4.7. Risk management process

of an incident, and the organisation seeks local psychologists to provide this service to national staff or local community members affected by an incident related to the organisation's activities. In some high-risk contexts this type of local service can reportedly be found, but in other contexts, this is not always available.

Not all staff take advantage of these services when they are available, according to some key informants. A significant barrier may be cultural attitudes (within the organisation and outside of it) as well as a lack of confidentiality to access these services. However, very serious incidents do tend to result in staff requesting these services.

One key informant stated that although some staff have begrudgingly gone to psycho-social debriefings upon recommendation, they have all returned with positive experiences.

Key informants believe that appropriate awareness-raising can ensure employees take advantage of the psycho-social services their organisations offer.

4.7. Risk management process

Risk ownership was an issue raised by multiple key informants. In most organisations interviewed, ownership over duty of care, including safety and security risk management, sits within the management line; ultimate responsibility rested at the organisation’s board level.

Safety and security responsibilities are delegated down the management line, with head office programme managers/desk officers, regional directors, and country directors held responsible for safety and security risk management within their teams. In most organisations, these responsibilities are reflected in policy and job descriptions. Some key informants interviewed, however, state that their organisations are still not clear on risk ownership. This appears to be in organisations where job roles and safety and security risk management grew organically in response to need, rather than where these were proactively established and standardised as part of a broader organisational strategy.

Key informants, nonetheless, agreed that duty of care responsibility ultimately does not lie with security staff or with human resources as these individuals play a technical advisory role on paper. In practice, however, some key informants stated that decision-making around duty of care could fall to these individuals even if this should not be the case.

Some organisations have assigned a duty of care focal point or put together a working group with responsibility for oversight over duty of care related measures.

A key learning from the key informants was that HR and security share duty of care technical expertise (the breakdown of which varies between organisations) and that to ensure appropriate duty of care at an organisation-wide level these two functions need to work very closely together.