit she or he has limited information to go on), not liking the sound of the attorney, or time constraints that preclude the consultant’s involvement. It’s not uncommon for law firms to delay incurring the cost of experts until late in the game, and then there’s a scramble to find a qualified expert who has time to undertake the task immediately. Fortunately, not all lawyers are so disposed.

If the consultant expresses an interest in the case—that is, becomes a viable candidate for consideration as the attorney’s consultant—there invariably is a discussion about fees and the attorney’s interest in obtaining a copy of the consultant’s fee schedule (Figure 14.1) and curriculum vitae, commonly referred to as a CV, which is like a résumé (Figure 14.2). The fee schedule and CV are usually mailed, faxed, or sent as an e-mail attachment to the attorney’s office at that time.

Figure 14.1   Example of a forensic consultant’s agreement.

Figure 14.2   Sample CV.

The decision to proceed now rests with the attorney—to retain or not to retain. That decision is usually based on such factors as the consultant’s reputation and fees, location of the court as compared with where the consultant resides, and probably, to some degree, what impression the consultant makes on the attorney during the phone conversation.

Most consultants require a retainer fee along with a letter confirming the retention. The retainer is nonrefundable, and represents either a flat fee or, as in my case, five hours of work.

Now surfaces a particularly thorny problem that we consultants have little control over, and that is the issue of a given consultant being declared an expert witness by an attorney with whom you’ve telephonically discussed a case and indicated your willingness to assist, yet you have not been retained! Put another way, the attorney claims you as his or her expert in documents submitted to the court, uses your CV to spell out your qualifications to serve as an expert, and states in that declaration that you will be willing to testify to a variety of opinions and even articulates specific opinions—and you aren’t even aware this has occurred. No matter how you slice it, this is a misrepresentation made to the court and to the opposing counsel. And this is becoming a growing problem. To add injury to insult, consultants are not even compensated for the use of their “intellectual property” when it clearly is a designed strategy to flex the muscles of the attorney’s case, as well as enhance the possibility of a settlement.

This is not to suggest that the majority of law firms engage in this practice. Clearly they don’t. But those of us who are active in forensic consulting see it growing at an alarming rate. One consultant (not in the security discipline) established that he had been declared as an expert without his knowledge and permission and without compensation more than 1,000 times and filed a lawsuit against a number of firms for that practice.

In an effort to combat this practice, some enlightened consultants have adopted the practice of sending a follow-up letter to each attorney with whom they’ve talked and sent a CV stating, in essence:

Thirty days have passed since our discussion and I’ve not heard from you; hence, I assume you’ve elected to retain another consultant or have resolved the matter. Therefore, it is understood we do not have a business relationship and I am free to accept inquiries by and/or engagements with any other parties regarding this matter.

It’s amazing how many retainer checks that generates.

Another strategy consultants follow upon learning they have been declared as an expert is simply to invoice for the retainer amount.

The Consultant Reviews the Materials

Any time from a matter of days to one year later, depending on the urgency of the matter, the consultant will receive materials from the attorney (which usually include a cover letter listing what has been transmitted for the review) along with the agreed on retainer. I request the following materials:

• The police report of the incident in question

• The plaintiff’s complaint and the defense’s answer to that complaint

• Interrogatories and responses of both parties

• Requests for production of documents from both sides and the responses received

• The depositions that pertain to the issue of liability (as opposed to damages)

• Any criminal court proceedings and testimony, if appropriate and available

I recommend numbering each document and logging the documents on the front page of a tablet in which the notes of the review will be recorded (Figure 14.3). I then paginate the tablet, so that the table of contents allows me to easily reference a given document.

Figure 14.3   Notepad table of contents listing review notes taken on each document. A, Attorney’s name and phone number. B, “Style” or caption of lawsuit. C, Date of incident. D, Document I.D. number. E, Page number.

The documents provided by counsel do not constitute the only material that the consultant must review and digest. Other important supplemental material, such as crime statistics and a history of crime on the premises (typically in the form of computerized police department “calls for service”), may be gathered and made a part of the file. Indeed, I refer the reader to Appendix E, The IAPSC’s “Best Practice #2: Forensic Methodology,” for additional guidance in this kind of consultant’s project.

The review requires the extraction of salient information and key points that are memorialized as the consultant’s notes (typically on a yellow lined tablet that can be reviewed as a refresher prior to a meeting with attorneys or the presentation of testimony in court (Figure 14.4). Invariably, as the review progresses, certain questions will be raised or further discovery or research required, and these needs may be noted in the margin, as reflected in Figure 14.4.

Figure 14.4   Sample page of review notes, with questions in the margin. A, Document reviewed. B, Questions that need answers. C, Notes on document. D, Page number of notes.

The Consultant Reaches an Opinion

The review is the process whereby the expert can formulate an opinion as to the conditions of the case. If the expert has been retained by the law firm representing the plaintiff, the task is to determine, in the consultant’s opinion, whether the case is meritorious. The expert is sought for the purpose of rendering an opinion, and if it favors the attorney’s position, then that opinion is offered in the form of an affidavit or sworn testimony.

It should be noted that only recognized “experts” are allowed to express opinions in our judicial system. All other witnesses are restricted to factual testimony. If the expert’s opinion is unfavorable, however, chances are rare indeed that she or he ever will testify.

The consultant may not need to review all the material provided to reach an opinion. I recall one case in which I had been retained to review a plaintiff action against a retailer for false arrest and imprisonment. I had assisted the same firm in a similar case some years earlier, and the plaintiff had prevailed. Midway through this new assignment, I called the attorney and advised him of the materials I had reviewed and what remained. I then asked if he could direct me to a specific document in the yet unread materials that might throw a different light on the case, because I found no fault in the retailer’s conduct. I also advised him there was no point in my continuing with the review and incurring expenses if there were no new facts that addressed the issue of probable cause for the arrest. That concluded my work! As disappointed as he was, he now had an authoritative analysis of his case that suggested it lacked merit. He was then obliged to proceed with the prosecution of his case without an expert witness (and some attorneys do that), find another consultant/expert who supported his theory, or drop the lawsuit. I’ve seen all three options exercised.

My experience is that the consultant reaches an opinion at some point prior to the completion of the assessment in its totality, and all work performed beyond that point tends to enhance or buttress the opinion.

You form this opinion through site inspection—a visit to and inspection of the premises—if the nature of the litigation warrants this. To view the configuration of a parking lot, its relationship to the facility it serves, and the types of lighting, landscaping, perimeter, and access devices brings into focus the scene of the problem. Once you reach an opinion (assuming for this example that the case is meritorious), that position usually is conveyed during a phone conversation with the attorney.

The fact that an expert has been retained must be disclosed to the opposing side, and the opposition is entitled to know the expert’s position prior to trial. In some states the opposition is entitled to the expert’s opinion in writing prior to the consultant’s taking of his or her testimony in a deposition. In other states the opinion surfaces in the deposition only.

A word is necessary about the need to resist attorneys who attempt to formulate or otherwise influence the consultant’s opinion. Certainly most attorneys are not guilty of this form of manipulation, but some are. Beware of the possibility.

In the first two editions of this book, at this point in this chapter I proceeded on with the process of the deposition and deposition testimony. With the passage of time, new legal considerations have arisen that should be considered before we get into testimony. One is the Federal Rules of Civil Procedure and the other is the Daubert Rule. They are as follows.

The Federal Rules of Civil Procedure

The Federal Rules of Civil Procedure, a portion of Rule 26 (General Provisions Governing Discovery, [2] Disclosure of Expert Testimony)

Rule 26 (a)(2): Except as otherwise stipulated or directed by the court, this disclosure shall, with respect to a witness who is retained or specially employed to provide expert testimony in the case or whose duties as an employee of the party regularly involve giving expert testimony, be accompanied by a written report prepared and signed by the witness. The report shall contain a complete statement of all opinions to be expressed and the basis and reasons therefore; the data or other information considered by the witness in forming the opinions; the qualifications of the witness, including a list of all publications authored by the witness within the preceding ten years; the compensation to be paid for the study and testimony; and a listing of any other cases in which the witness has testified as an expert at trial or by deposition within the preceding four years.

Following are some pertinent portions of an actual report with commentaries, submitted by security consultant John Christman in compliance with this Federal Rule 26:

Ronald XXXXXX, Plaintiff vs. Rotoxxxxxx Company, Defendant

File No. C-02–02643 PVT

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

IN SAN JOSE

Report by John H. Christman, CPP

Submitted pursuant to Federal Rule of Civil Procedure 26(a)(2)

June 10, 2xxx

“My report will consist of eight sections, namely:

I. Factual Background, II. Introduction, III. Professional Qualifications, IV. Compensation, V. Prior Expert Witness Testimony, VI. Materials Reviewed, VII. Discussion, and VIII. Opinions.

Under Introduction: I describe my retention, by whom, dates, and assignment.

Under Qualifications I include: A copy of both my Curriculum Vitae and a list of published writings are included herewith under Attachments.

Under PRIOR EXPERT WITNESS TESTIMONY I include: I have given expert testimony (both direct and by Declaration) twenty eight times in both state and federal courts. See attachments for listing of cases and venues.

I have been deposed approximately forty plus times as a security expert; a list of these cases is also included under Attachments.

Under DISCUSSION: I discuss pertinent issues in the case.

The Daubert Rule

The U.S. Supreme Court in Daubert v. Merrell Dow Pharmaceuticals Inc., 509 U.S. 579 (1993) and Kumho Tire Co. v. Carmichael, 526 U.S. 137 (1999) charged district court judges with the responsibility of acting as gatekeepers to exclude unreliable expert testimony in all fields of expert testimony. Typically, a witness qualified as an expert by knowledge, skill, experience, training, or education may testify in the form of an opinion provided that (1) the testimony is based on sufficient facts or data, (2) the testimony is the product of reliable principles and methods, and (3) the witness has applied the principles and methods reliably to the facts of the case.

The intention of these rulings was to eliminate “junk science.” U.S. District Courts, and many state courts that use similar rules, exclude experts who are not operating in litigation in the same way that they would operate in nonlitigation engagements. Experts are not “hired guns” willing to testify in any manner that benefits their client. The purpose of experts is to assist jurors in understanding a field for which they are not expected to have sufficient knowledge to render a finding. Therefore, an expert’s testimony must be properly grounded, well reasoned, and not speculative before it can be admitted. The more subjective and controversial the expert’s inquiry, the more likely the testimony will be excluded as unreliable.

The method used to exclude an expert’s testimony, in whole or in part, is a motion by a party (known as a Daubert challenge) to strike that testimony so the jury does not hear it. This requires the trial judge to hold a hearing with attorneys representing the parties presenting arguments as to why this expert should or should not be allowed to testify at trial. Occasionally the expert in question is allowed (or required) to testify at the hearing, but more often the expert simply provides information to the attorney to be used at the hearing.

Daubert challenges have increased dramatically in federal courts and in state courts that have adopted the Daubert ruling. Between 2000 and 2010 there was a 350 percent increase in these challenges, and approximately 49 percent of the challenges were successful in whole or in part. That means that in almost half of the challenges, the expert or the attorney who hired that expert could not demonstrate that testimony was worthy of being presented to the jury. Having testimony struck can be damaging to the expert’s reputation because the Daubert challenge goes to the very heart of the methodology the expert uses and not to the actual conclusions reached.

The International Association of Professional Security Consultants has provided experts in the field of security with a methodology that meets these criteria in the form of “best practices.” It can be located at www.iapsc.org as well as in Appendix F in this text.

The Consultant Is Deposed

A deposition is the oral examination of a witness, under oath, by the opposing attorney(s). The objective of an examination of an expert witness is to explore the expert’s credentials and discover the expert’s opinions prior to trial. The testimony is recorded by a court reporter and, although the setting seems somewhat casual, the results bear the same weight as they would if the proceedings were held in an actual court of law.

Videotaped depositions are increasingly used to supplement the official typed transcript of the testimony. Subsequent viewing of the videotape allows the opposition to critique the witness’s appearance and communication skills as well as to determine how the witness will come across in trial.

Although the objective of the deposition is to examine the witness, the occasion affords the witness an opportunity to assess the competency and personality of the examining attorney. Some attorneys approach the process with a professional and objective air and proceed smoothly in discovering the information they need to do their job. Others may be unpleasant, officious, or on the edge of being abusive.

You run the risk of being examined by an attorney who views you as an adversary. Some take advantage of the deposition to intimidate witnesses, hence stretching the bounds of propriety outside the view of the judge and jury. These counselors tend to be more judicious in the presence of a jury for fear of alienating them. Jurors demand fair play.

Whatever the style, tack, or method of the attorney’s interrogation, the expert witness should rise to the level of professionalism but never stoop to anything less. Be pleasant and courteous at all times and under all circumstances. Be succinct but complete in your answers. Needless to say, be impeccably honest and truthful in every answer.

Do not volunteer information. Just answer each question—nothing more or less.

Whatever notes or files you bring into the deposition, the examining attorney is entitled to examine and make copies of them. I welcome that scrutiny, because it tends to reflect the thoroughness and quality of my work.

The opposing law firm usually is obliged to pay for your time and expenses in connection with the deposition. Require your fee and expenses prior to testifying, to avoid a possible collection problem later.

Subsequent to your deposition, you will receive the transcript for your review, correction, and signature. If your answers require any change or correction, by all means do so, but bear in mind those changes may be focused on during your examination before the jury and you will need to explain the reason for the change.

Deposition transcripts, sometimes taken years prior in other cases, are examined by attorneys looking for positions previously taken by an expert that could be used to impeach his or her testimony in current litigation. Some experts have taken one position while assisting in a plaintiff action, such as “lighting is important in deterring criminal activity at night,” and years later have testified that lighting was not important as a deterrent. Obviously, the consultant must be consistent in related positions and recognize that the deposition transcript is a permanent record.

The Consultant Testifies at Trial

I trust and respect the U.S. judicial system. Jurors arrive at their decisions based on the facts presented by both sides. Surely the manner of presentation has some impact, but the facts ultimately tend to speak for themselves. The facts may be put into a better perspective by the testimony of an expert. It is an absolute privilege to be allowed to express an opinion under oath from the witness stand to help the jury in its awesome task of sifting through all the evidence to find the facts and to understand the truth.

That privilege must never be abused by shoddy pretrial preparation or by appearing before the court poorly groomed. We represent the entire security industry, not the defendant or the plaintiff. We are allowed to speak from the box as an exception to the rule, an allowance well thought through because of the need for professional opinion testimony. That makes us a vital component of the judicial process. When you take the stand speak evenly, clearly, and loud enough so all can hear without strain. Answer the questions from both sides with sincerity.

If you have made it to the witness stand as an expert witness, you have come a long way in our industry. As a forensic consultant, you assist the court and jury in their efforts to arrive at a fair judgment, and you bring respect to our industry in general and forensic consulting in particular.

Examples of the Types of Cases That Can Involve Security Consultants

Case 1

Two security officers murder a young man and rape and attempt to murder his girlfriend at a remote telecommunication site. The plaintiff’s theory of liability is that the officers were negligently hired and negligently supervised.

I was retained by plaintiff’s counsel. I determined there were three security officers assigned to the site, each working an eight-hour shift. The sergeant worked 8 a.m. to 4 p.m. The other two officers worked the swing and graveyard shifts. The sergeant never made site inspections to see what the other two were doing. The control point, as such, was a security operations desk at the main facility many miles away, and the night shift officers were required to phone that desk periodically to ensure they were on the job. Examination of all records disclosed security management’s only site visits were during the day shift. No one ever checked the site after normal working hours. The two younger night shift officers soon realized they could do what they wanted as long as they called the desk from time to time.

On the night in question the swing officer, instead of going home as required, stayed over to visit, drink beer, and smoke marijuana with his relief officer and friend. They drove around the extensive site and connecting roadways and happened on a parked car with two teenage lovers. They killed the boy with a knife and pushed him over a cliff. They then raped, sodomized, and stabbed the girl numerous times and threw her over the cliff, believing she was dead. She survived and crawled to the road just as the sun was coming up and just as the two officers drove by again. They repeatedly stabbed her again, and again threw her over the edge. The girl again survived and crawled to the road, this time to be discovered by a regular day-shift employee.

Aside from the issue of a poor background investigation (but not necessarily a “negligent” one, as I recall), the control and supervision of these two young officers was negligent, in my opinion.

Case 2

In this premises liability matter, a young woman was abducted from a grocery store parking lot, in broad daylight, as she was entering her car. She was taken to a number of locations including a motel where she was ultimately raped, stabbed, and left for dead. The plaintiff’s theory of liability was that the store provided an inadequate level of security and hence was negligent.

I was retained by the law firm defending the grocery company. After reviewing the history of incidents on the premises, the history of crime in that part of the community, the number of customers, the store’s policy of requiring uniformed employees to assist all customers out to their autos with their groceries, the security officers’ assignment schedule, and the testimony and statements of the two abductors as to the brief periods of time they had been in that parking lot prior to their spontaneous decision to abduct the young woman, I concluded the store was not negligent nor was the store responsible for this terrible crime.

Interestingly, the security expert for the plaintiff was of the opinion there should have been a security officer assigned to that lot. I, for one, would never have recommended an officer be assigned to that lot during morning and afternoon hours.

Case 3

In this premises liability case, a young mother was abducted from in front of a grocery store at night and that store was located in a strip center. The woman had parked directly in front of the store for the purpose of renting a carpet shampooer. A box boy carried the shampooer to the rear of her car and wanted to place it in her trunk. She told him she would do it and busied herself with putting her two little children in the car. As she was so engaged a man approached her, put an object in her side, and told her to get in the car from the passenger side. Out of fear for her children she complied. He followed her in, closing the door. She was instructed to back out, running over the shampooer. A witness honked her horn continually to catch the victim’s attention, in an attempt to avert the destruction of the machine, and the witness had no idea an abduction was occurring. The lot was relatively active, and the location of the car in question was well illuminated. She was forced to drive to a remote location and was raped in front of her children. The victim’s attorney retained me to evaluate the security that was provided. The theory of liability was that the store personnel should have reacted to all the honking of the horn and that the shopping center security officer was not doing his job.

After reviewing all available data and personally inspecting the property, I determined that the security officer was indeed doing his patrols, those patrols were properly being recorded per the post orders by an electronic patrol supervisory system, and indeed that very security officer within minutes prior to the abduction was leaning down talking to two deputy sheriffs in their patrol vehicle there in the center. I further decided that even if an employee had come out of the store to see why someone was honking, that person wouldn’t have understood the dynamics of the event and would not nor could not intervene. As a result, I informed my client that I felt there was no negligence and would be unable to serve as the attorney’s expert witness. My client was disappointed, to say the least, but was undaunted and went out and retained another consultant in hopes of finding one that would be supportive of the client’s theory.

As these three brief scenarios suggest, this is fascinating and challenging work, and in some of these matters, literally millions of dollars are at stake. I would like to conclude by saying, in view of that reality, that only the qualified and talented need apply. Regrettably, I can’t.

Chapter 15

Liability and Insurance Considerations

Norman D. Bates Esq.

Professional Liability

When you enter the marketplace as a security consultant or security expert, you will face a number of potential issues that could lead to a claim against you and your company for malpractice. Professional liability for the security consultant or expert witness can arise in a number of ways. Commonly, a security consultant undertakes a project to evaluate a security program or security system and then generates a report containing recommendations for the purpose of improving that program or security system. Should the consultant fail to identify an obvious weakness in the client’s security program, and as a result of that failure a criminal incident occurs, then the client could claim negligence on the part of the consultant, leading to a civil lawsuit.

Example 1

A security systems consultant designs a new alarm system for a client, and that system fails as a result of a poor design. Intruders are able to enter a facility undetected, stealing thousands of dollars worth of merchandise. The client would potentially have a claim for that loss because of the defective design.

Example 2

A security management consultant conducts an assessment of the client’s security program but fails to recognize some obvious risks to the client’s business (e.g., late-night robbery). The consultant does not offer recommendations to the client on how to handle such risks, and as a result, a preventable robbery occurs during which someone is injured. The injured party could potentially sue both the client and the consultant, again for negligence.

Example 3

A security expert is retained by a plaintiff’s attorney to evaluate a negligent security case and provide testimony at trial about the risks of crime at the subject property, as well as the deficiencies in the security program. However, the expert fails to follow the accepted methodology for security experts (e.g., see the Forensic Methodology, Best Practice #2, of the International Association of Professional Security Consultants), fails to get actual police incident reports of prior crimes at the subject site, and only uses uniform crime report (UCR) data from the government’s Unified Crime Reports (UCR) to show that the crime in the case was foreseeable. At the time of trial, the expert’s data is deemed unreliable evidence and the court dismisses the case.

The plaintiff has lost the case without having the jury decide the outcome. The expert has an exposure to liability for professional malpractice (i.e., negligence). Although in the past expert witnesses enjoyed some level of immunity from such claims, in recent years more and more states have eliminated those provisions.

Insurance Considerations

Good business practice dictates that professional consultants of all types would be wise to maintain the appropriate amounts and types of insurance to protect them and their clients during the course of their work. Even the sole practitioner will have substantial risk exposures that could wipe out the consulting practice with one lawsuit, even if the consultant prevails at trial. Many professionals do not consider the fact that most business insurance policies provide for the cost of legal defense and lawyers are not inexpensive.

Types of Insurance Coverage

General Liability Insurance

The first type of coverage that the practitioner should consider is general liability insurance. These policies are usually fairly comprehensive and provide a variety of coverage, including fire and theft, business interruption, relocation expenses, and injuries arising from visitors falling on the premises. The cost of general liability insurance used to be fairly reasonable (e.g., for a small firm it may have cost about $900 per year); however, since September 11, 2001, security consultants are perceived as a bigger risk for insurance carriers. However, these policies do not cover claims for malpractice by the consultant (a topic to be covered in this section), which is where the major risk exposure exists.

Workers’ Compensation Insurance

If the practitioner employs other individuals to assist in the work, workers’ compensation insurance may be required by the state where the office is located. The cost of this type of insurance is usually based on the size of the payroll, excluding the principal’s income. For a small firm of approximately six employees, the cost can run several hundred dollars per year with upward adjustments for previous and outstanding claims.

Professional Malpractice Insurance

Most security consultants will discover quickly that they will not be able to even bid for a consulting job of any sizable scope unless they carry professional malpractice insurance. This type of coverage is designed to protect the consultant in the event that something is overlooked or bad advice is given and the client has been harmed as a result. Commonly referred to as errors and omissions insurance, if the consultant fails to perform the work diligently and, as a consequence, a preventable incident that results in a loss or injury occurs, then the consultant may be sued for malpractice. The theory of liability is based in the civil tort of negligence that, simply stated, creates liability when the professional consultant failed to act reasonably and in accordance with good and accepted practices of the profession and that, as a consequence, an injury or loss occurred.

“Going Bare”

“Going bare” is an expression that simply means one is operating his or her business without insurance coverage in one or more areas a discussed previously. Not carrying insurance can lead to a number of major problems, including significant financial exposure that one faces in the event a lawsuit is filed, the cost of legal defense, and a nonfinancial consideration that prospective clients frequently require consultants to carry an appropriate amount of coverage. For those practitioners with employees, most states will require, as a matter of law, that the business provide workers’ compensation insurance.

How Much Insurance Should You Carry?

The answer to this question depends partly on the type of insurance purchased. For example, the amount of coverage a business needs for workers’ compensation is set by state law. For other types of coverage, the amount of insurance will be somewhat affected by the ability of the business owner to pay the premiums, as well as the reality of what amount of insurance is needed to cover a claim. Insurance agents will be helpful in determining the minimum amount. Further, it is common for client to require a minimum of $500,000 to $1,000,000 in coverage.

Following the events of September 11, security consultants and other professionals in the security industry saw their premiums skyrocket. For example, professional liability insurance has increased as much as two to four times in one year, if the coverage is even available. Some major insurance carriers have refused to write policies because they see the risk as being too great at this time.

The cost of the insurance will vary depending on the consultant’s level of experience, the amount of business conducted (in dollars per year), and the size of the deductible. The consultant should obtain prices on insurance policies with different deductible amounts. The amount of insurance purchased should be sufficient to prevent the business from being devastated financially. A deductible will reduce the amount of the premiums yet should not be so high as to cause undue hardship to the business if that first amount has to be paid in a claim before insurance contributes.

Use of Contract Clauses

There are a number of different contract clauses that security consultants can use in the course of their work. It is a common practice for organizations of any size to use contracts with vendors, whether they provide services or goods. The following are examples of clauses that may be used in an agreement to conduct a security assessment of a facility.

Project Objectives

This does not guarantee that crime and corresponding premises security liability will be eliminated at the property reviewed.

The purpose of this clause is to make it clear that the assessment is not going to prevent all crimes or liability claims, and it also acts as a disclaimer for the consultant. Remember that one of the many purposes of a contract is to clarify the role of the respective parties.

Standard Indemnification

[The client] shall indemnify and hold harmless XYZ, Inc. [the consultant] and its employees from any and all property damage or loss, claims, liability, damages, expenses (including, without limitation, attorney’s fees and expenses), and any other amounts arising out of any losses or criminal events occurring on or about the client’s property subsequent to the work that is being performed pursuant to this agreement.

The purpose of an indemnification agreement is to shift the financial risk of loss to the client. This will not eliminate the risk that the consultant will be sued, but in the event of a judgment against the client or the consultant, the latter would be covered financially for the loss. One argument in favor of the use of this clause is that it allows the consultant to find the most cost-effective, not the most conservative, solutions for the client without the fear of being sued.

Indemnification agreements are not, however, a substitute for insurance coverage. The consultant still has an exposure to civil suits and the costs associated with their defense.

Insurance Coverage

XYZ, Inc., will provide the applicable workers’ compensation in accordance with required amounts under [your state] law and general liability and professional liability coverage for its staff while working at the client’s site.

This contract clause informs the client that the consultant will provide all necessary and appropriate insurance coverage while performing the work for the client. It also tells clients that they are dealing with a professional consultant.

Confidentiality Agreement—Between Client and Consultant

Upon execution of this agreement, all recommendations and identified deficiencies (oral and written) communicated to representatives of [the client] by XYZ, Inc. [the consultant] in the course of the services outlined in this agreement will remain confidential. All information discovered in connection with the services to be provided hereunder will be held in confidence and not discussed, communicated, or transmitted to others.

A confidentiality agreement between the consultant and the client is important to protect the client’s proprietary information. It also provides some level of comfort to the client that the critical information (e.g., weaknesses in their security program) will not be revealed to others.

Confidentiality Agreement—Between Consultant and Employees of Consultant

As an employee of XYZ, Inc., the undersigned acknowledges that from time to time s/he will receive confidential and proprietary information concerning the business of XYZ, Inc. The undersigned further acknowledges that such information, if shared directly or indirectly with third parties, could be detrimental to XYZ, Inc., because it would place XYZ, Inc., at a competitive disadvantage if disclosed, and that but for her/his employment at XYZ, Inc., s/he would not receive such information, as it is not available to the public.

Accordingly, the undersigned agrees that so long as s/he is an employee and, thereafter, except as necessary to conduct business, s/he shall not disclose, copy, communicate, or divulge to, or use for the direct or indirect benefit of any person, firm, association, or company other than XYZ, Inc., any material provided by XYZ, Inc., including but not limited to business methods, business policies, procedures, techniques, research or development projects or results, trade secrets, or other knowledge or processes of or developed by XYZ, Inc., or any other confidential information relating to or dealing with the business operations or activities of XYZ, Inc., made known to the undersigned or learned or acquired by the undersigned while an employee of XYZ, Inc.

The undersigned further agrees to indemnify XYZ, Inc., from any and all causes of actions or damages, including all costs and attorney’s fees that may be directly or indirectly caused or incurred by her/his breach of this agreement. This agreement is governed by the laws of the State of _________________________, and suit to enforce any part of this agreement must be brought in a court of competent jurisdiction in ______________________ County, [state].

It is helpful to use a confidentiality agreement whenever the consultant employs individuals, whether on a temporary or permanent basis, to work on consulting projects. The agreement ensures that, first, the employee will not divulge the client’s proprietary information and, second, that the employee will not go to work for a competitor of the consultant’s and use proprietary information of the consulting firm such as the consultant’s work methods, client lists, financial data, and so forth.

Retainer Fees

An initial nonrefundable retainer of $X,XXX is to be paid before any work will commence. This retainer is for labor only, excluding expenses.

In both nonlitigation and litigation-related consulting work, it is useful to state initially that the consultant requires a retainer fee before any work is to commence. This protects the consultant against the unethical behavior of others who may have the consultant perform some initial tasks without compensation.

Travel Time and Related Expenses

Travel is billed at $XXX/hour. For locations requiring air travel, air travel time will be charged at one-half the regular hourly fee. All reasonable and related expenses are to be paid for by the law firm, including lodging, meals, and costs of travel. Airfare is based on full coach (refundable) ticket price. All travel expenses are to be paid in advance.

Again, one of the purposes of a written contract is to convey the intentions and requirements of the parties to the agreement. Given that most consultants operate as small businesses, receiving advance payments for travel can help the consultant avoid serious cash flow problems.

Interim Billings

The firm will be billed monthly after the initial retainer is exhausted. Invoices are due upon receipt, and interest in the amount of 1.5% per month will be added to all accounts 30 days or more past due. All accounts must be current before any testimony, either at deposition or trial, will be provided. If collection becomes necessary on overdue accounts, the client will be responsible for all reasonable legal fees and court costs.

Every business, especially small consulting firms, survives or fails based on the equality of the business’s cash flow. Simply stated, this means how quickly clients pay their bills. No consultants would be in business for very long if the work performed in the current month was not compensated for several months. In fact, most small businesses fail within the first five years because of cash flow/income problems.

Further, if a consultant is not paid in a timely manner, then cash may have to be borrowed to pay expenses (rent, insurance, utilities, payroll, etc.). The charging of interest for late payments helps to offset the costs of a loan and may inspire some clients to pay on time.

The Employment Relationship

This agreement is between the law firm and XYZ, Inc. As such, contingency agreements are not acceptable, and the law firm (not the firm’s client) will be responsible for all payment of invoices. The use of the expert’s name in any manner is not authorized, nor will any work commence, until the retainer fee and signed agreement are received.

In litigation-related consulting services, some law firms will attempt to have the client that they represent be primarily responsible for the payment of all expenses incurred by the expert witnesses. Ultimately, the client is responsible for these liabilities. However, the firm representing the plaintiff usually pays the expenses until the matter is resolved. The forensic consultant does not want to be in a position where the individual plaintiff must come up with the resources to pay the expenses. One sure way of not getting paid as an expert witness is to take a plaintiff’s case, have the plaintiff be the primary responsible party for expenses, and then lose the case. This clause allows the consultant/expert to seek full recovery against the law firm, not the individual plaintiff client.

General Arbitration Clause

Any controversy or claim arising out of, or relating to, this Contract or the breach thereof shall be settled by arbitration, in accordance with the rules then obtaining, or the American Arbitration Association, and judgment upon the award rendered may be entered in any court having jurisdiction of the controversy or claim.

In contrast to costly litigation, arbitration has become a popular alternative to resolve disputes. This contract term provides that any disputes arising from the contract relationship will be resolved through binding arbitration. Arbitration is speedy and much less expensive for resolving disputes.

Release of Liability

In consideration of One Dollar ($1) and other good and valuable consideration paid to him by Doe Applications, Inc., a Pennsylvania Corporation, Richard Roe does hereby release and forever discharge said Doe Appliances, Inc., from any and all demands of the undersigned, his heirs, executors, administrators, and assigns from any and all claims of any nature whatsoever that he ever had, now has, or they can, shall, or may have against Doe Appliances, Inc., concerning or arising out of the lease dated June 1, 1980, for premises located at 100 Main Street, Middletown, Pennsylvania, by the undersigned to Releasee.

If a dispute should arise between parties and then be resolved, the individuals will typically have reciprocal releases from future liability by agreement. Signing the release is the last step after a dispute is resolved.

Chapter 16

The Need for Professional Growth

The Origin of the International Association of Professional Security Consultants

I started my consulting practice in late 1979, and by 1982 it became apparent to me that I was operating in a vacuum. I was talking to the walls of my office. I was growing in terms of reputation, engagements, and income, but I was a professional satellite, orbiting alone with no meaningful or intellectual contact or stimuli with my consulting peers.

I contacted the headquarters of the American Society for Industrial Security (ASIS) and talked to the executive director (someone whom I knew personally) and suggested that the association create a new standing committee for security consultants. The then board of directors rejected the idea, stating that it would be a “conflict of interest” (more likely than not because security consultants were rare and not popular). I told the executive director I’d go out and do it on my own, and he wished me luck (in good faith).

I approached the editor of Security World Magazine, the forerunner of today’s Security Magazine, and shared with him my vision of a security consultant’s organization. That call resulted in the magazine, working with the International Security Conference exhibits/seminars, accommodating the needed publicity and facilities for consultants to come together and discuss the possibility of forming an association. With this support, I held meetings during 1983 in Los Angeles, Chicago, and New York. Several hundred “consultants” attended these meetings, and the two key questions addressed were (1) Is there a need for an association? If so, (2) what qualifications would be required for membership?

There was an overwhelming agreement that an association was needed, but a sharp debate arose, in each meeting, about membership and membership restrictions. On one hand there were those who either engaged in “turn-key” consulting work or sold the client the hardware specified in the recommendations and those who were private investigators who “consulted” when the opportunity presented itself. The opposing group, always smaller in number but obviously (to me) more professional, opted for the “purist” approach—that is, pure or exclusive consultants who don’t sell anything other than their wisdom, experience, and advice. I was persuaded by the logic of the latter group and made notes on the back of business cards I collected at each of these meetings.

From those cards I invited some twenty consultants across the country to come together in a founding meeting at the Barnaby’s Hotel in Manhattan Beach, just outside of Los Angeles, in early January 1984. Eighteen men came together then, for two days, and founded the International Association of Professional Security Consultants (IAPSC). It was an inspiring experience to work and share with my unique peers something I knew would fill that professional vacuum. At last, a vehicle for professional growth as a CONSULTANT!

The IAPSC (Figure 16.1)

This association (see Figure 16.1) has three missions:

1. To provide to business and industry a single source of truly professional prescreened consultants whose sole purpose is to provide quality consulting services instead of pursuing some other agenda, such as selling equipment or other services.

2. To provide a forum for truly professional consultants for their business and professional growth and for upgrading their consulting skills.

3. To promote, protect, and polish the image of the consultant in our industry.

Figure 16.1   The IAPSC’s logo.

Advantages of Joining the IAPSC

To explain the advantages of membership in the IAPSC, the only security consultant’s organization in existence, the following was published under the heading, Why Should You Join IAPSC?

The IAPSC represents the interest of independent consultants in regard to federal and state legislation, codes and standards, and other matters of a similar nature.

The Association newsletter serves as a means of communication between members (Figure 16.2). It contains information that can save money, improve skills, and possibly help in winning contracts.

Figure 16.2   Front page of the IAPSC newsletter.

The annual meeting and seminar is an opportunity to network with your colleagues, exchange information, and gain new ideas and information.

The membership directory provides each member with a professional showcase that includes the member’s photo, description of the services he or she provides, and a link to one’s website (Figure 16.3).

Figure 16.3   Individual IAPSC member’s page in the directory.

The IAPSC website provides a search vehicle whereby those seeking expert consulting services can match their needs with the specific skills of members (Figure 16.4).

Figure 16.4   A partial view of the listings of all security consulting specialties.

Through the IAPSC, members often receive free exposure in trade and professional publications.

The IAPSC has identified a single provider for relatively low cost Errors and Omissions Insurance, exclusively for security consultants.

Qualifications for IAPSC Membership

Education

A baccalaureate or higher degree from an accredited college or university is required. The Membership Committee may accept eight years of direct, broad security experience as equivalent on a case-by-case basis.

Experience

At least five years of broad security experience in paid positions, demonstrating increasing responsibilities, with at least three years at management or higher levels, is required. No part of this requirement may be used as a substitute for the educational requirement.

Certification

The Membership Committee may accept the following in place of the education qualification:

• Certified protection professional with at least three years’ experience as described previously.

• Membership in the bar of any state, commonwealth, or country, with at least three years’ experience as described previously.

• Other certifications may be accepted at the discretion of the Membership Committee.

Membership Requirements

An active member shall be a person whose primary working income is derived from providing security advice, information, and recommendations to management. The active member shall have been engaged in this activity for a minimum of one year prior to the date of the application.

An associate member shall be a person who meets this criteria, except that that activity does not provide his or her primary working income (e.g., university professor, security executive doing some part-time consulting, or a law enforcement officer who does some consulting work on the side).

An internal consultant member shall be a person in a security management position employed by an organization that does not market security services. The internal consultant Member should be that organization’s primary security director, an executive, or in some other type of management position where he or she regularly provides security advice and recommendations to his or her organization. Internal consultant members may vote and serve on the board of directors but may not be an officer.

Annual IAPSC Meetings

The annual meetings of the association focus on the kinds of issues that are of the most concern to the membership. Mini-workshop sessions have included such topics as the following:

• Marketing and selling your service

• Proposal writing

• Sharing examples of reports

• Handling collection problems

• Becoming an expert witness

• Preparing graphics for presentations

Attending these annual meetings and spending time with those who engage in the same kinds of work and problems and who share formally in sessions and informally around the pool will enhance professional growth.

In addition to individual professional growth opportunities, there are unlimited opportunities for the growth of one’s consulting practice through networking and sharing projects and referrals—the kinds of things that don’t and can’t happen unless you all know one another.

Whereas the book you are now reading is deemed a relatively important contribution to our industry, I personally view the creation of the IAPSC as the most important contribution I ever made. And interestingly, I have gained as a person and a professional immeasurably as a consequence of my association with the highest quality of individuals in the security industry. In the almost thirty years of our existence, we’ve slowly and carefully increased in number from 18 members to 130 strong and growing, representing the cream of the crop. This book is written to help security professionals who seek excellence and success in the security consulting profession find their way into the IAPSC, (www.iapsc.org).

The Certified Security Consultant Certification

Although there are many certifications for security knowledge, such as the certified protection professional (CPP) and the physical security professional (PSP) certifications sponsored by ASIS; many information technology (IT) security–related certifications; and many industry-specific security certifications, the security industry was lacking of a specific security consulting certification. To fill this void, in 2005 the IAPSC developed and implemented the certified security consultant (CSC) certification. Although the qualifications for being eligible to earn the certification are similar to the qualifications for joining the IAPSC, being an IAPSC member is not required.

To earn the certification, one must meet the eligibility requirements and then pass a multiple-choice exam. The exam tests on three major categories: consulting (40 percent), security consulting methods (40 percent to include management, technical, forensic, and IT consulting), and business ethics (20 percent). These categories ensure that a consultant with this certification is well rounded in both the required elements to be a good consultant in general and the required elements to be a good security-specific consultant. The references used for the certification are some of the best in the consulting and security industries, including this book. Recertification is also a requirement to continue holding the CSC certification. All the details regarding the certification can be found on the IAPSC website.

The CSC certification is still relatively new compared to other established certifications, but already it is gaining traction as a sought-after and desired certification for security consultants and as a client requirement for projects. With the continued reality of salespeople calling themselves consultants and so-called consultants recommending services provided by another branch of their company, it is more and more important that distinctions can be made between them and the true independent security consultant. It is the realistic goal of the IAPSC that, like membership in the organization itself has become, the CSC becomes a symbol for truly professional consultants providing quality security consulting services.

Institute of Management Consultants

Although the IAPSC had indeed provided a meaningful vehicle for professional growth, I felt its limitations in that the membership is exclusively composed of security people, and in my view, we can get tunnel vision if we don’t broaden our horizons.

Where can one associate with consultants of all disciplines? The answer was clear. The IAPSC had permission from the Institute of Management Consultants (IMC) to liberally borrow from its bylaws and code of conduct, which had been developed back in its formation in 1968. The IMC services consultants of every conceivable discipline and offers an awesome array of programs aimed at continued growth presented not only at their annual meeting but by various chapters scattered around the country.

The IMC’s stated purpose is as follows:

The primary purpose of the Institute of Management Consultants is to assure the public that members possess the ethical standards and the professional competence and independence required for membership and are, therefore, qualified to practice.

More broadly, the goal of the Institute is to help ensure standards that will engender greater public confidence in the management consulting profession.

Additional important purposes are:

• To provide opportunities for consultants to improve their technical and consulting skills through specialized training and career development programs

• To gain public recognition for Institute certification and to enhance the reputation of management consulting as a profession.

One must be a certified management consultant (CMC) to be a member of the Institute. To achieve the CMC certification, one must have a minimum of five years’ consulting experience, must have a bachelor’s degree, must submit a list of past clients (whom indeed are contacted and with whom the quality of work is verified), and must successfully pass an oral examination/interview and a written test.

I earned my CMC in 1992 after identifying that goal as a worthy endeavor and evidence of continuing professional growth, although I was 61 years old at the time. At that time there were only four security consultant CMCs in the IMC. I understand that number has grown. By the time the IMC finalized its recertification program, I opted for the CSC certification and allowed my CMC to lapse.

The IMC’s Journal of Management Consulting is published twice a year and is of superior quality.

Here’s a sampling of the articles contained in the Journal:

• “When Consultants Are Hired”

• “Strategy Implementation Hurdles: A Diagnostic Paradigm”

• “How Changes in Federal Rules Could Affect Management Consultant Expert Witnesses”

• “To Be or Not to Be... a Partner”

• “Critical Factors for Consulting to Small Business”

• “How to Consult to Government”

• “Implementing TQM on a Shoestring”

• “How Do I Go International?”

• “Establishing Alliances”

The IMC’s seminar programs are equally stimulating. Here is a sampling of what they have offered to help members learn subjects such as the following:

• Overcoming roadblocks to successful engagements

• Closing sales and handling objections

• Planning and conducting better client interviews

• Writing winning proposals

• Facilitating client participation

• Improving profits through effective billing

• Professional referrals

• Borderless consulting

• Consulting fees today

Pro Bono Work as a Source of Professional Growth

The term pro bono is best defined in “YourDictionary” as “designating professional services provided, without compensation, for charitable organizations, poor persons, etc.”

Although pro bono didn’t become common among American lawyers until the early 1970s, it was considered mandatory for lawyers in the largest and most prestigious law firms by the mid-1980s. Its use by other, nonlegal professionals began in the middle 1990s and is common today. True professionals perform pro bono work periodically.

I’ve mentioned pro bono work elsewhere in this book, but it deserves a closer look. The experiences shared with me by a security consultant whom I hold in high esteem struck me as examples worth sharing. He told me he was introduced to pro bono work by an attorney client who was a full partner in a large, prestigious Washington, D.C. law firm. The firm required each of the full partners to take on one new pro bono case every three years. The attorney asked the consultant to assist, also pro bono.

The lawyer’s client was awaiting execution for murder. The case was appealed through the state and federal courts three times. The United States Supreme Court ultimately decided the case. The reversal for the client was most unusual for Harris County, Texas, but was proper and proved to be the most rewarding decision in the consultant’s forty-year career. The United States Supreme Court would never have gotten the case if pro bono work were not available to the indigent client.

In another case, during a beautiful mid-summer sunrise in Reno, more than 100,000 people got ready to head for the casino parking lot to buy venders’ products and guess which chili cooker would be the next world’s champion. People began arriving early and wandered between the 40 chili cookers from around the world so that they could buy the wares from the more than 100 vendors whose tents were pitched in the huge casino parking lot. None cared that the weather report predicted 40-mile-an-hour winds, with 55-mile-an-hour gusts, for the afternoon. It was a typical forecast for a summer day in Reno. One casino opted to secure the tent in place with 5-gallon buckets full of sand and tied it down with a rope. All other casino’s tents were secured against the wind with 55-gallon drums, filled with water, that could safely hold the tents down in our typical summer afternoon winds.

A young single mom led her two preschool sons, one by each hand, meandering through the crowd and the maze of vendor’s tents. When the first gusts of wind lifted the defendant’s tent into the air, the sand-filled buckets followed. Without warning, the young mother fell to the ground. A bucket had struck her in the back of the neck, severing her spinal cord. At the hospital, awake and alert but knowing that she would not survive, the mother’s only goal was to prepare for her children’s future.

The mother hired a lawyer who filed a lawsuit for negligence connected with a foreseeable risk.

The lawyer retained the security consultant as an expert witness for the dying plaintiff. Because she was without relatives, a neighbor family with a son the same age as the victim’s oldest child agreed to care for her boys. Soon thereafter, they decided to adopt the boys.

The entire legal community, including courts, defense and plaintiff’s counsel, adoption counsel, insurance companies, and plaintiff’s expert, agreed to settlements only two days before the victim died. The security consultant offered his services to counsel pro bono if counsel would do the same. The attorney agreed to do so. The hospital waived all fees not previously paid. The mortuary and cemetery provided all services without cost to the victim. The entire community had worked together to resolve several problems that could not be resolved as quickly, or humanely, any other way.

The experience that one gains from the successful completion of a pro bono case provides a deeper satisfaction than achieved from most other cases. The awareness that you have helped someone who might not otherwise have been able to gain any sense of fairness from the system helps to make you a better person and a better professional representing your field. As you mature in your profession, I recommend that each of you consider taking on deserving expert witness cases or consulting cases, pro bono. This is a unique route to enhancing and growing your professionalism as a security consultant.

Surely it should be apparent that the successful security management consultant not only has to be skilled in his or her niche specialty of security but must be equally skilled in the art and business of being a consultant. How is that achieved? It is achieved by pursuing professional growth as a consultant.

Chapter 17

Ethics in Consulting

Ethics has to do with the general nature of morals and the moral choices to be made by an individual in relationship with others. Certainly all security practitioners need to conform to principles of good and moral conduct, but where and what are those principles? In 1983 more than 2,000 men and women identified themselves to Security World magazine as security consultants. This author is unable to find any other authoritative documentation as to the number of consultants in this country, and I’m skeptical of the 2,000 number, mostly because the title means different things to different people (e.g., residential alarm sales representatives are known as “security consultants,” as are other security product and service organizations), and how many moonlighting or private investigators have identified themselves as “security consultants”? And that number continues to inch up, but by what standards did they abide? How could it be that literally hundreds, if not thousands, of men and women move throughout our residential business and industrial communities, accessing confidential, secret, and sensitive proprietary data with no universally accepted code of conduct?

Security consultants had no such code until the formation of the International Association of Professional Security Consultants (IAPSC). In 1984, that newly formed group, recognizing the need for standards of conduct, looked to the Institute of Management Consultants and, with that organization’s permission, liberally adopted from its code of professional conduct. The objective of embracing a code of professional conduct was to signify members’ willingness to assume an obligation of self-discipline above and beyond requirements of the law. Thus, it notifies clients and prospective clients that members intend to maintain a high level of ethics and professional service, a service of genuine integrity.

Providers of security consulting services, at the very least, should do the following:

1. Place the interest of clients and prospective clients ahead of their own interests.

2. Hold the affairs of their clients in strict confidence.

3. Strive continuously to improve and enhance their professional knowledge and skills.

4. Uphold the honor and dignity of the security profession in general and the consulting profession specifically.

5. Maintain the highest standards of personal conduct.

General Standards for Consultants

In 1984, the IAPSC adopted twenty-nine articles of conduct, in four categories. These were the first codified rules of ethics ever set down for security consultants, and they clearly delineate all the major points of concern for this profession.

Serving the Client: Basic Responsibilities

1. Consultants will, at all times, place the interests of clients ahead of their own and serve their clients with integrity and competence.

2. Consultants will assume an independent position with the client, making certain that advice to clients is based on impartial consideration of all pertinent facts and responsible opinions.

3. Consultants will guard as confidential all information concerning the affairs of a client that is gathered during the course of the professional assignment.

4. Consultants will not take personal, financial, or other advantage of material or inside information resulting from their professional relationship with clients; nor will consultants provide the basis on which others might take such advantage.

5. Consultants will not serve two or more competing clients in areas of vital interest without informing each client.

6. Consultants will inform clients of any special relationships or circumstances or interests that might influence their judgment or impair their objectivity.

Serving the Client: Arrangements

1. Consultants shall, before accepting an assignment, confer with the client in sufficient detail and gather sufficient facts to gain an adequate understanding of the problem, the scope of study needed to solve it, and the possible benefits that may accrue for the client. The preliminary exploration will be conducted confidentially on terms and conditions agreed on by the consultant and the prospective client.

2. Consultants will accept only assignments for which they believe they are qualified. Consultants will recommend that other professionals be retained whenever their special knowledge and skills are needed by the client.

3. Consultants will only accept assignments they believe will prove beneficial to the client.

4. Consultants will not serve a client under terms or conditions that might impair their objectivity, independence, or integrity; they will reserve the right to withdraw if conditions beyond their control develop in a manner that would interfere with the successful conduct and completion of the assignment.

5. Consultants will not accept an assignment of such limited scope that they cannot serve the client effectively.

6. Consultants will present their qualifications for serving a client solely in terms of their competence, experience, and standing.

7. Consultants will perform each assignment on an individualized basis and develop recommendations designed specifically for the solution of each client’s problems.

8. If conditions change during an assignment, the consultant will discuss with the client any changes in the objectives, scope, and approach or other aspects of the engagement and obtain the client’s agreement to such changes before taking action. Unless the circumstances make it unnecessary, the consultant will confirm these changes in writing.

Serving the Client: Fees

1. Members will not charge more than a reasonable fee. Determination of the reasonableness of a fee will be based on the nature of the services performed; the time required; the consultant’s experience, ability, and reputation; the degree of responsibility assumed; and the benefits that accrue to the client.

2. Wherever feasible, the consultant will agree with the client in advance on the fee or fee basis.

3. The valuation of services and the procedures by which charges are made are matters of individual preference and are based on agreement between the consultant and the client. However, the pricing and charging practices should not serve to impair the independent status or objectivity of professional judgments of the consultant or contribute to a conflict of interest with the client.

4. Members will neither accept nor pay fees or commissions to others for client referrals, or enter into any arrangement for franchising their practice to others. However, a member may agree with one or more other qualified consultants as to sharing of any fee on a basis reasonably commensurate with the relative values of the services performed.

5. Members will not accept fees, commissions, or other valuable considerations from individuals or organizations whose equipment, supplies, or services they might recommend in the course of their service to clients.

Professional Practices

20. Members will strive continuously to advance and protect the standards of the security consulting profession.

21. Members will not affiliate or work with any consultant who does not adhere to the standards represented by this code of professional conduct.

22. Consultants recognize their responsibilities to the public interest and to their profession to contribute to the development and understanding of better ways to protect corporations, governmental organizations, the legal profession, and other institutions in our society.

23. Members recognize their responsibility to the profession to share with their colleagues the methods and techniques they utilize in serving clients.

24. Members will not knowingly, without their permission, use proprietary data, procedures, materials, or techniques that other security consultants have developed but not released for public use.

25. Members will not accept an assignment from a client while another security consultant is serving that client unless they are assured, and can satisfy themselves, that any conflict between the two engagements is recognized by, and has the consent of, the client.

26. Members will not endeavor to displace another security consultant once they have knowledge that the client has made a commitment to the other consultant.

27. Consultants will review for a client the work of another security consultant currently engaged by the client only with the other consultant’s knowledge, provided that the client consents to the disclosure.

28. Members will strive to avoid not only professional improprieties but also the appearance of improprieties.

29. Consultants may not be convicted of any felony or misdemeanor involving moral turpitude and retain membership in the association.

Standards for Forensic Consulting

In addition to these standards, the following ten articles, recommended by Dr. Robert Gallati, address a code of conduct that specifically pertains to the field of forensic work:

1. Members testifying will respond with the truth, the whole truth, and nothing but the truth to appropriate questions.

2. Members will not exaggerate their qualifications to have the court, or others, accept them as expert witnesses.

3. Members will not conceal any relevant facts that bear on their degree of expertise in specific matters concerning their testimony as experts.

4. Members will not discuss pending litigation with anyone, except as approved by the client.

5. Members, when providing expert opinion, will be objective, fair, impartial, and consistent.

6. Members who have been previously subjected to effective cross-examination will disclose this to the client and alert the client to the consultant’s points of possible vulnerability in the case at hand.

7. Members are entitled to reasonable fees for professional services as an expert witness; however, any such fees will never be contingent on the outcome of the case.

8. Members will, if feasible, consent to accept court appointment as an expert at the request of the judiciary.

9. Members, in rendering their expertise in our judicial system, always will be conscious of their dedication to just verdicts.

10. Members, when testifying, will carefully avoid assuming an adversarial approach, or appearing to assume such an approach, for justice requires that the professional security consultant should consider himself or herself to be neutral, with no personal interest in the outcome of the case.

Gallati’s ten recommendations are just that—a list of suggestions. I include them as well as the preceding twenty-nine, knowing they all may evolve and be refined. But they are of such fundamental importance to the consulting profession that they cannot be excluded from this work. Without these thirty-nine articles of faith,” what is out there in terms of professional and moral guidelines for the consultant? Indeed of special note is Gallati’s second recommendation: “Members will not exaggerate their qualifications to have the court, or others, accept them as expert witnesses.” This recommendation goes to the very heart of ethics. This is the one swamp that hungry consultants get trapped in, holding themselves out as having specific expertise to gain acceptance by an otherwise unknowing law firm seeking an “expert” in a specific area of litigation. Having been employed in the Loss Prevention or Security Department of a major retailer doesn’t in and of itself qualify a given supervisor as an expert in the specific area of shoplifting. I’m personally aware of consultants who have claimed such expertise despite the fact they had no supervisory or actual experience with shoplifting detectives, had never made an arrest or observed an arrest, and had never specifically trained detectives on the law and method of arrests; yet, they testified as experts. Police officers are common offenders in this area too. But we can’t hold off-duty police officers to the high standards of the security consulting profession, can we?

Not only do practicing consultants have an abiding concern about the ethics in their profession, so do clients. Clients often will require consultants to sign agreements of nondisclosure and conflict-of-interest statements (Figures 17.1 and 17.2). Yet the signature on an agreement is only as binding as the morality of the person who affixes it to the document. Therefore the code of professional conduct can be compared with an oath of office or the physician’s Hippocratic oath; these oaths of ethical professional behavior work only as well as we apply them.

Figure 17.1   Nondisclosure agreement.

Figure 17.2   Conflict-of-interest statement.

Appendix B is a copy of an agreement for consulting services that was included in the Protection of Assets Manual, in a chapter on consultants. The agreement includes, among other important factors, the issue of ethics. Paragraph 6, Professional Standards, reads as follows:

“Consultant agrees that the work performed here under will represent her or his best effort and will be of the highest professional standards and quality.”

I underscore highest professional standards. To what standards was the author or designer of the agreement referring? To my knowledge, other than the IAPSC’s code and what has been presented in this chapter, none exist for consultants in the security industry.

This issue of and concern about ethics is not some vague idealism that consultants wrap themselves in as an enhancement to marketing. The truth is that security consultants are perceived as a model of knowledge and honesty. Most professions are known or suspected to have a dark side. Most have heard of doctors and lawyers who have engaged in unethical or unscrupulous conduct. Consultants, for the most part, particularly security consultants, are really the last bastion of unquestioned honesty. That is our image. And the IAPSC is committed to safeguard that perception.

Appendix A

Consulting Contract

This sample contract is provided for your convenience and is one of many alternative styles you can use. We suggest that you consult your attorney. We are not providing legal advice and do not recommend this contract as anything but a possible choice.

Consulting Contract

This agreement is made as of [Date] between [Your Firm] and [Your Client].

In the event of a conflict in the provisions of any attachments hereto and the provisions set forth in this agreement, the provisions of such attachments shall govern.

1. Services. Consultant agrees to perform for Client the services listed in the Scope of Services section in Exhibit A, attached hereto [see page 134] and executed by both Client and Consultant. Such services are hereinafter referred to as “Services.” Client agrees that Consultant shall have ready access to Client’s staff and resources as necessary to perform the Consultant’s services provided for by this contract.

2. Rate of Payment for Services. Client agrees to pay Consultant for Services in accordance with the schedule contained in Exhibit B [see page 134] attached hereto and executed by both Client and Consultant.

3. Reimbursement for Expenses. Consultant shall be reimbursed by Client for all reasonable expenses incurred by Consultant in the performance of Services, including, but not limited to, travel expenses of Consultant and Consultant’s staff, long-distance telephone calls, and supplies.

4. Invoicing. Client shall pay the amounts agreed to herein upon receipt of invoices, which shall be sent by, and Client shall pay the amount of such invoices to, Consultant. Invoices are sent monthly for work performed in the month. A final invoice is submitted upon completion of the project.

5. Confidential Information. Each party hereto (“Such Party”) shall hold in trust for the other party hereto (“Such Other Party”) and shall not disclose to any nonparty to the agreement any confidential information of Such Other Party. Confidential information is information that relates to Such Other Party’s security, operations, trade secrets, or business affairs, but does not include information that is generally known or easily ascertainable by nonparties of ordinary skill.

6. Staff. Neither Consultant nor Consultant’s staff is or shall be deemed to be employees of Client. Consultant shall take appropriate measures to ensure that its staff who perform Services are competent to do so and that they do not breach Section 5 hereof. Consultant and staff are independent contractors. Consultant assumes full responsibility for payment of any taxes due on money received hereunder. Client will not make any deductions for taxes.

7. Use of Work Product. Consultant and Client agree that Client shall have nonexclusive ownership of the deliverable products described in Exhibit A and the ideas embodied therein. The Consultant’s notes and a file copy of all reports, blueprints, drawings, or other products in written, computer media, or other format shall be retained in a secure manner by the Consultant.

8. Client Representative. The following individual, _______________, shall represent the Client during the performance of this contract with respect to the services and deliverables as defined herein and has authority to execute written modifications of additions to this contract as defined in Section 13.

9. Independent Status. The Consultant is an independent consultant and does not represent or sell any product or service or benefit from any recommendation made herein.

Limited Warranty

10. Liability. Consultant warrants to Client that the material, analysis, data, programs, and services to be delivered or rendered hereunder will be of the kind and quality designated and will be performed by qualified personnel. Special requirements for format or standards to be followed shall be attached as an additional exhibit and executed by both Client and Consultant. Consultant makes no other warranties, whether written, oral, or implied, including without limitation warranty or fitness for purpose or merchantability. In no event shall Consultant be liable for special or consequential damages, in either contract or tort, whether or not the possibility of such damages has been disclosed to Consultant in advance or could have been reasonably foreseen by Consultant and, in the event this limitation of damages is held unenforceable, then the parties agree that by reason of the difficulty in foreseeing possible damages, all liability to Client shall be limited to One Hundred Dollars ($100.00) as liquidated damages and not as penalty.

The Client fully understands that the Consultant is not an insurer and cannot insure the protection of the facility or its contents, employees, visitors, or others. The protection of a public facility or private institution such as the Client’s facility cannot be insured without extraordinary measures. The Client agrees that the Consultant is to recommend security measures and devices that are reasonable in nature, and the lack of additional recommendations will not be construed as errors or omissions of the Consultant.

11. Complete Agreement. This agreement contains the entire agreement between the parties hereto with respect to the matters covered herein. No other agreements, representations, warranties, or other matters, oral or written, purportedly agreed to or represented by or on behalf of Consultant by any of Consultant’s employees or agents, or contained in any sales materials or brochures, shall be deemed to bind the parties hereto with respect to the subject matter hereof. Client acknowledges to be entering into this agreement solely on the basis of the representations contained hereon. This agreement supersedes all prior proposals, agreements, understandings, representations, and conditions.

12. Applicable Law. Consultant shall comply with all applicable laws in performing Services but shall be held harmless for violation of any governmental procurement regulation to which it may be subject, but to which reference is not made in Exhibit A. This agreement shall be construed in accordance with the laws of the State indicated by the Consultant’s address.

13. Scope of Agreement. If the scope of any of the provisions of the agreement is too broad in any respect whatsoever to permit enforcement to its full extent, then such provisions shall be enforced to the maximum extent permitted by law, and the parties hereto consent and agree that such scope may be judicially modified accordingly and that the whole of such provisions of this agreement shall not thereby fail, but that the scope of such provisions shall be curtailed only to the extent necessary to conform to law.

14. Additional Work. After receipt of an order that adds to the Services, Consultant may, at her or his discretion, take reasonable action and expend reasonable amounts of time and money based on such order. Client agrees to pay and reimburse Consultant for such action and expenditure as set forth in Exhibit B of this agreement for payments and reimbursements related to Services.

15. Notices.

(i) Notices to Client should be sent to: ___________________

(ii) Notices to Consultant should be sent to: ____________________

16. Assignment. This agreement may not be assigned by either party, without the prior written consent of the other party. Except for the prohibition on assignment contained in the preceding sentence, this agreement shall be binding upon and inure to the benefit of the heirs, successors, and assigns of the parties hereto. Nothing in this provision prohibits the Consultant from utilizing the services of a qualified specialist-associate.

IN WITNESS WHEREOF, the parties hereto have signed this agreement as of the date first above written.

CLIENT (Title)Date

CONSULTANT (Title)Date

Exhibit A: Scope of Services

The Consultant agrees to perform the following services for the Client pursuant to the Contract affixed hereto:

[List what you intend to do for the Client here so as to define the scope of services. If you intend to provide a report, say so].

We hereby accept the Scope of Services as herein described.

Client (Title) Date

Consultant (Title) Date

Exhibit B: Rate of Payment

The work outlined in Exhibit A: Scope of Services will be performed for a total fee not to exceed $ ____________, excluding expenses. Work will be billed at the rate of $ ____________ per hour for work performed within 25 miles of the main office of the Consultant and a rate of $ ____________ per hour for work performed beyond 25 miles of the main office of the Consultant.

Specification writing will be performed at a rate of $ ____________ per hour regardless of where the work occurs.

Travel time is billed at the out-of-town rate.

Expenses are actual. Effort will be made to obtain the lowest reasonable, refundable airfare. The Client recognizes that airfares vary greatly and the lowest fares require advance reservations.

The Client agrees to pay any fee or service charge incurred by the Consultant as a result of any cancellation of air or hotel reservations or other accommodations when the cancellation is at the request of the Client or made necessary for the convenience of the Client. This includes cancellation of air reservations made necessary by the weather at the Client’s airport.

The Client agrees to pay reasonable meal and lodging costs, ground transportation costs, and other similar expenses. Client will, if necessary for the project, provide at least one set of architectural blueline prints and three sets of reduced floor plans. If the reproduction of blueline prints is necessary for the project, the Client authorizes the Consultant to produce vellums, or other copies as necessary and to pay the cost of the reproduction.

Mailing and parcel costs will be the responsibility of the Client.

The following fees and expenses are due and payable in advance:

______________________________________________

Invoices are mailed at the end of the month for work performed in that month and are due and payable immediately. A final invoice is submitted upon completion of the project or project phase.

We accept the above terms and rate of payment:

Client (Title)Date

Consultant (Title)Date

Appendix B

Professional Services Agreement

This sample service agreement is provided for your convenience and is one of many alternative styles you can use. We suggest that you consult your attorney. We are not providing legal advice and do not recommend this contract as anything but a possible choice.

Professional Services Agreement

AGREEMENT, made as of ____________________, by ____________________, an individual, hereinafter referred to as the “Consultant,” and ____________________, a company.

Witnesseth

WHEREAS Company and Consultant desire to enter into an agreement for the performance by Consultant of professional services in connection with programs of research and development and other activities of Company.

NOW, THEREFORE, in consideration of the premises and of the mutual promises herein, the parties hereto agree as follows:

1. RETAINER-TERM. This agreement is made with Consultant as an independent contractor and not as an employee of Company. The Company hereby retains Consultant and Consultant agrees to perform professional services for the Company commencing on the date set forth above and concluding ____________________.

2. STATEMENT OF WORK. The work described in the attachment hereto entitled “Scope of Work” and incorporated herein shall be performed by Consultant as requested from time to time by Company, at such place or places as shall be mutually agreeable.

3. PAYMENT. (a) Company shall pay Consultant at the rate of ________________ for each _________________ spent on the work hereunder during the terms of this agreement. Unless and until revised by a written amendment to this agreement, Company shall not be obligated to Consultant and Consultant shall not be entitled to payment from Company for more than _________________ days/hours. Time spent in travel hereunder during normal working hours or otherwise, if requested by Company, shall be paid for at the above rate. (b) Company shall pay or reimburse Consultant for travel and other appropriate expenses incurred in the performance of work hereunder in accordance with the attachment hereto entitled: “Consultant Expense.”

4. PATENT RIGHTS. Consultant will disclose promptly to Company all ideas, inventions, discoveries, and improvements, hereafter referred to as “Subject Inventions,” whether or not patentable, relating to the work hereunder, which are conceived or first reduced to practice by Consultant in the performance of the work under this agreement. Consultant agrees to keep a written record of technical activities and that all such records and such Subject Inventions shall become the sole property of Company. During or subsequent to the period of this agreement, Consultant will execute and deliver to Company all such documents and take such other action as may be reasonably required by Company to assist it in obtaining patents and vesting in the Company or its designee title to said Subject Inventions; except, however, that as to Subject Inventions not conceived but first reduced to practice hereunder, Consultant’s obligations shall be only to the extent that such actions may be made by Consultant without incurring liability to others solely because of such actions.

5. COPYRIGHTS. Consultant agrees that all writings produced by Consultant under this agreement shall be the sole property of Company, and Company shall have exclusive right to copyright such writings in any country or countries; however, Company will make its best efforts to grant a nonexclusive right to Consultant to publish such writings when circumstances, including security regulations, will permit.

6. PROFESSIONAL STANDARDS. Consultant agrees that the work performed hereunder will represent the best efforts and will be of the highest professional standards and quality.

7. SECURITY. Company agrees to apprise Consultant of any information or items made available hereunder to Consultant that are Classified or Restricted Data, and Consultant agrees to comply with the security requirements imposed with respect thereto by the United States Government or the Company. If it becomes necessary for Consultant to store classified material at Consultant’s place of business, other than the Company, a facility clearance will be required. In this event, Consultant agrees to enter into a security agreement with the Department of Defense and to maintain a system of security controls in accordance with the requirements set forth in “Department of Defense Industrial Security Manual for Safeguarding Classified Security Information.” Consultant further agrees that any classified material furnished by the Company will be immediately returned to the Company upon termination of either the security agreement or this Professional Services Agreement.

8. RISK OF LOSS. Consultant assumes all risk of personal injury, and all risk of damage to or loss of personal property furnished by Consultant’s office.

9. PRIVILEGED OR PROPRIETARY INFORMATION. Except as may be required in the performance of the work, Consultant agrees not to divulge any unpublished information, acquired as a Consultant to the Company from any source, including the Company, its customers and associate or other contractors, without the prior written consent of the Company.

10. TERMINATION. Either party may terminate this agreement in whole or in part at any time by giving written notice to the other.

IN WITNESS WHEREOF, the parties hereto have executed this agreement as of the day and year first above written.

Consultant

By________________________

Date________________________

Appendix C

Confidential Information Agreement

This sample agreement is provided for your convenience and is one of many alternative styles you can use. We suggest that you consult your attorney. We are not providing legal advice and do not recommend this agreement as anything but a possible choice.

Confidential Information Agreement

Agreement and acknowledgment, between Your Company, the undersigned, and Your Client.

The undersigned hereby agrees and acknowledges:

1. That while serving as Consultants to _____________, certain trade secrets may become known to us. These trade secrets fall under the following descriptions:

a) Technical data: Methods, formulae, inventions, research material, designs, computer software, technical specifications, electronic systems, and security provisions.

b) Business data: Tactics, employee names, values, vulnerabilities, names of suppliers and subcontractors, operations, policies, and procedures.

2. While serving as Consultant or upon termination, we shall not make use of, or disclose or reveal to other parties, any confidential information or data aforementioned.

3. Hereby, in the event of termination of my Consulting relationship with the Company:

a) I will restore to the Company all documents relating to it, including specifications, drawings, reports, manuals, blueprints, letters, software, marketing lists, and all other materials relating in any way to the Company’s business, or issued by the Company while I was in its service. I also promise to return all copies of the aforementioned, except the copy permitted in the contract. All retained computer disks shall be password-protected.

b) The Company reserves the right to inform any future or prospective employer or client of this agreement.

c) Any condition of this agreement that is held unenforceable, shall not affect any other condition.

_________________

____

Consultant’s signature

Date

Appendix D

Security Survey Work Sheets[*]

This is a basic guide that may be used to assist personnel in performing physical surveys in most industrial settings. Questions have been prepared for the purpose of reducing the possibility of neglecting to review certain areas of importance and to assist in the gathering of material for the survey. It is not meant to represent an exhaustive totally comprehensive list of items or points of risk to examine or inspect.

General Questions before Starting the Survey

• Date of survey

• Interview with whom?

• Number of copies of survey desired by client; to be forwarded where?

• Obtain plot plan. Plot the production flow on plot plan and establish direction of north.

• Position and title of persons interviewed

• Correct name and address of plant

• Type of business or manufacture

• Square feet of production or manufacturing space

• Property other than main facility to be surveyed is located where?

• Property known as what?

• Property consists of what?

• What activity is in progress here?

• Is there other local property that will not be surveyed? Why?

• If plot plan is not complete, sketch remainder of property to be surveyed.

Number of Employees

• Administrative total number of all shifts

• Skilled and unskilled—total number on each shift

• 1st shift

• 2nd shift

• 3rd shift

• Maintenance/cleanup crew

Normal Shift Schedule and Break Times

• Salaried

• 1st Shift

• 2nd Shift

• 3rd Shift

• Maintenance/cleanup crew

• What days of the week is manufacturing in process?

• Are employees authorized to leave plant during breaks?

• Are hourly employees union or not?

• Are company guards in union bargaining unit?

Cafeteria

• Where is cafeteria located?

• What are hours of operation?

• Is it company or concession operated?

• What is security of proceeds from sales?

• What is security of foodstuffs?

• What is method of supply of foodstuffs?

• How are garbage and trash removed?

• Where is location of vending machines?

• Where is location of change-maker, if any?

Credit Union

• Where is credit union located?

• How is money secured?

• How are records secured?

• How is office secured?

• What are hours of operation?

• How much money is kept during day and overnight?

Custodial Service

• Is it outside contract or company employees?

• What hours do they actually start and complete work?

• Do they have keys in their possession?

• How remove?

• Who, if anyone, controls removal?

• Who controls their entrance and exit?

• Are they supervised by any company employee?

Company Store

• Where is company store located?

• What are hours of operation?

• What method used to control stock?

• How is stock supplied from plant?

• Number of clerks working in store?

• How is cash handled?

• When are inventories conducted, and who performs them?

• How are proceeds from sales secured?

• How is the store secured?

Petty Cash or Funds on Hand

• In what office are funds kept?

• What is the normal amount?

• How are these funds secured?

• What is the control and security of containers?

• Who has general knowledge of amount normally on hand?

Classified Operations

• Is government classified work performed?

• What is the degree of classification?

• How are classified documents secured?

• What is security during manufacture?

• What is classification of finished product?

• Are government cognizant officers on premises?

• Is company-classified R&D performed?

• Is company-classified work sensitive to industry?

• What degree of security is it given?

• What degree of security does it require?

• What are the locations of the various processing areas and containers?

Theft Experience

• Office machines or records

• Locker room incidents

• Pilferage of employees’ autos

• Pilferage of vending machines

• Pilferage from money-changer

• Theft of tools

• Theft of raw material and finished product

• Are thefts systematic or casual?

• Have any definite patterns been established?

• Are background investigations conducted prior to employment of any personnel?

• What category of personnel are investigated?

• What is extent of investigations?

The foregoing questions, answered properly, will assist you in developing the degree of control required for various areas, which can be secured only through the interview—the more probing the interview the better. You should now also have a working knowledge of the general operational plan. Before starting your detailed examination and study, you must take a guided orientation tour of the facility to acquaint yourself with the physical setting. Make notes on your plot plan and pad during this tour.

I. Physical Description of the Facility

• Is the facility subject to natural disastrous phenomena?

• Describe in detail the above if applicable.

• What major vehicular and railroad arteries serve this facility?

• How many wood-frame buildings? Describe and identify them.

• How many load-bearing brick buildings? Describe and identify them.

• How many light or heavy steel-frame buildings? Describe and identify them.

• How many reinforced concrete buildings? Describe and identify them.

• Are all buildings within one perimeter? If not, describe.

II. Perimeter Security

• Describe type of fence, walls, buildings, and physical perimeter barriers.

• Is fencing of acceptable height, design, and construction?

• What is present condition of all fencing?

• Is material stored near fencing?

• Are poles or trees near fencing? If so, is height of fence increased?

• Are there any small buildings near fencing? If so, is the height of fence increased?

• Does undergrowth exist along the fencing?

• Is there an adequate clear zone on both sides along fencing?

• Can vehicles drive up to fencing?

• Are windows of buildings on the perimeter properly secured?

• Is wire mesh on windows adequate for its purpose?

• Are there any sidewalk elevators at this facility? If so, are they properly secured when not in operation?

• How are sidewalk elevators secured during operation?

• Do storm sewers or utility tunnels breach the barrier?

• Are these sewers or tunnels adequately secured?

• Is the perimeter barrier regularly maintained and inspected?

• How many gates and doors are there on the perimeter?

• Number used by personnel? (visitors, employees)

• Number used by vehicles?

• Number used by railroad?

• How is each gate controlled?

• Are all gates adequately secured and operating properly?

• Are railroad gates supervised by the guard force during operations?

• How are the railroad gates controlled?

• Do swinging gates close without leaving a gap?

• Are unused gates secured and sealed properly?

• What is security control of opened gates?

• Are chains and locks of adequate construction used to secure gates?

• Are any alarm devices used at the gates?

• Is [close-captioned television] CCTV used to observe gates or any part of the perimeter?

• How many doors from buildings open onto the perimeter?

• What type are they—personnel or vehicular?

• How are they secured when not in use?

• What is security control when in use?

• How many emergency doors breach the perimeter barrier?

• How are the emergency doors secured to prevent unauthorized use?

• Are there any unprotected areas on the perimeter?

• What portion of the fence do guards observe while making rounds?

III. Building Security

A. Offices

• Where are the various administrative offices located generally?

• When are offices locked?

• Who is responsible for checking security at end of day?

• How and where are company records stored?

• How are they secured?

• Are vaults equipped with temperature thermostats (rate-of-rise; Pyro-Larm)?

• Are offices equipped with sprinklers? Fire extinguishers?

• Are any central station or local alarms installed to protect safes, cabinets, etc.?

• Are various file cabinets locked?

• Are individual offices locked?

• Does the company have IBM computer rooms?

• What type of fire protection are they given?

B. Plant

• When and how are exterior doors locked?

• When and how are dock doors locked?

• Are individual plant offices locked?

• Are warehouses apart from production area secured?

• Are certain critical and vulnerable areas protected by alarms? What type?

• What are these areas? What do they contain?

• Are locker room windows covered by screening?

C. Tool Room

• Is one or more established?

• Departmental or central tool room?

• What is the method of control and receipt?

• How is tool room secured?

D. Locker Rooms

• What is basis of issue to individual?

• What is type of locker—wall or elevated basket type?

• How are individual lockers secured?

• Does company furnish keys/locks?

• Who or what department controls keys/locks?

• What control methods are used?

• How and when are keys and locks issued and returned?

• Are issued uniforms kept in lockers?

• Are unannounced locker inspections made?

• Who conducts inspections and how often?

E. Special Areas That May Require Additional Attention

If the facility houses the following types of activities, they may require special individual inspection. (Base recommendations on any or all of the applicable portions of the checklist.)

• Research and development areas

• Laboratories

• Storage areas for valuable, critical, or sensitive items

• Finished product test areas

• Finished product display areas

• Vehicle parking garages apart from the facility

• Vacant or used lofts, attics, etc.

• Mezzanines or sub-basements

• Aircraft hangars, maintenance shops, and crew quarters

Note: You will, after the initial inspection tour, design a checklist applicable to these special areas.

IV. Security of Shipping and Receiving Areas

• How many shipping docks, vehicle and railroad?

• What are the hours of operation of docks?

• What is the method of transportation?

• What is the method of inventory control at docks?

• What is the method of control of classified items?

• What is the security of classified or “hot” items?

• What supervision is exercised at the docks?

• Are loaded and unloaded trucks sealed?

• Who is responsible for sealing vehicles?

• What type of seals are being used?

• How are truck drivers controlled?

• Is there a designed waiting room for truck drivers?

• Is it separated from company employees?

• Are areas open to anyone other than dock employees?

• Do guards presently supervise these areas? Is this necessary?

• What is the method of accounting for material received?

• Is shipping done by parcel post?

• What is the control at point of packaging?

• Who controls stamps or stamp machines?

• Who transports packages to post office?

• What is the method of transport to post office?

• Where is pick-up point at plant?

• What controls are exercised over the transport vehicle?

• Are inspections of operations made presently?

• Who conducts these inspections and how often?

• Does the facility have ship loading wharves or docks?

• Are contract longshoremen used?

• How do longshoremen get to and from the docks?

• If they pass through the facility, how are they controlled?

• How are ships’ company personnel controlled when given liberty?

• Are any specific routes through the facility designated for longshoremen and ship personnel?

• If so, how is it marked and is it used?

• Are these personnel escorted?

• If they are not escorted, what measures can be taken to escort them?

• Is there any way in which these personnel could be kept from passing through the facility?

V. Area Security

• Can guards observe outside areas from their patrol routes?

• Do guards expose themselves to attack?

• Are patrols staggered so no pattern is established?

• What products are stored in outside areas?

• Is parking allowed inside the perimeter?

• If so, are controls established and enforced?

• Where do employees, visitors, and officials park?

• What security and control is provided?

• Are parking lots adequately secured?

• Is there a trash dump on the premises?

• How is it secured from the public?

• Is it operated by company employees?

• Is it approached directly from the manufacturing facility?

• Do roads within the perimeter present a traffic problem?

• Do rivers, canals, public thoroughfares, or railroads pass through the plant?

• Are loaded trucks left parked within the perimeter?

• If so, what protection is given them?

• Do the roads outside the facility present a traffic problem?

• What are these problems and how can they be remedied?

• Is there any recreational activity, such as baseball, within the perimeter?

• Are these areas fenced off from the remainder of the property?

• Could they logically be fenced off?

VI. Protective Lighting

• Is protective lighting adequate on perimeter?

• What type of lighting is it?

• Is lighting of open areas within perimeter adequate?

• Do shadowed areas exist?

• Are outside storage areas adequately lighted?

• Are inside areas adequately lighted?

• Is the guard protected or exposed by the lighting?

• Are gates adequately lighted?

• Do lights at gate illuminate interior of vehicles?

• Are critical and vulnerable areas well illuminated?

• Is protective lighting operated manually or automatically?

• Do cones of light on perimeter overlap?

• Are perimeter lights wired in series?

• Is the lighting at shipping and receiving docks or piers adequate?

• Is lighting in the parking lots adequate?

• Is there an auxiliary power source available?

• Are the interiors of buildings adequately lighted?

• Are top secret and secret activities adequately lighted?

• Are guards equipped with powerful flashlights?

• How many more and what type of lights are needed to provide adequate illumination? In what locations?

• Do security personnel report light outages?

• How soon are burned out lights replaced?

VII. Key Control, Locking Devices, and Containers

• Is there a grand-master, master, and submaster system? Describe it.

• Are locks used throughout the facility of the same manufacture?

• Is there a record of issuance of locks?

• Is there a record of issuance and inspection of keys?

• How many grand-master and master keys are there in existence?

• What is the security of grand-master and master keys?

• What is the security of the key cabinet or box?

• Who is charged with handling key control? Is the system adequate? Describe the control system.

• What is the frequency of record and key inspections?

• Are keys made at the plant?

• Do keys have a special design?

• What is the type of lock used in the facility? Are all adequate in construction?

• Would keys be difficult to duplicate?

• Are locks changed periodically at critical locations?

• Are any “sesame” padlocks used for classified material storage areas or containers?

• If a key cutting machine is used, is it properly secured?

• Are key blanks adequately secured?

• Are investigations made when master keys are lost?

• Are locks immediately replaced when keys are lost?

• Do locks have interchangeable cores?

• Are extra cores properly safeguarded?

• Are combination locks three-position type?

• Are safes located where the guard can observe them on rounds?

• How many people possess combinations to safes and containers?

• How often are combinations changed?

• What type of security containers are used for the protection of: Money? Securities? High value metals? Company proprietary material? Government classified information?

• Are lazy-man combinations used?

• Are birth dates, marriage dates, etc., used as combinations?

• Are combinations recorded anywhere in the facility where they might be accessible to an intruder?

• Are the combinations recorded and properly secured so that authorized persons can get to them in emergencies?

• Is the same or greater security afforded recorded combinations as that provided by the lock?

• Where government classified information is concerned, does each person in possession of a combination have the proper clearance and “need to know” information?

• Have all faces of the container locked with a combination lock been examined to see if combination is recorded?

• Are padlocks used on containers containing classified material chained to containers?

VIII. Control of Personnel and Vehicles

• Are passes or badges used? By whom?

• Type used? Describe in detail.

• Is color coding used?

• Are badges uniformly worn on outer clothing?

• Are special passes issued? To whom? When?

• Who is responsible for issue and receipt of passes and badges?

• Are badges and passes in stock adequately secured?

• How are outside contractors controlled?

• How are visitors controlled?

• How are vendors controlled?

• How many employee entrances are there?

• What type of physical control is there at each entrance and exit?

• Where are the time clocks located?

• Is it possible to consolidate clock locations to one or two main clock alleys?

• Is there any control at time clock locations?

• Are there special entrances for people other than employees?

• How are the special entrances controlled?

• Are fire stairwells used for operational purposes?

• Does the facility use elevators to various floors?

• What control is exercised over their use?

• Are elevators used by operating employees?

• Do the elevators connect operational floors with strictly office floors?

• Does this present a problem for personnel control?

• Are the elevators automatic or attended?

• If automatic, are floor directories posted in them?

• Do avenues within the buildings used for emergency egress present a problem of personnel control?

• Examine pedestrian flow from entrance, to locker room, and to work area.

• Can changes be made to shorten routes or improve control of personnel in transit?

• Are personnel using unauthorized entrances and exits?

• If government classified work is being performed, are controls in use adequate to comply with the Defense Department pamphlet for safeguarding classified information?

• Are groups authorized to visit and observe operations?

• How are these groups controlled?

• Do registers used to register visitors, vendors, etc., contain adequate information?

• Are these registers regularly inspected? By whom?

• Are employees issued uniforms?

• Are different colors used for different departments?

• What control is exercised over employees during lunch and coffee breaks?

• Do guards or watch patrols ever accompany trash trucks or vending machine service personnel?

• Is parking authorized on premises within the perimeter?

• Are parking lots fenced off from the production areas?

• What method of control of personnel and vehicles is there from the parking lots?

• Is vehicle identification used?

• What types of vehicle stickers or identification are used?

• How are issue and receipt of stickers controlled?

• If executives park within the perimeter, are their autos exposed to employees?

• If nurses and doctors park within the perimeter, are their autos exposed to employees?

• Where do vendor service personnel park?

• Do vendor service personnel use plant vehicles to make the service tours? Are small vehicles available?

• How are outside contractor vehicles controlled?

• What method is used to control shipping and receiving trucks?

• Are the parking facilities adequate at the docks?

• Does parking present a problem for vehicle or personnel control?

• What is the problem encountered?

• During what hour does switching of railroad cars occur?

• Is it possible for persons to enter the premises during switching?

• Are there adequate directional signs to direct persons to specific activities?

• Are the various buildings and activities adequately marked to preclude persons from becoming lost?

• Are safety helmets required?

• Are safety shoes required?

• Are safety glasses required?

• Are safety gloves required?

• Are safety aprons required?

• Are full-time nurses or doctors available?

• Is there a vehicle available for emergency evacuation? What type is it?

IX. Safety for Personnel

• How far away is the nearest hospital in time and distance?

• Are any company employees or guards trained in first aid?

• Is a safety director appointed?

• Is there a safety program? What does it consist of?

• How often does the safety committee meet?

• Is a first aid or medical room available?

• How are medicine cabinets secured?

• Who controls these keys?

• How is the first aid room secured?

• Are any narcotics on hand?

• If so, is there established narcotic security?

• Are the required safety equipment items worn? By visitors?

• What is the safety record of this facility?

• How does it compare with the national record?

• Are areas around machinery well policed?

• Does machinery have installed guards where needed? Are they used?

• Are mirrors used where needed to allow forklift operators to observe “blind” turns?

• Could or would mechanical devices used for forklift control improve safety?

• What type of device could be used? Pneumatic alarm system? Signal light?

X. Organization for Emergency

• Are doors adequate in number for speedy evacuation?

• Are they kept clear of obstructions and well marked?

• Are exit aisles clear of obstructions and well marked?

• Are emergency shutdown procedures developed and is the evacuation plan in writing?

• Do employees understand the plans?

• Are emergency evacuation drills conducted?

• Do guards have specific “emergency” duties? Do they understand these duties?

• Are local police available to assist in emergencies?

• Are any areas of the building in this facility designated public civil defense (C.D.) shelters?

• If so, what control is established to isolate the area from the rest of the facility?

• Do the emergency plans provide for a designated repair crew? Is the crew adequately equipped and trained?

• Are shelters available and marked for use of employees?

• If the plant is subject to natural disastrous phenomena, what are they? Floods? Tornados?

• What emergency plans have been formulated to cope with these hazards?

• When and what was the latest incident of a natural disaster?

• Did it result in loss of life and/or loss of time?

• Attach a copy of the emergency procedures.

XI. Theft Control

• Are lunch-box inspections conducted?

• Is a package-pass control system being used? Describe it.

• Is a company-employed supervisor assigned to check the package-pass system regularly?

• Is a company official occasionally present during lunch-box inspections?

• Are package passes serially numbered or do they contain control numbers?

• Is security of package passes in stock adequate?

• Are comparison signatures available for the guards’ comparison?

• Is the list of signatures kept up to date?

• What action is taken when anyone is caught stealing?

• What controls are established on tools loaned to employees?

• What controls are established on laundry being removed?

• What is the method of removal of scrap and salvage?

• What controls are exercised over removal of useable scrap?

• Is control of this removal adequate?

• Are vending and service vehicle inspections being conducted?

• Do employees carry lunch boxes to their work areas?

• Are railroad cars inspected entering and leaving the plant?

• Are company-owned delivery or passenger vehicles authorized to park inside buildings of the plant?

• Does this parking constitute a possible theft problem?

• Do guards check outside the perimeter area for property thrown over fences?

• Do guards occasionally inspect trash pick-up? Does anyone?

XII. Security Guard Forces

• What is present guard coverage—hours per day and total hours per week?

• Describe in detail guard organization and composition.

• Number and times of shifts each 24-hour period during weekdays and weekends?

• Number of stationary posts? When are they staffed?

• Number of patrol routes? When and where are they and when are patrols made?

• For tours, is an electronic supervisory or mechanical system (like DETEX clocks) in place?

• How many stations? Locate them on your plot plan. (Use different colors or shapes or symbols for different floors and routes.)

• What is length of time of each patrol?

• Is there additional coverage on Saturday, Sunday, or holidays?

• Do the patrol routes furnish adequate protection as presently established?

• Are the guards required to be deputized?

• Are armed guards required?

• How do guards communicate while on patrol?

• Are written guard instructions available? If so, secure a copy.

• If no written instructions are available, generally describe duties of each shift and post.

• What equipment does the guard force have issued? Need?

• Do they require security clearances? What degree?

• Do they require special training?

• Is there a training program in force?

• What communications are available to the guard force to call outside the facility?

• Is the number of guards, posts, and patrol routes adequate?

• Are mechanical or electrical devices used in conjunction with the guard force?

• Do the guards know how to operate, reset, and monitor the devices properly?

• Do the guards know how to respond when the alarms are activated?

• Are guards included in emergency plans?

• Do guards know their duties? Emergency duties?

• Do guards make written reports of incidents?

• Are adequate records of incidents maintained?

• Are the guards familiar with the use of fire-fighting equipment?

Recommendations for changes must indicate each post, patrol, and so forth by number of hours for weekdays, weekends, and holidays, and brief description of the guard’s duties. List the total present coverage, total after recommendations, and the differences in hours. If your recommendations increase coverage you should justify the hours and the cost.

•Appendix D taken from Risk Analysis and the Security Survey, by James F. Broader (Stoneham, MA: Butterworths, 1984).

Appendix E

Best Practice #1: Detaining Shoplifting Suspects

May 1999[1]

The International Association of Professional Security Consultants is issuing this consensus-based Best Practice for the guidance of and voluntary use by businesses and individuals who deal or may deal with the issues addressed herein.

A. Background

Definition: As used in this bulletin, the term “security person(s)” is intended to include only store proprietors and managers, store plainclothes security agents sometimes called “detectives,” and uniformed security officers also called security guards (either proprietary or contract). The term does not include sales clerks, maintenance persons, or stockers, for example. The term “security person(s)” is not intended to apply to off-duty public law enforcement or special police personnel unless they have been instructed by store management to follow the same procedures required of ordinary citizens, which procedures do not include police powers of arrest.

1. Shoplifting is a serious threat to the profitability of retail stores. Losses in stores from shoplifting amount to billions of dollars a year. The public is affected by the increases in prices resulting from shoplifting losses.

2. The ultimate purpose of security precautions in stores is to keep merchandise items in the stores unless they have been paid for by customers. Loss prevention practices and procedures both deter and detect the theft of merchandise. Detention for further arrest and prosecution is a last resort only when other security precautions have failed to keep unpaid-for merchandise in the store.

3. In almost all jurisdictions in the United States, merchants are legally empowered to detain shoplifting suspects for investigation and possible arrest and prosecution in the criminal justice system. This power is called “merchant’s privilege.”

a. The merchant’s privilege provides for detention of persons suspected of shoplifting only when probable cause or reasonable cause exists to believe a person has committed theft. The best practice for establishing this probable cause (as compared to any legal standard) is the security person’s having met all the following six steps: (1) observe the customer approach the merchandise, (2) observe the customer select the merchandise, (3) observe the customer conceal (or otherwise carry away) the merchandise, (4) keep the customer under constant and uninterrupted observation, (5) see the customer fail to pay for the merchandise, and (6) detain the customer outside the store.

b. The merchant’s privilege permits detention for limited purposes which vary by state. Common among these limited purposes are: (1) ascertaining that stolen merchandise is possessed by the suspect, (2) identifying the suspect, (3) investigating the alleged theft, (4) recovering stolen merchandise, and (5) notifying the police of the offense. Some states permit limited searches of the suspect, some states limit the extent to which identity may be established; and the use of force which can legally be used is, if mentioned, always non-deadly. Many company or store policies further restrict permissible actions in dealing with shoplifting suspects; e.g., prohibiting pursuing suspects beyond company property.

4. In some circumstances shoplifting suspects are treated incorrectly by store management and security persons. Such treatment may cause results varying from simple mistakes to the violation of civil rights of suspects. If a best practice is not used, it is better not to detain a suspect than to risk the high cost of a civil liability suit. Two kinds of questionable detentions will illustrate this point. One kind applies to the customer who is truly an innocent party but whose conduct, for any number of reasons, led the security person to believe that a theft had occurred. People in this kind of detention are innocent victims of circumstance. The other kind applies to the customer who is not truly an innocent party, but for any number of reasons is not in possession of stolen merchandise when stopped by a security person.

5. Security persons usually do not actually “arrest” shoplifters, but simply detain them for police authorities. Exceptions arise to this practice in those states where private persons’ arrest powers exist concurrent with but separate from the “privilege” statutes discussed above. In these exceptional cases, security persons arrest after proof of the offense of theft.

6. Security persons cannot look into the minds of suspects. Security persons can only observe actions of suspects and completely and accurately report such actions. It is up to a judge or trier of fact to determine intent to deprive a merchant permanently of a taken item. See the discussion in 3.a. above. Step number 6 exists to help the judge or trier of fact determine the intent of the customer because the cash registers inside a store are normally the last place a person would have to pay for an item before departing a store. Reports by security persons are normally detailed enough to include other observations which would tend to establish intent.

The International Association of Professional Security Consultants, Inc. (IAPSC) has examined the methods of detaining suspects recommended by security professionals and practiced by merchants throughout the United States. IAPSC sets forth below what it believes to be the best practices.

B. Best Practices

1. Practice. Security persons using best practices detain a suspect only if they have personally seen the suspect approach the merchandise.

Rationale. The suspect may have entered the store with the merchandise already in hand or otherwise on or about their person (say, in a shopping bag or purse).

2. Practice. Security persons using best practices detain a suspect only if they have personally observed the suspect select or take possession of, or conceal the merchandise.

Rationale. Security persons trust their own eyes and do not rely on reports by others.

3. Practice. Security persons using best practices detain a suspect only if they have observed the suspect with the merchandise continually from the point of selection to the point where the suspect has gone beyond the last checkout station without paying for the item. If the surveillance has been broken, or if the person has gotten rid of the merchandise, the security person breaks off following for that offense, but may continue surveillance if it appears the suspect may commit theft again.

Rationale. The suspect may have “ditched” the merchandise or concealed it. By continually observing the suspect, the security person can observe whether or not the suspect still has the merchandise even if it has been concealed on the suspect’s person.

4. Practice. Security persons using best practices detain a suspect outside the store after the suspect has passed the last checkout station and has failed to pay for an item of merchandise. At this point security persons using this best practice immediately investigate to verify or refute a suspect’s claim of innocence. Special care and consideration is exercised when merchandise is displayed for sale outside the store, such as garden supplies, sidewalk sales, etc., or which is displayed for sale inside the store, but beyond the last sales point.

Rationale. The security person does not do only what is required to meet the minimum requirements of theft laws. The actions of a suspect make it easier to prove intent to deprive the merchant of an item of merchandise. The farther from the actual taking a suspect is detained, the clearer the offense will appear to a judge or trier of fact. The security person is aware of suspects who might claim they were looking for a matching item or looking for someone to give an opinion on the merchandise before it is purchased. A suspect may, however, offer a logical explanation for actions that initially appeared to the security person to be acts of shoplifting, but which may require only a limited investigation to verify the suspect’s explanation.

5. Practice. Security persons using best practices normally do not “chase” suspects by running inside a store or in shopping centers that are occupied by customers. Exceptions occur when necessary, but only in such areas as parking lots, and then only when few people are in the area and it is unlikely a bystander could get hurt. Such foot pursuits never leave the property on which the store is located. If a suspect runs, the best practice is for the security person to make a mental note of the appearance of the suspect and the merchandise that appears to have been taken; then to make a written report for the store’s files.

Rationale. Running may create more problems than it solves. When a suspect runs and a security person chases that person by also running, clients and employees of the store and store employees are endangered more by the combination of two persons running than by the suspect’s running alone. Handicapped clients may be knocked off their feet. Wheel chairs may be overturned. Store employees who may intervene to help may be injured by security persons in pursuit, or by running into counters or display devices, or by slipping on polished floors. When clerks leave their posts, they leave their own merchandise exposed to theft. An exception to this best practice may exist when it is necessary to chase a suspect down in order to protect customers and store employees from ongoing violence by the suspect.

6. Practice. Security persons using best practices treat suspects equally and fairly regardless of a suspect’s race, color, creed, gender, or national origin.

Rationale. Anecdotal information suggests certain groups have been marked by some store management and security persons for more surveillance and/or more aggressive anti-shoplifting measures. Color, religious or national dress, gender, and “race” are alleged to have been used to identify persons in such groups. However, there is no scientific evidence regarding the validity of such “profiling,” and this practice is avoided by security persons using best practices. Suspicion of shoplifting depends upon observed actions, not appearance. All law-abiding persons have the right to be treated the same as any other person in the marketplace.

7. Practice. Security persons using best practices do not use weapons such as firearms, batons (“nightsticks”), or restraining devices such as thumb cuffs, “comealongs,” mace, or pepper spray in order to apprehend or detain a shoplifting suspect. Stores using best practices occasionally permit the use of handcuffs by security persons whose training has included instruction in the proper use of handcuffs when necessary to prevent injury to customers or store personnel. Security persons using best practices use handcuffs only when a suspected shoplifter is physically threatening violence or otherwise resisting detention; or there is, in the good judgment of the security person, the risk of imminent serious harm absent their use.

Rationale. There is no merchandise of such value that it warrants a security person’s injuring a suspect or an innocent customer. Use of weapons and restraining devices except handcuffs should be left to on-duty public law enforcement officers. If it is not possible to get the suspect’s willing cooperation, it is better to let the suspect go free than to risk injuring a suspect or other customer. Risk avoidance is a factor considered in apprehending and detaining suspects. Because handcuffs are restraining devices, they can be painful if improperly applied and can cause injury. Not all persons caught need restraining. Many people caught shoplifting are humiliated by the incident and are cooperative; hence, in such cases restraint is not necessary.

8. Practice. Security persons using best practices limit the use of force to “holding” or “restraining” to effect a detention. Security persons using best practices do not use actions such as striking, tackling, sitting on a suspect’s body, or any other action that might cause physical injury to the suspect.

Rationale. Use of force is subject to criticism, and assaultive use of force is typically unnecessary and unacceptable in the private sector. However, some holding or restraining may be necessary lest potential thieves learn that by simply resisting they may come and steal with impunity. Use of limited holding or restraining force is sometimes necessary to detain a suspect until police arrive, or to prevent a suspect from injuring security persons. Under no circumstances should the force applied be that which may result in injury or death to a suspect. No merchandise is of such value as to justify physical injury to a suspect. The better practice is to allow the suspect to depart the premises rather than to cause any injury by the use of force in detaining the suspect. Assuming the suspect can be identified, the merchant can file a complaint; then the public police have the option of apprehending the suspect at a later time.

LEGAL NOTICE/DISCLAIMER: Copyright © 1999–2006 The International Association of Professional Security Consultants (IAPSC), All Rights Reserved. The IAPSC makes no representations concerning the guidelines contained herein which are provided for informational and educational purposes only, and which are not to be considered as legal advice. The IAPSC specifically disclaims all liability for any damages alleged to result from or arise out of any use or misuse of these guidelines.

[1]Best Practice #1: Detaining Shoplifting Suspects, was published in May 1999 by the IAPSC. It stood as the industry’s most authoritative guideline until the decision was made in 2012 to expand and clarify some issues that were tested in the crucible of civil and criminal trial. At press time the revised Best Practice #1 had not gone through the full approval process. That new and approved Best Practice is now publicly available and can be found on the IAPSC Website at: www.iapsc.org.

Appendix F

Best Practice #2: Forensic Methodology

Table of Contents

Position Statement

Evidence Review–The Process

Risk Assessment

Threat Assessment

Vulnerability Assessment/Security Survey

Analysis and Opinions

Bibliography

Forensic Security Committee Members

Cases Citing the Methodology

Document Revision History

The International Association of Professional Security Consultants has issued this consensus-based and peer-reviewed Best Practice for the guidance of and voluntary use by businesses and individuals who deal or may deal with the issues addressed in the context of third-party premises security litigation.

Position Statement

The International Association of Professional Security Consultants does hereby recognize that its members will be called upon to perform as “Forensic Consultants” and serve as Expert Witnesses in a court of law or other legal proceeding. The purpose of these guidelines is to meet the need for a standardized methodology used in the evaluation of premises security cases.

It is recognized that the task of the Forensic Consultant is one of education. Forensic Consultants will provide their opinion(s) to the client, to opposing counsel during deposition, in response to written interrogatories, in reports, and to the judge and jury at trial or any other lawfully convened hearing. This is done with the goal of making others aware of the security issues and contributing to a just and proper conclusion on the litigation.

The responsibility of the Forensic Consultant lies within our system of justice and the ethics of the security profession. The opinions so offered are made as an objective expert witness/consultant, without any financial or other interest in the outcome of the litigation.

Forensic Consultants will, at all times, be forthright, honest and precise in evolving the ultimate conclusion(s) and opinion(s). The opinion(s) will be the result of a review of all available documentation and discovery material presented by all parties to the litigation. Site inspections and analytical procedures generally followed by the “Forensic Consultant” are described in these guidelines.

The following methodology is to be used in a typical premises security case. The Forensic Consultant is expected to exercise diligence in requesting and/or obtaining information that the Consultant reasonably believes is relevant to the facts and circumstances of the case. It is reasonable to expect variations of the steps, with some steps deleted and others added as the facts and circumstances of the case being analyzed warrant.

Evidence Review—The Process

In the context of this guideline, the Forensic Consultant will review and analyze various information, whether produced during the discovery process of the litigation or otherwise obtained through research, common knowledge, investigation, and/or other legal means that allow the Consultant to identify factors leading to an understanding of the crime risks present at the time of the criminal event.

Types of evidence generally available to the Forensic Consultant include, but are not limited, to the following:

1. Complaint/Petition

2. Police Report

3. Site and Immediate Vicinity Crime History

4. Interrogatories and Responses

5. Requests for Production of Documents and Responses

6. Requests for Admissions and Responses

7. Affidavits, Witness Statements, and Interviews

8. Depositions

9. Expert Witness Reports

10. Medical Records Relating to the Facts of the Case

11. Photographs, Video, and Audio Recordings, etc.

12. Other Related Evidence

Risk Assessment

A risk assessment is the general process of identifying and prioritizing risks. It is a qualitative, quantitative, or hybrid assessment that seeks to determine the likelihood that criminals will successfully exploit a vulnerability or compromise a security countermeasure.

There are two main components to a risk assessment: a threat assessment and a vulnerability assessment. The threat assessment is an evaluation of the various sources for crime threats. The vulnerability assessment, which includes a security survey, is an analysis of the weaknesses in a security program.

The security survey, along with documented evidence, is the means by which security measures utilized and/or available at the facility at the time of the incident leading to the incident that is the subject of the litigation are identified and analyzed.

A risk assessment provides the foundation for effectively implementing countermeasures.

Threat Assessment

A threat assessment is an evaluation of events that can adversely affect operations and/or specific assets. Historical information is a primary source for threat assessments, including past criminal and terrorist events. A comprehensive threat assessment considers actual, inherent, and potential threats.

1. Actual Threats

a. The crime history against an asset or at a facility where the asset is located. Actual threats are a quantitative element of a threat assessment.

b. Relevant crimes on the premises (three to five years prior to the date of the incident).

c. Relevant crimes in the immediate vicinity of the facility (three to five years prior to the date of the incident).

2. Inherent Threats

Threats that exist by virtue of the inherent nature or characteristics of the facility or nature of the operation. For example, certain types of facilities or assets may be a crime magnet or prone to loss, damage, or destruction (e.g., assaults among patrons in nightclubs, infant abductions from hospital nurseries, etc.).

3. Potential Threats

Threats which exist by virtue of vulnerabilities around the asset or weaknesses in the security program which produce opportunities for crime to occur.

Vulnerability Assessment/Security Survey

The vulnerability assessment is an analysis of security weaknesses and opportunities for criminal activity. A security survey is the fundamental tool for collecting information used in the vulnerability assessment.

A security survey is a physical survey of the scene of the incident and areas/functions that are applicable to the incident to achieve a meaningful understanding of information that has potential application to the matter in litigation.

1. Incident Review

a. Police incident and investigation report

b. Proprietary incident report

c. Medical records (emergency room and/or autopsy as it relates to information about the occurrence of the incident)

d. Other sources of information about how the incident occurred

2. Site Inspection—Inspect site where the incident occurred and the surrounding relevant area. (Note that not all cases will require site inspections, nor is it always possible to conduct site views—e.g., if the site has been altered substantially or no longer exists). Further, the facts of some cases and potential liability issues are not related to the site/property layout, design, or other physical attributes. As such, a site inspection may be unnecessary.

a. Determine layout of the premises

b. Evaluate relevant factors (lighting, lines of sight, places of concealment, remoteness, accessibility, security measures, conditions, etc.)

c. If and when appropriate and as allowed by local rules of evidence, interview those with knowledge of the incident and/or the premises/surrounding area (this is often covered in depositions, police interviews, and private investigators’ investigations)

d. Review relevant documentation (lease, contract, diagram, map, etc.)

e. Assess the characteristics of the surrounding area

3. Security Personnel

a. Review security officer(s) actions, staffing levels, post orders, duty hours, equipment provided, tours, evaluations, training, hiring procedures, and supervision

b. Review law enforcement presence and actions (e.g., on-duty, police details, etc.)

c. Review roles and actions of non-security related persons who may have participated in the security program and/or incident

d. Assess the qualifications and performance of owner/management personnel overseeing the security program

4. Security Program

a. Review security-related policies and procedures

b. Review risk assessments performed prior to the date of the incident

c. Review daily activity reports, job descriptions, incident reports, and internal correspondence

d. Review security services contract

e. Review security manuals

f. Review training manuals and materials

g. Interview parties and/or review depositions regarding employees’ understanding of their duties, and all customs and undocumented practices

h. Review changes to security prior to the incident

i. Evaluate the qualifications and experience of security management and supervisory personnel

5. Security Equipment

a. Review building design and site plans

b. Inspect all security devices related to the incident

c. Inspect all structural security features

d. Determine the position, function, and maintenance status of the relevant security equipment and features

e. Determine levels of illumination, if relevant

Analysis and Opinions

The security expert will determine the level of adequacy of security at the location of the incident on the date and at the time the incident occurred. This will be based on the information obtained in the previous steps, and the application of a qualitative analysis based on experience, education, and training.

Based on the analysis, the expert will reach conclusions on the issues of foreseeability, preventability, and causation (i.e., terms as used in the security profession). At this point the expert has formed opinions and is prepared to provide a written report, be deposed, and/or testify at trial. Those opinions will state the detailed bases for the findings, including evidence, standards, best practices, and guidelines, where applicable.

Bibliography

1. The process of evaluating the risk of crime at a specific location or geographical area is widely recognized and has been adopted nationwide by private industry, public law enforcement, municipalities, and other governmental agencies. The following published sources reference the process used to perform a crime risk analysis. This is not all inclusive, but a representative sampling of available references.

2. This bibliography is not to be construed in any way as an endorsement by the International Association of Professional Security Consultants of the publications or the respective authors.

3. ASIS International (2003). General Security Risk Assessment Guideline, Alexandria, VA.

4. Bates, Norman D. (1997). “Forseeability of Crime and Adequacy of Security,” Accident Prevention Manual for Business & Industry, Security Management, National Safety Council.

5. Broder, James F. (2006). Risk Analysis and the Security Survey, Boston, MA: Butterworth-Heinemann.

6. Crowe, Timothy D. (2000). Crime Prevention Through Environmental Design, National Crime Prevention Institute, Boston, MA: Butterworth-Heinemann.

7. Department of the Navy, Naval Facilities Engineering Command, (1983). Physical Security Design Manual 13.1, Washington, DC: Government Printing Office.

8. Eck, John E. and David Weisburd (1995). Crime and Place, Monsey, NY: Criminal Justice Press (Police Executive Research Forum).

9. Gottlieb, Stephen, Sheldon Arenberg, and Raj Singh (1998). Crime Analysis: From First Report to Final Arrest, Montclair, CA: Alpha Publishing.

10. International Association of Crime Analysts (2004). Exploring Crime Analysis, Overland Park, KS: International Association of Crime Analysts.

11. Miethe, Terance D. and Richard McCorkle (1998). Crime Profiles: The Anatomy of Dangerous Persons, Places, and Situations, Los Angeles: Roxbury Publishing Company.

12. National Crime Prevention Institute (2001). Understanding Crime Prevention, Boston, MA: Butterworth-Heinemann.

13. Bates, Norman D., and Danielle A. Frank (2010). “Premises Security Experts and Admissibility Considerations Under Daubert and Kumho: A Revised Standard,” Norman D. Bates and Danielle A. Frank, Suffolk Journal of Trial and Appellate Advocacy.

14. Sennewald, Charles A. (2003). Effective Security Management, 4th Edition. Boston, MA: Butterworth-Heinemann.

15. U.S. Army Corps of Engineers (1990). Security Engineering Manual, Missouri River Division/Omaha District.

16. U.S. Department of Justice, Federal Bureau of Investigation (Revised 2004). UCR: Uniform Crime Reporting Handbook Washington, DC: U.S. Government Printing Office.

17. U.S. Department of Justice (1995). Vulnerability Assessment of Federal Facilities, Washington, DC: Government Printing Office.

18. Vellani, Karim H. (2006). Strategic Security Management: A Risk Assessment Guide for Decision Makers, Woburn: Butterworth-Heinemann.

Forensic Security Committee Members

1. Norman D. Bates, Esq., Committee Chairman; President, Liability Consultants, Inc.

2. John Case, CPP, John Case & Associates.

3. James H. Clark, CPP, Managing Partner, Clark Security Group, LLC.

4. Lance Foster, CPP, CSC, Security Associates, Inc.

5. William A. Hawthorne, CPP, CSC, William A. Hawthorne Associates, Inc.

6. Steve Kaufer, CPP, CSC, Inter/Action Associates, Inc.

7. Robert Shellow, PhD, CSC, Fellow, APA, President, IMAR Corporation.

8. Ira S. Somerson, BCFE, CPP, CSC, Loss Management Consultants, Inc.

9. Karim Vellani, CPP, CSC, Threat Analysis Group, LLC.

10. Ralph W. Witherspoon, CPP, CSC, Witherspoon Security Consulting.

11. Alan W. Zajic, CPP, CSP, AWZ Consulting.

Cases Citing the Methodology

1. Childress v. Kentucky Oaks Mall, 2007 WL 2772299 (W.D. KY) 2007.

2. Reinaldo Robles Del Valle, et al v. Vornado Realty Trust, 06-1818 US Dist. Crt.,.

3. Puerto Rico, 2009.

Document Revision History

1. Initial Release: June 2000 with approval by the IAPSC membership in attendance at the annual meeting.

2. Revised: May 2, 2005 with approval by the IAPSC membership in attendance at the annual meeting.

3. Revised: November 2008 with approval of the Board of Directors.

4. Revised: November 2011 by the Forensic Security Committee—minor formatting changes and addition of “Premises Security Experts…” article to bibliography.

Appendix G

Best Practice #3: Use of Force by Security Personnel

Table of Contents

Position Statement

Best Practice Committee Members

Document History

Addendums: Sample Policy Statement and Use of Force Factors

Further Reading

Position Statement

The International Association of Professional Security Consultants has issued this consensus-based and peer-reviewed Best Practice for the guidance of and voluntary use by businesses and individuals who deal, or may deal, with the issues addressed in the context of the use of force by security personnel.

I. Purpose

The purpose of this best practice is to provide guidance to organizations in the development of an internal policy for the use of deadly and non-deadly force by their security personnel when such force is permitted. Organizations should take into consideration the laws of their jurisdictions and any existing model policies for guidance.

It is recognized that some organizations prefer that their security personnel limit their role to that of an “observe and report” function and do not use force in the course of their work.

II. Definitions

Deadly Force: Any use of force that is reasonably likely to cause death or serious bodily injury.

Documentation: Documentation includes written reports, written statements, video recording, audio recording, photographs, etc.

Non-Deadly Force: Any use of force other than that which is considered deadly force. This includes any physical effort used to control or restrain another, or to overcome the resistance of another, including that force necessary to remove an individual from a premise.

Objectively Reasonable: This term means that, in determining the necessity for force and the appropriate level of force, security personnel are to evaluate each situation in light of the known circumstances, including, but not limited to, the seriousness of the incident, the level of threat or resistance presented by the subject, and the level of threat or resistance to the community.

Security Personnel: Individuals, other than public employees (federal, state, or local government), employed part or full-time, in uniform or plain clothes, contract or proprietary, hired to protect the employing party’s assets, ranging from human lives to physical property (the premises and contents). This definition includes individuals who are not security personnel, but who regularly perform security-related tasks (e.g., individuals who perform security-related functions in a bar/nightclub, retail loss prevention, etc.).

III. Policies

A. Use of Deadly Force

Security personnel are authorized to use deadly force to protect the officer or others from what is objectively and reasonably believed to be an imminent threat of death or serious bodily harm.

B. Use of Non-Deadly Force

1. Where deadly force is not appropriate, security personnel may use only that level of force that is objectively reasonable to bring an individual under control.

2. Security personnel are only authorized to use non-deadly force techniques and issued equipment to:

a. Protect the security personnel or others from physical harm;

b. Lawfully restrain or subdue a resistant individual; and/or

c. Bring a situation safely under control.

C. Training

In addition to training required for firearms qualification pursuant to local law, security personnel are to receive periodic employer training/instruction to enhance the security personnel’s discretion and judgment when using force in accordance with this policy. Employers should provide appropriate training given the type of equipment and force, which may be used by their security personnel.

D. Documentation

All incidents involving the use of force by security personnel will be documented.

Best Practice Committee Members

Alan W. Zajic, CPP, CSP, AWZ Consulting, Ad-Hoc Chairman, Committee on the Use of Force by Security Personnel

Norman D. Bates, Esq., Best Practice Committee Chairman; President, Liability Consultants, Inc.

John Case, CPP, John Case & Associates

Tommy J. Burns, CPP, Burns and Associates

Document History

First Draft sent out for 45-day membership comments closed 10/21/2011

First Draft sent out for Non-Member review closed 10/21/2011

Review of commentary by Ad Hoc Committee 01/11/2012 and 01/26/2012

Second Draft sent out for 45-day membership comments closed 03/19/2012

Review of commentary by Ad Hoc Committee 03/30/2012

Final Draft to Board for Vote 04/15/2012

Addendums

Sample Policy Statement:

It is the policy of [this organization, business/enterprise] that security personnel use only the force that reasonably appears necessary to effectively bring an incident under control, while protecting the lives and safety of the invitees, employees, and others as is reasonably possible. Security personnel should attempt to deescalate any situation before using any level of force upon a person. Should the use of physical force be deemed required, security personnel are to use only that amount of force necessary to overcome the opposing resistance. The use of force must be objectively reasonable. The security personnel must only use that force which a reasonably prudent person would use under similar circumstances.

Use of Force Factors:

The following are among the factors that should be considered when developing a use of force policy:

1. Seriousness of the act or crime

2. Size, age, and weight of the subject

3. Apparent physical ability of the subject

4. Weapons possessed by or available to the subject

5. Known history of violence by the subject

6. Whether the subject appears to be under the influence of an intoxicating substance

7. Presence of bystanders

8. Distance from the threat, ability to retreat, and the availability of backup

Further reading

1. This bibliography is not to be construed in any way as an endorsement by the International Association of Professional Security Consultants of the publications or the respective authors.

2. ASIS International. Private Security Officer Selection and Training Guideline, ASIS, 2004, 2010.

3. Bates, Norman D. (1989) “The Disarming Question of Arming Guards,” Security Management, November 1989.

4. Burns, Tommy J., A Force to Reckon With, Security Management, July 2011.

5. Christman, John H., Sennewald, Charles A., Shoplifting, Managing the Problem. ASIS International, 2006. Use of force, pp. 199, 208, 262.

6. Graham vs. Connor, 490 U.S. 386 (1989).

7. IACP National Law Enforcement Policy Center, Use of Force—Concepts and Issues Paper. Alexandria, VA, 2006.

8. International Association of Chiefs of Police. Use of Force Model Policy, Alexandria, VA, 2001.

9. International Association of Chiefs of Police. Private Security Officer Selection, Training and Licensing Guidelines, Alexandria, VA, April 24, 2002.

10. Mains, Paul, CPP, (2006) Use of Force in Private Security: A Primer, Journal of Healthcare Protection Management.

11. Mains, Paul, CPP, (2010) Security Officer Use of Physical Force, International Association for Healthcare Security and Safety.

12. O’Malley, Michael T., MOAB®, (2010) Training International Inc., MOAB® Management of Aggressive Behavior Reference Guide.

13. Sennewald, Charles A., Christman, John H., Retail Crime, Security, and Loss Prevention. An Encyclopedic Reference. Elsevier Books, 2008. Use of force, pp. 312, 315, 404, 578-579.

Appendix H

A Timeless Message

20th Anniversary Conference

Remarks by Robert O. Murphy, CPP

Founding Member, Past President (1987–1989)

Delivered April 26, 2004

Newport Beach, California

Thanks for this opportunity to address my assembled peers at this splendid seaside setting. As I have often said in the past, we may not be the brightest bunch, but we certainly are adept at finding nice places to meet.

In January 1984, my motivations to journey to Manhattan Beach were several. It sounded much warmer than South Bend. My oldest son was living in Studio City. And the prospects of sharing ideas and experiences with my security consulting colleagues were attractive. That was the initial rationale for the founding of the IAPSC, and it continues to pertain. It was not seen as a conduit to clients, though if that eventuated so much the better.

That was then. This is now. In the twenty-year interim we have not had the smoothest ride through time. But we have survived, and to a considerable degree we have thrived. We never envisioned a large organization, and we obviously don’t have one. Our strength is rigorous selectivity.

But let’s look ahead to the time when some of you here may assume the mantle of IAPSC leadership. First, let me express my admiration for our present officers. They are doing a fine job. And thanks also to Kathy Rinkenberger for her good work. She is invariably pleasant, helpful, and competent.

Let’s look at present conditions in the world of commerce and see if we can’t learn something as consultants from the travail we all read about. The New York attorney general and the Securities and Exchange Commission are shaking the banking and investment trees on Wall Street and have uncovered corruption involving analysts and the investment banking firms they work for. A year ago Merrill Lynch, Morgan Stanley, and Citigroup, and seven other firms were forced to pay more than $1.4 billion in settlements for wrongful activities. Of course, these giants neither admitted nor denied guilt. But they paid.

We have seen the vaporization of Arthur Andersen, the accounting giant, caught in the Enron quicksand debacle and other unfortunate delinquencies. On April 15, less than two weeks ago, the Securities and Exchange Commission barred Ernst & Young from accepting new corporate clients for six months for failing to maintain its independence from a company whose books it audited. The SEC said that Ernst & Young “has an utter disdain” for the SEC’s regulations on auditor’s independence. It was the first time in 29 years that the SEC had sought the suspension of a major accounting firm. Ernst also had to pay $1.7 million in restitution.

On April 8, the SEC announced that Putnam Investment Management was ordered to pay a $50 million civil penalty and $5 million in disgorgement for violating federal security laws. The money will be distributed to investors harmed by market timing trading. I am fascinated by that term “disgorgement.” It occurs when a glutton throws up.

The Chicago Tribune several months ago had an editorial captioned, “Is anyone honest anymore?” It cited a poll which found business executives in general were considered honest and ethical by just 18% of the respondents. There was no assessment relating to security consultants. Fortunately.

So what does big-time corruption and felonious conduct among the titans have to do with us? I say it highlights the utter necessity for the IAPSC to keep on track and be above any suggestion of corruption.

We have several things to offer: competence, objectivity and integrity. And the greatest of these is integrity.

Let’s recognize that the world of commerce is awash in the sewer water of self-serving criminality. Men wearing $2,000 tailored suits and leading billion-dollar corporations have the morals of muggers. The only thing they know about ethics is that it starts with an “e” and ends with an “s.” What they have done is to distort the free enterprise system that has been so compellingly beneficial to our country.

Let’s be different. Very different. In our individual practices and in the governance of the IAPSC, let’s avoid the quick, the clever, and the questionable. Let’s do what is transparent, trustworthy, and truthful. Smoking one past the IAPSC membership won’t happen because it is patently wrong.

In the IAPSC, let’s take the high road in preference to the low road. The view is much better and so is the aroma.

Know that the IAPSC has no secrets. There is no hierarchy here. This is an association of equals. Each one of us as members can ask for and get any detail of IAPSC operations and functions.

Let’s go forward with the invincible resolution that as individual practitioners we will provide ethical and exemplary services. We are security consultants. We are not investigators. We are not manufacturer’s representatives.

WE ARE THE INTERNATIONAL ASSOCIATION OF PROFESSIONAL SECURITY CONSULTANTS.

And as members we will ensure that the IAPSC will always be a sure beacon, honored for the quality of its members and esteemed for its glimmering integrity.

Thank you.

Appendix I

Outline of the IAPSC’s Successful Security Consulting Program

Course Description

“This is the only course offered on how to successfully launch a new security consultant practice or jump-start an existing one—this popular, intensive program will show you how! Learn from a faculty of seasoned consultants how to develop and market yourself as a security consultant and how to avoid the expensive mistakes that can sabotage your success. The program is filled with practical information that will save you time, money, and frustration. Take home a comprehensive workbook of sample proposals and reports that give you a clear advantage when competing for a security consulting assignment.”

Richard Grassie

Session 1: SSC Introduction, Overview, and Objectives

The course introduction describes the key elements involved in launching a new security consultant practice, plus it covers all of the topics to be presented over the course of a day’s teaching. The introduction also highlights how existing security consultants will pass on valuable best practices on how to avoid the expensive mistakes that can sabotage your eventual success as an independent security consultant. Finally, the introduction emphasizes how the course uses practical, hands-on information about the business of security consulting that will save you time, money, and frustration in forming your own practice.

Session 2: The Business of Security Consulting

The business of security consulting is a key topic in this course, as it describes the essential traits for success as a security consultant including determination, skill, integrity, experience, and expertise in your specialty as guarantors of success. Emphasis is placed on the utilization of professional contacts, how to develop and hone marketing skills, and how to develop and implement a realistic business plan. A key element of the business of security consulting topic, building a trust relationship with end users, is treated in quite a bit of detail in the course. The full spectrum of possible consulting concentration areas is explored, along with areas where individuals can concentrate their services. Also covered is how to build a practice around key consulting specialties, namely technical security consulting, forensics or expert witnessing, security management consulting, and IT security consulting. Finally, the professional security environment for consulting is explored with an emphasis on the security consultant’s role in an organization, how to add value to a client’s operation, essential consultant’s skills, and how to implement each of the five consulting phases.

Session 3: Defining and Marketing Your Services

This session emphasizes the marketing aspects of building a successful security consulting practice, or how to make your business “fit” the desired marketplace where your expert services will be sold. The difference between “sales” and “marketing” is described in terms of how best to market or introduce your services and how to effect the sell aspect and close the deal for your services. Attendees are instructed on how to identify and target certain market segments, such as the entertainment industry, government sales, or industrial security. The concept of marketing your consulting practice is explored in some detail for the attendee. Issues such as researching market problems and opportunities, selecting and developing market targets, how to develop multiple markets, qualifying and responding to valid opportunities, how to reach out to end users, and how to develop a specific expertise in a market segment and sell it are all addressed. Specific challenges and tips on dealing with marketing or sales implementation problems, including positioning your business, are discussed, plus the best ways you can introduce yourself to the targeted industry.

Session 4: Developing and Submitting Winning Proposals

A key aspect of developing a successful consulting practice is the understanding of how to identify opportunities, develop winning proposals, and beat out the competition for competitive bids. Proposal basics are discussed including getting wind of opportunities before they expire, the types of bid packages and proposals one might encounter (RFP, RFQ, RFI, and Sources Sought), how to cost estimate a job, the various types of contractual relationships, and how to fully and completely respond to a bid. Attendees are told how to develop a winning proposal theme and format, how to document your approach and position in a proposal, and how to follow up after a proposal is submitted. The time-consuming nature of proposals is discussed and how best to allocate resources so that proposals fit into the business cycle rather than upend it.

Session 5: Completing the Consulting Assignment

Once the consultant lands the work, the next topic is how to complete the consulting assignment in a professional manner so the client uses the consultant’s services repeatedly. The types of essential consulting skills, such as technical, interpersonal, and consulting, are discussed, along with the four key phases of consulting: contracting, discovery, feedback, and decision. The consultant’s role in a given assignment is explored including certain roles that the consultant might avoid due to the culture of the organization within which the services are offered. A key element of the advice/consultation role that is stressed is how to develop and build influence over an individual, group, or organization when the consultant typically has no direct power or resources to make changes or implement programs within that organization. This session emphasizes how the consultant offers and delivers advice and technical support to a group known as “clients” and describes how the “client” must be expertly influenced for the consultant to be successful. Finally, the goals and objectives of the consultant in an engagement are discussed in terms of identifying problems, solutions, and engaging in actions that result in people or organizations managing themselves or doing things differently.

Session 6: Conducting Security Audits and Assessments

As one of the key aspects of any security consulting job, this session covers the topic of how to conduct security audits and assessments and deliver professional reports. The various types of audits/assessments are addressed, including the security survey involving a review of the existing security program or system and the security audit where operations are measured against specific documentation (standards, guidelines, regulations, etc.). The various phased aspects of the security assessment are explored, including how to conduct an asset analysis, threat analysis, vulnerability analysis, risk analysis, and requirements analysis. The various client circumstances that would generate the need for a security assessment are identified, along with a discussion of whether the current security program’s individual and collective elements are sufficient and potentially responsive to short- and long-term asset protection needs, including personnel, physical property and information, technologies, guards, procedures, and information safeguards. Attendees are also instructed in how to assess current security postures against new requirements, determine vulnerabilities and corresponding mitigation strategies, and produce written planning guidance in the form of a formal assessment report. Some automated assessment tools are identified and discussed.

Session 7: The Business of Expert Witnessing

This session covers the subject of focusing your security consulting business on a expert witness skills. In a practice such as this, the emphasis is on a number of topics, such as how to start your practice, what constitutes an expert, how to market yourself to attorneys, contracting, conducting the survey, direct and cross-examination and persuasion skills, report writing, depositions, testifying, legal issues, practice management/risk management, and practice development.

Session 8: Preparing a Responsive, High-Impact Consultant’s Report

This session covers the types of reports and report formats typically prepared and submitted by security consultants. The security assessment report, design concept report, system design and assessment phase report, the architectural project phase reports, the design specifications and drawings, and the forensic reports. The specific content of each type of report is discussed along with report examples.

Session 9: Money: The Good, the Bad, and the Ugly

This session addresses all the financial aspects of starting and operating an individual consulting practice. Topics covered include the consulting process, project lead qualification, proposed scope of services and compensation, how to win the contract, executing purchase orders, performing the scope of work according to a set budget, invoicing for services, and collecting payments. Attendees will be given detailed instruction on how to arrive at a reasonable bill rate and how to determine your cost basis hourly rate, including salary, expenses, and billable hours.

Session 10: Project Teaming and Business Planning

This session covers the topics of teaming with your contemporary security consultants and business planning. The session begins with a discussion of the three basic purposes of teaming, namely communications, management, and planning. The advantages and disadvantages of teaming with other consultants are explored in terms of marketing and proposal preparation, and project execution. Prospective consultants are then instructed in how to prepare an initial business plan for your practice including the key business plan components: business description, markets, competition, financial projections, service delivery, sales and marketing, and partnering with other consultants.

Session 11: Back-of-the-House Mechanics

This session describes the essential administrative and accounting aspects of the consultant’s own practice and how to administer the practice as a business on a daily business. Setting up the legal entity is covered, plus naming your company, developing a website, creating your letterhead/logo, types of insurance, office set-up, accounting, budgeting, human resources, time tracking, newsletter, trade groups, and performance metrics.

Session 12: Convergence Consulting

This session introduces and covers the topic of convergence (a holistic view of physical and logical security) and how convergence consulting is fast becoming a lucrative area. Instruction emphasizes how the emergence of networks and technology has resulted in quantum shifts in the security industry. Security consulting is now split between physical and logical security, and the issue of organizational convergence is more an organizational than a technical phenomenon. Instruction emphasizes the fact that certain types of organizations benefit from convergence and how the key aspect is risk management and control. A model for convergence consulting is introduced, along with the benefits of assuming a holistic view of an organization’s risks and security elements.

Bibliography

References

1. Broder, J.F., Tucker, E., 2012. Risk Analysis and the Security Survey, 4th ed. Butterworth-Heinemann, Boston.

2. Block, P., 2011. Flawless Consulting: A Guide to Getting Your Experience Used, 3rd ed. Pfeiffer: San Francisco.

3. Blount, J., 2010. People Buy You: The Real Secret to What Matters Most in Business. John Wiley & Sons, New York.

4. Canyon, T., 2009-2010. The Fast Start Guide to Becoming a Highly Paid Independent Consultant. Ebook, Market Annex LLC.

5. Chronicle Guidance Publications, 1987. Security Consultants. (brief 563). Guidance Pub., Moravia, NY.

6. Connor, R.A. Jr,. Davidson, J.P., 1997. Marketing Your Consulting and Professional Services, 3rd ed. John Wiley & Sons, New York.

7. Crawford, M.A., 1984. Consultants on consultants. Security Management (February), 16.

8. Dalton, D.R., 2003. Rethinking Corporate Security in the Post 9/11 Era: Issues and Strategies for Today’s Global Business Community. Butterworth-Heinemann, Boston.

9. Franklin, R.A., 1996. The Consultant’s Guide to Publicity: How to Make a Name for Yourself by Promoting Your Expertise. John Wiley & Sons, New York.

10. Gouin, B., 2007. Security Design Consulting: The Business of Security System Design. Butterworth-Heinemann, Boston.

11. Holtz, H., and Zahn, D., 2004. How to Succeed as an Independent Consultant, 4th ed. John Wiley & Sons, New York.

12. Janson, J.J. Jr., 1983. Security consultant? Professional Protection (March/April), 36.

13. Janson, J.J. Jr., 1982. Time: what is yours worth? Professional Protection (March): 10.

14. Kaufer, S., CPP., 1991. A user’s guide to consultants. Security Management (February).

15. Kaufer, S., CPP., 1995. Using outside expertise to improve security. Security Technology and Design Magazine (March).

16. Keller, S.R., CPP, 1988. Clearing up cloudy skies. Security Management (January), 47.

17. Levinson, J.C., McLaughlin, M.W., 2005. Guerrilla Marketing for Consultants: Breakthrough Tactics for Winning Profitable Clients. John Wiley & Sons, New York.

18. Littlejohn, R.F., CPP., 1993. Consulting: A New Role for the Security Manager, Encyclopedia of Security Management. Butterworth-Heinemann, Boston.

19. Lydon, K., 1988. Stretching dollars with consulting services. Security (February), 57.

20. Merron, K., 2005 Consulting Mastery: How the Best Make the Biggest Difference. Berrett-Koehler Publishers, San Francisco.

21. Morris, R.A., Sember, B.M., 2008. Project Management That Works: Real-World Advice on Communication, Problem-Solving, and Everything Else You Need to Know to Get the Job Done. American Management Association (AMACOM), New York.

22. National Forensic Center, 1988. The expert and the law. A publication of the National Forensic Center (8):3, 4.

23. Patterson, D.G. III, 2004. Implementing Physical Protection Systems: A Practical Guide. ASIS International, Alexandria, VA.

24. Poynter, D., 1997. The Expert Witness Handbook: Tips and Techniques for Litigation Consultant, 2nd ed. Para Publishing, Santa Barbara, CA.

25. Serb, T., 1983. Calling all consultants. Security World (January), 9.

26. Shenson, H.L., Wilson, J.R., 1993. 138 Quick Ideas to Get More Clients. John Wiley & Sons, New York.

27. Siver, E.W., 1984. The ten commandments for choosing and using consultants. Risk Management (June), 64.

28. So you want to be a consultant, 1991. Security Management (February).

29. Veich, A.M., 1992. Guidelines for garnering a good consultant. Security Management (January).

30. Vellani, K.H., 2007. Strategic Security Management: A Risk Assessment Guide for Decision Makers.Butterworth-Heinemann, Boston.

31. Walsh, T.J., Healy, R.J., 1985. The Protection of Assets Manual. The Merritt Company, Santa Monica, CA.

32. Weiss, A., 2009. Million Dollar Consulting: The Professional’s Guide to Growing a Practice, 4th ed. New York: McGraw-Hill.

33. Whitman, M.E., Mattord, H.J., 2010. Management of Information Security, 3rd ed. Thomson-Course Technology, Boston.

34. Wiefling, K., 2007. Scrappy Project Management: The 12 Predictable and Avoidable Pitfalls Every Project Faces. A Happy About series, Cupertino, CA.

Index

A

AA. See Advertising alone

Active member, 188

Ad-hoc security, 145–146

Advertising alone (AA), 51

Advocacy, 158

Alphabetical soup of consulting, 8

American Society for Industrial Security (ASIS), 11–12, 189

Annual meetings of association, 188–189

Area security, 218

ASIS. See American Society for Industrial Security

Associate member, 188

B

Bank account, 28

Bidding, 139–140

encouraging bidders, 140

errors, 139–140

ITB, 139

prebid meeting, 140

RFP, 139

Billing periods, 119

Blogs, 39–40

blogging software, 39

RSS, 39–40

software links, 39

Break times, 212

Building security, 215–217

Bumps in road

articles, 48

brochure, 47

consultant type selection, 44–45

fee rate setting, 48

forensic consulting, 45–46

knowledge seeking, 46

LLC formation, 44

marketing, 46, 46–47

money, 43–44, 47

pro bono work, 47

professional certifications, 49

professional membership, 49

rate levels, 48

subject of independence, 45

Business of Security Consulting, 237

Business record keeping, 28

daily business journal, 28

financial journal, 28

bank deposit and withdrawal, 28

debit and credit, 28

hand-entry journals, 29

internal revenue service, 29

transactions, disbursement, and receipts, 29

C

CAD. See Computer-aided design

Cafeteria, 212

Caveat emptor, 116

CCTV. See Closed-circuit television

CD. See Construction documents

CDP. See Certified in disaster preparedness

CEO. See Chief executive officer

Certified fraud examiner (CFE), 11

Certified in disaster preparedness (CDP), 11

Certified information security manager (CISM), 11

Certified information systems auditor (CISA), 11

Certified management consultant (CMC), 12

Certified project manager (CPM), 143

Certified protection officer (CPO), 11–12

Certified protection professional (CPP), 11, 49

Certified security consultant (CSC), 11, 49, 189

CFE. See Certified fraud examiner

Chief executive officer (CEO), 94

CISA. See Certified information systems auditor

CISM. See Certified information security manager

Civil liability, 158

Civil procedure, federal rules of, 167, 168

Clerical services, 120

Closed-circuit television (CCTV), 97

CMC. See Certified management consultant

Company-wide problems, 5

Computer-aided design (CAD), 132

Confidential information, 201

Confidential information agreement, 209

Confidentiality contracts, 91

Construction documents (CD), 130

field device data gathering, 131

Construction Specifications Institute (CSI), 137

Consultant deposition, 169

attorney’s interrogation, 170

deposition transcripts, 170

intimidate witnesses, 170

objective, 170

opposing law firm, 170

videotaped depositions, 169

Consultant experience, 9

line experience, 10

managerial experience, 10

supervisory experience, 10

Consultant querying, 160

attorney’s responsibility, 160

factual scenario, 160

liability theories, 160

qualified consultant, 160–161

by telephone, 160

top-drawer experts, 161

Consultant review materials

cover letter listing, 164

notepad table of contents listing, 164–165

salient information extraction, 165

sample page of review notes, 165–166

supplemental material, 164

Consultant testifies in trial, 170

expert witness, 171

pretrial preparation, 171

security consultants involvement, 171–173

Consultant’s decision making

with attorney, 161

declining involvement, 161

forensic consultant’s agreement, 161–162

law firms, 164

retainer fee, 161

sample CV, 163, 161

strategy consultants, 164

thorny problem, 161–164

Consultant’s opinion, 166

assessment completion, 167

attorneys, 167

plaintiff action review, 166–167

recognized experts, 166

site inspection, 167

Consultant’s website, 31

Consultants, 2, 12

general standards of, 194

See also Forensic consulting standards

arrangements, 194–195

fees, 195

professional practices, 195–196

responsibilities, 194

Consulting contract, 201

client representative, 202

confidential information, 201

independent status, 202

invoicing, 201

limited warranty

additional work, 203

applicable law, 203

assignment, 203

complete agreement, 202–203

liability, 202

notices, 203

scope of agreement, 203

security measures, 202

payment rate for services, 201

rate of payment, 204

reimbursement for expenses, 201

scope of services, 203–204

services, 201

staff, 202

work product use, 202

Consulting websites

advantages, 41

blogs, 39, 40

blogging software, 39

RSS, 39–40

software links, 39

experience page, 33–34, 35, 36

case study, 37

publications page, 35

homepage, 32, 33

mobile versions

complex websites, 40–41

smart phones, 40–41

tablet computers, 40–41

services page, 32, 34

business protection specialists, 35

case study, 37

social networking, 36–37

firm commitment, 37–38

publications page, 38

Quora caters, 38–39

Quora links, 39

websites links, 37

Containers, 219–220

Contract, 88

Contract clauses, 178

See also Insurance

arbitration clause, 181

confidentiality agreement, 179

between client and consultant, 179

between consultant and consultant employees, 179

employment relationship, 181

indemnification agreements, 178

insurance coverage, 179

interim billings, 180

liability release, 181

purpose, 178

retainer fee, 180

travel time and related expenses, 180

Corporate employee, 2

Corporate security executive, 4

CPM. See Certified project manager

CPO. See Certified protection officer

CPP. See Certified protection professional

Creative freedom, 4

corporate security executive, 4

firm’s security director, 4

recommendations, 4

security consulting, 4–5

senior managers, 4

Credit union, 212–213

CSC. See Certified security consultant

CSI. See Construction Specifications Institute

D

Daily business journal, 28

Daubert rule, 168–169

Daubert challenge, 169

expert’s testimony, 169

professional security consultant association, 169

DD. See Detailed design

Dead time, 116

Deadly force, 238

Demeanor, 14

Detailed design (DD), 130

Detaining shoplifting suspects, 225

best practices, 227–229, 228, 229

IAPSC, 229

procedures, 225, 226, 227

Device schedules, 131

interim device identifier, 131

power requirements, 131

unique identifier, 131

unique space name, 131

E

EIN. See Employer identification number

Emergency organization, 222–223

Employer identification number (EIN), 44

Ethics in consulting

See also Successful security consulting program (SSC program)

consultants general standards, 194

arrangements, 194–195

basic responsibilities, 194

fees, 195

professional practices, 195–196

forensic consulting standards, 196–197

agreement for consulting services, 197

conflict-of-interest statement, 199

consultant agreement, 197

highest professional standards, 198

IAPSC, 198–199

nondisclosure agreement, 198

practicing consultants, 197

recommendations, 197

professional service, 193

security consultants, 193

Expenses, 119–120

See also Fees

actual only expenses, 120

clerical services, 120

collection problems, 125

delayed payment, 125

refusal to pay any amount, 125

refusal to pay part of amount, 125

miscellaneous expenses, 120

reimbursable expenses, 120

travel costs, 119

Experience page, 33–34, 36

case studies, 34–35, 35, 37

publications page, 35

F

Facebook, 66–68, 68

Fees, 115

See also Expenses

advances, 118

former client, 118

reflect expenses, 118

amount of time, 115–116

billing periods, 119

caveat emptor, 116

dead time, 116

office-time formula field, 116

cost short-term profit, 117

1:1 ratio, 116–117, 117

unproductive time, 117

retainers, 119

commitment and guaranteed income, 119

consultant, 119

travel time, 118

IAPSC members, 118

Field device data gathering, 131

Financial journal, 28

bank deposit and withdrawal, 28

debit and credit, 28

hand-entry journals, 29

internal revenue service, 29

transactions, disbursement, and receipts, 29

Firm’s security director, 4

Floor plans, 132

Force factors, 239–240

Forensic consulting, 157

case study, 171–173, 173

consultant

decision making, 161

deposition, 169

opinion, 166

querying, 160

review materials, 164

testifies in trial, 170

Daubert rule, 168–169

federal rules of civil procedure, 167

need for security consultants

advocacy, 158

civil liability, 158

legal professionals, 158

negligence, 158

plaintiff law firm, 159

San Francisco law firm, 158

security issues, 157–158

security negligence questions, 159

third-party crimes, 157

torts involvement in negligence, 158

whores, 158–159

process, 159

Forensic consulting standards, 196–197

See also Consultants general standards

agreement for consulting services, 197

conflict-of-interest statement, 199

consultant agreement, 197

IAPSC, 198–199

nondisclosure agreement, 198

practicing consultants, 197

professional standards, 198

recommendations, 197

Forensic methodology

analysis, 235

content, 231

position statement, 231–232

process, 232

risk assessment, 232–233

threat assessment, 233

vulnerability assessment, 233–235

G

General liability insurance, 176

GM. See Good marketing

Going bare, 177

Good marketing (GM), 51

Google+, 68

Grooming, 14–15, 15

H

Hand-entry journals, 29

Homepage, 32–33

Hospital survey, 107

alternative report strategy, 111–112

areas of concern, 112

introduction and scope page, 111–112

sample page, 111–113

attachments, 111

consultant’s report, 103

contents, 103–104, 106

executive summary, 104

interviews, 104

management’s attention, 105–107, 107

purpose, 104

findings, 108

parking lots, 109

procedures, 108

oral survey, 114

recommendations, 110–111

scope, 107–108

security report cover, 103–104

title page, 103–104

I

IAPSC. See International Association of Professional Security Consultants

IMC. See Institute of Management Consultants

Information security consulting team, 145

See also Successful security consulting program (SSC program)

access and risk balance, 154–155

ad-hoc security, 145–146

ID and password, 147

using outside players, 150

advancement, 150

using outside firm, 149–150

third-party service provider, 149

risk assessment, 151–152

risk management

ad-hoc approach, 151

information security, 150

risk treatment plan, 152–153

security assessment

external network and web application assessment comparison, 154

external network security evaluation, 153

penetration, 153

steps to intruding, 146–147

teams at risk, 148

installing and configuring systems, 148

in IT department, 148

security chain weakness, 149

vulnerabilities, 151

Information technology (IT), 10

Installation typical details, 134

Institute of Management Consultants (IMC), 190

journal of management consulting, 190

purpose, 190

seminar programs, 191

Insurance, 176

See also Contract clauses

general liability insurance, 176

going bare, 177

insurance limitation, 177–178

professional malpractice insurance, 177

workers’ compensation insurance, 176–177

Interim device identifier, 131

Internal consultant member, 188

Internal revenue service, 29

International Association of Professional Security Consultants (IAPSC), 184, 229

advantages, 184

conducting annual meeting, 142–143

defining consultant, 6

front page, 184–185

list of individuals, 185, 187

member’s page, 185–186

membership qualifications

certification, 188

education, 186

experience, 186

membership requirements

active member, 188

annual meetings, 188–189

associate member, 188

CSC certification, 189

IMC, 188–189

internal consultant member, 188

pro bono work, 191–192

missions, 184

range of fees, 115

security consulting specialties, 185, 187

Interpersonal skills, 13

demeanor, 14

grooming, 14–15, 15

honesty, 13–14

integrity, 13–14

patience, 14

persuasive powers, 14

Invitation to bid (ITB), 139

Invoice, 120, 201

See also Expenses; Fees

consultant’s letterhead, 120–122

duplicate preparation, 122

with fewer details, 123

for forensic work, 121

log tracks status, 122

penalty, 122

IT. See Information technology

ITB. See Invitation to bid

L

Limited liability company (LLC), 23, 44

Line experience, 10

LLC. See Limited liability company

Locker rooms, 216

M

Management information systems (MIS), 10

Marketing creation

AA, 51

advertising, 51, 56–57

budget, 57–58

institutional advertising, 56–57

plan, 57

authorship, 62, 64

blogs, 66

Internet blogging, 66

mass e-mailing newsletters, 66

brochures, 58

help centers, 58

web versions, 58

business cards, 59

custom stationery, 59

customer reaching, 55

benefit, 56

consulting, 56

increase profitability, 55

words of wisdom, 56

direct mail, 59–60

deciding as client, 60

e-mail, 60

feast or famine problem, 60

postcards, 60

GM, 51

knowledge centers, 51

newsletter, 65

plan preparation, 51

pro bono work, 68

promotional sundries, 61

caveat, 62

goal, 62

public appearance, 58

opportunity seeking, 59

speak seeking, 58–59

social networking, 66

Facebook, 66–68

Google+, 68

Twitter, 68

website design, 56

Marketing customer identification

retail marketing, 54

retail security, 55

consultant, 55

target, 54

Marketing plan preparation

defining services, 52–54

reaching customers, 55–56

customer identification, 54–55

Marketing quick tips

imperatives, 69–70

mandatory marketing maneuver, 72

pricing, 69

reasons for lose clients, 69

sales letters, 69

truism, 70–72

Marketing service description

actual statements, 52

conducting comprehensive study, 53

emergency management, 53

existing protection programs survey, 52

in-depth security surveys, 53

security surveys, 53

security/loss prevention audits and surveys, 53

branding, 52

money-back guarantee, 54

MIS. See Management information systems

Miscellaneous expenses, 120

N

Negligence, 158

Non-deadly force, 238

O

Office equipment, 29–30

Outside players, 150

P

PCI. See Professional certified investigator

Perimeter security, 214–215

Personal and interpersonal skills, 13

demeanor, 14

grooming, 14–15

honesty, 13–14

integrity, 13–14

patience, 14

persuasive powers, 14

Personal computer, 25

Personnel and vehicle control, 220–222

Personnel control, 220–222

Personnel safety, 222

Persuasive powers, 14

Physical security professional (PSP), 11, 49

Plaintiff law firm, 159

Preliminary survey, 95

with management, 96

final meeting, 96

initial meeting, 95

meeting selection, 96

tour of facility, 96

Press release

announcement form, 27

local newspaper, 28

security management magazines, 28

Pro bono work, 47, 191–192

Professional answering service, 26–27

Professional certifications, 11

CPP, 11

security consulting profession, 11

Professional certified investigator (PCI), 49

Professional consultants, 1–2

Professional credentials, 11

membership in professional organizations, 11

ASIS, 11–12

CMC, 12

consultants, 12

CPO, 12

IAPSC, 11–12

professional certifications, 11

CPP, 11

security consulting profession, 11

public speaking, 12

writing

authoring books, 12–13

bibliography of articles, 13

variety of magazines, 13

Professional liability, 175–176

Professional malpractice insurance, 177

Professional organizations, membership in, 11

ASIS, 11–12

CMC, 12

consultants, 12

CPO, 12

IAPSC, 11–12

Professional practices, 195–196

Professional security consultant qualifications

education, 10

IT, 10

MIS, 10

self-discipline, 10–11

experience, 9

line experience, 10

managerial experience, 10

supervisory experience, 10

personal and interpersonal skills, 13

demeanor, 14

grooming, 14–15

honesty, 13–14

integrity, 13–14

patience, 14

persuasive powers, 14

professional credentials, 11

membership in professional organizations, 11

professional certifications, 11

public speaking, 12

writing, 12–13

self-confidence, 15

Professional service, 193

Professional services agreement, 205–206

Proposal and contract

consultation need, 73

proposal requesting, 73–74

RFP, 73–74

for services, 74

acceptance, 88–89

caution, 91–92

confidentiality contracts, 91

issues, 83–88

properly prepared, 74–75

retainer basis, 91

understanding letter, 88, 90, 91

Prospective client, 31

Protection program equation, 97

personnel, 100–101

physical, 99–100

policy, 98

procedure, 98–99

Protective lighting, 218–219

PSP. See Physical security professional

Public speaking, 12

Publications page, 35

Q

Quora, 38–39

Quora caters, 38–39

Quora links, 39

R

Really simple syndication (RSS), 39–40

Receiving areas security, 217–218

Reimbursable expenses, 120

Request for proposal (RFP), 73–74, 139

Retainers, 119

commitment and guaranteed income, 119

consultant, 119

RFP. See Request for proposal

Riser diagram, 132

Risk assessment, 232–233

threat assessment, 233

vulnerability assessment, 233–235

RSS. See Really simple syndication

S

Safety for personnel, 222

Safety nets, 129

San Francisco law firm, 158

SBA. See Small Business Association

Security

guard forces, 224

industry, 13

personnel, 238

riser diagram, 134

Security consultants, 1–2, 45, 127, 193

comparison, 1

work, 2–3

Security consulting, 1, 7–8, 17

consultant’s work, 6, 8

alphabetical soup of consulting, 8

company’s security needs, 7

IAPSC, 6–7

national presentation preparation, 8

problem-solving process, 7–8

control over assignment, 2

control over one’s time, 3–4, 4

creative freedom, 4

corporate security executive, 4

firm’s security director, 4

recommendations, 4

security consulting, 4–5

senior managers, 4

diversity of tasks, 2

horizons, 3

own consulting practice, 3

retail consulting assignments, 3

retail operations, 2–3

freedom to criticize, 5–6

freedom to disagree, 5–6

freedom to live and work, 6

questions about entering profession, 17–22

security consultant, 1–2

security executive, 1

Security personnel force

committee members, 239

contents, 237

document history, 239

position statement, 237–239

policies, 238–239

purpose, 237–238

Security survey work sheets

break times, 212

cafeteria, 212

classified operations, 213–214

company store, 213

credit union, 212–213

custodial service, 213

normal shift schedule, 212

number of employees, 212

petty cash on hand, 213

questions, 211–212

Senior managers, 4

Services page, 32, 34

business protection specialists, 35

case study, 37

Shipping security, 217–218

Small Business Association (SBA), 44

Social networking, 36–37, 66

Facebook, 66–68

firm commitment, 37–38

Google+, 68

publications page, 38

Quora caters, 38–39

Quora links, 39

Twitter, 68

websites links, 37

SSC program. See Successful security consulting program

Starting business

bank account, 28

business record keeping, 28

daily business journal, 28

financial journal, 28

geographic location

reasons, 24

relocating to city, 24

insurance, 30

naming business, 27

consultant names, 27

own name, 27

reputation, 27

office equipment, 29–30

personal computer, 25

press release

announcement form, 27

local newspaper, 28

security management magazines, 28

specific location of office

advantage, 24

building, 25

convenience of office, 24

leasing of traditional office, 25

rental agreement, 25

stationery, 30

telephone equipment

cordless phone, 26

fax machine, 26

low-cost service, 26

telephone answering machine, 26–27

telephone service, 25

using yellow pages, 25–26

Stationery, 30

Successful security consulting program (SSC program), 237

See also International Association of Professional Security Consultants (IAPSC)

back-of-the-house mechanics, 238

business of expert witnessing, 237

Business of Security Consulting, 237

completing consulting assignment, 237

conducting security audits and assessments, 237

consultant’s report preparation, 237

convergence consulting, 238

defining and marketing services, 237

developing and submitting winning proposals, 237

money, 237

project teaming and business planning, 237

Supervisory experience, 10

Survey, 93

CEO and consultant conversation, 94

fact-finding process, 96–97

fact-gathering process, 97

personnel, 100–101

physical plant and equipment, 99–100

policy, 98

preliminary survey, 95

final meeting with management, 96

initial meeting with management, 95

select meetings with key managerial personnel, 96

tour of facility, 96

procedure, 98–99

scope of work, 93

security program, 97

Survey fact-finding process

interviewing, 96

observation, 96

problem, 97

research, 97

T

Technical security consulting

architectural and professional security community, 128

bidding and award matters, 139, 140

encourages bidders, 140

errors, 139–140

ITB, 139

prebid meeting, 140

RFP, 139

construction and closeout

beneficial use, 142

commissioning and closeout phase, 141–142

construction site review, 141

preconstruction meeting, 140–141

security system programming, 141

training, 141

warranty, 142

construction documents, 130

field device data gathering, 131

CPM, 143

designs, 128, 130

device schedule development, 131

interim device identifier, 131

power requirements, 131

unique identifier, 131

unique space name, 131

drawing package, 128

floor plan development, 132–133

IAPSC, 142–143

initiating specifications, 135–136

achieve consistent interpretation, 137–138

bidders, 138

bidding phase of, 139

considerations, 138–139

CSI, 137

during DD/CD phase, 136

design features in, 136

in latter scenario, 137

moving from DD to CD, 139

strong specification, 136

installation typical details, 134–135

iterative process, 128

percentage contingency, 129

riser diagram preparation, 132

security riser diagram, 134

safety nets, 129

schematic design, 129–130

block diagrams, 130

preliminary cost estimate, 130

solicit approval, 130

work products in, 129–130

technical security performs, 127

updating cost estimation, 134–135

work phases, 128

Telephone answering machine, 26–27

Telephone equipment

cordless phone, 26

fax machine, 26

low-cost service, 26

telephone answering machine, 26–27

Telephone service, 25–26

Theft control, 223–224

Theft experience, 214–224

See also Security survey work sheets

area security, 218

building security

additional attention areas, 216–217

locker rooms, 216

offices, 215–216

plant, 216

tool room, 216

containers, 219–220

key control, 219–220

locking devices, 219–220

organization for emergency, 222–223

perimeter security, 214–215

personnel and vehicle control, 220–222

physical description of facility, 214

protective lighting, 218–219

receiving areas security, 217–218

safety for personnel, 222

security guard forces, 224

shipping areas security, 217–218

theft control, 223–224

Threat assessment, 233

Timeless irony, 116

Timeless message, 237, 239

Tool room, 216

Travel costs, 119

Twitter, 68

U

Unique identifier, 131

Unique space name, 131

V

Vehicles control, 220–222

Vulnerability assessment, 233–235

W

Warranty, 142

Website, 31

content, 31

creation, 31

Well-designed websites, 31

Whores, 158–159

Workers’ compensation insurance, 176–177

Y

Yellow pages, 25–26

Z

Zero.feedblitz.com, 66