27-11draft

Security Management
On the Institute’s theme of ‘culture’,
Matthew Drew indeed dwelt on
‘behaviours’.
He mentioned the fine by
the Serious Fraud Office,
or rather the ‘Deferred
Prosecution Agreement’ (DPA)
completed in January. To quote
the SFO director David Green in
a September speech, ‘bribery had
occurred in seven jurisdictions
[Indonesia, Thailand, India, Russia,
Nigeria, China and Malaysia] in three
of its business streams touching three
decades’. The penalty and costs,
also to the authorities in Brazil and
the United States, at about £670m
‘was equivalent to a year’s profits
for Rolls-Royce’, Green noted. As an
aside, that case shows the sheer size
of a corporate and how hard it is to
achieve compliance; the investigation
was the SFO’s largest ever, costing
£13m and covering some 30m
documents.
Behaviour
But to return to Matthew Drew. He
recalled a memorable line from an
Institute conference speaker years
before; that security is a behaviour,
not a function. In that bribery case,
you had people who thought they
didn’t have to behave in an ethical
way (in procurement); that brought
Rolls-Royce those problems.
“Security is the same,” Matthew said.
“You can have a fantastic security
function, and clear policies, but
unless every individual feels some
ownership, you won’t be a secure
company.” Everyone who joins the
firm is vetted, to a consistent
standard. Their criminal and financial
history, and right to work in the
country, and social media profile and
any views if expressed, checked. As
R-R has 50,000 people, the company
as Matthew said has experienced ‘just
about every’ personal issue that can
cause a reputational harm. A R-R
team runs ‘high quality investigations’
so that if such behaviours have to go
to law enforcement or an internal
disciplinary process, evidential
standards have been kept.
Code of conduct
He spoke of a ‘global code of
conduct’, a commitment given when
applying to join Rolls-Royce, ‘so that
you know exactly what you are
signing yourself up to. It’s very clear,
it’s a very simple document, it leaves
absolutely no room for ambiguity on
the behaviours expected in the
company’. Another document is the
‘global security policy’; again, sent
out to people before they even join,
so that everyone, security and nonsecurity
jobs alike, understands the
‘core behaviours’ expected. It goes
over basics, such as; you will wear a
pass if you are in a R-R building, and
if you don’t bring it, you go home for
it. If you’re a manager, it’s your
responsibility to brief your staff at
team meetings on such security issues
as ‘clear desk’. Matthew also aired
something that Paul Grainge did at
his Security TWENTY talk in 2015 in
Newcastle; how to deal with unions.
R-R factories, like docks, has a
unionised workforce. Even small
changes to security behaviour can be
significant for unions, Matthew said.
meeting the unions:
If any new CCTV is fitted, unions
will ask whether it’s not for safety
and security, but to monitor time and
attendance. Security meets with
unions monthly, the aim to get unions
to understand why such things as
wearing passes to work are necessary.
Here the threat of terrorism and risk
to workers - and Security’s advice on
the official lines of ‘run-hide-tell’ -
has meant that unions have been the
ones to report to their members, on
security behaviour. On the insider
threat, R-R doesn’t want to ‘recruit
the problem’. R-R doesn’t want its
intellectual property so locked down
that it cannot be used; the company
has to know where the IP actually is;
but Matthew returned to security
‘culture’; workers understanding
what unusual behaviour is, such as
working odd hours, avoiding
supervision, and drawing it to
Security’s attention.
Enabler
As Drew added, he tries to drive
security as a business enabler, not
a cost. Drew’s direct line manager
is the general counsel, who makes
sure that every time the executive
leadership team meets, at least one
security issue is on the agenda. While
his work is about flattening out risk,
and managing real (and perceived)
threats from terrorism, the recent acts
of terror across Europe, in Berlin
and Brussels for example, affect R-R
people simply because they are in the
vicinity. Likewise, the Westminster
Bridge terror attack was 300 yards
from R-R headquarters. Drew praised
support from police; and stressed the
first five minutes of an attack, figuring
out where people are, and what to do
for them. p
About Rolls-Royce
n R-R has customers in
150 countries; armed
forces and navies, airlines,
nuclear power companies.
n Revenue was £13.8
billion in 2016, around half
from ‘aftermarket services’.
n Its recent engine sales
include to the UK’s new
polar research vessel the
RRS Sir David
Attenborough; San
Francisco Bay catamaran
ferries; and Bangladesh
power stations.
Below: An Emirates
A380 passenger jet. The
airline is among users
of Rolls-Royce engines
and service support
Photo courtesy of Airbus
www.professionalsecurity.co.uk NOVEMBER 2017 PROFESSIONAL SECURITY 43
p42,3 Institute 27-11.indd 2 12/10/2017 11:01