/CPPSEC4006A-Assess-Risks-v0711-unlimited

CPPSEC4006A ASSESS RISKS

CANDIDATE STUDY GUIDE AND ASSESSMENTS

© Treble J Enterprises Pty Ltd T.A. Training Business Security Consulting – TBS Consulting v110110

Table of Contents CPPSEC4006A Assess risks - Introduction ..................................................................... 3 Required Reading............................................................................................................ 5 Recommended Reading .................................................................................................. 5 Assessments Section 1 - Written Tasks .......................................................................... 7 Assessment Section 2 - Projects ..................................................................................... 9

© Treble J Enterprises Pty Ltd T.A. Training Business Security Consulting – TBS Consulting v110110

Core Unit of Competency CPPSEC4006A Assess risks - Introduction This unit of competency specifies the outcomes required to determine effective security policies and controls. It requires the ability to identify key systems and assets, and the likelihood of threat against each asset. It also requires an ability to calculate the current risk for each asset. This unit may form part of the licensing requirements for persons engaged in risk assessment operations in those states and territories where these are regulated activities.

This unit of competency has application in those work roles involving the assessment of risk in a security environment. Competency requires legal and operational knowledge applicable to relevant sectors of the security industry. The knowledge and skills described in this unit are to be applied within relevant legislative and organisational guidelines.

In order to prepare for your assessment of this unit of competency you must read and understand the subject matter relevant to the unit and also develop and understanding of the principles of frontline management by reading and researching the recommended texts. It is recommended that you extend your preparation to appropriate websites, industry journals and forums.

CPPSEC4006A Assess risks contains employability skills.

1.

Read the relevant chapter(s) of the nominated texts – listed below.

2.

Read relevant texts from the list of suggested reading provided.

3.

Read all of the case studies, assessment tasks and questions for this unit of competency before commencing.

4.

Answer the assessment tasks and questions for this unit of competency. Keep in mind you are studying a Nationally Recognised Certificate IV qualification. Your answers must reflect the depth of knowledge and understanding expected of a person who can work with minimal supervision and demonstrate a high level of judgement and decision making.

5.

Unless otherwise indicated, you should plan to provide approximately 100 words to approximately 250 words for each answer.

6.

The program is a self paced, external study program supported by class seminars. Each seminar is one (1) day duration. Candidates are encouraged to complete the entire program within the specified duration.

7.

You must confirm that answers to the assessment tasks and questions you submit are all your own work and completed without assistance. Your assessor will ask you to complete a Justice Act Declaration or a Statutory Declaration or similar that states you have completed the work without assistance.

8.

Save your work on your computer.

Š Treble J Enterprises Pty Ltd T.A. Training Business Security Consulting – TBS Consulting v110110

9.

Back up your work and secure the back up in an alternate, safe location. For example, save a back up copy on an external drive or another computer.

10.

Convert your work to Adobe PDF format (if possible). Adobe PDF creates a permanent record (that can’t easily be altered) and compresses the files to a size that is easy to email.

11.

Email your work to the assessor.

© Treble J Enterprises Pty Ltd T.A. Training Business Security Consulting – TBS Consulting v110110

Required Reading Security Risk Management Body of Knowledge - SRMBOK Chapter 4, Security Risk Management Context; page 41 Chapter 8, Strategic Knowledge Areas Section 8.1 Introduction; page 129 Chapter 8, Strategic Knowledge Areas Section 8.3 Risk; page 166 Program text books Security Risk Management Body of Knowledge (SRMBOK) by Risk Management Institute of Australia (RMIA) Management, Theory & Practice by Kris Cole ISBN 9781442503120 Fourth Edition Recommended Reading Program Pre-reading Recommended – External Study Preparation (not included) External or Self Paced study is a convenient and effective means of achieving a Nationally Recognised qualification. It can also present challenges within the work / life / study balance for some students.

These books are intended to provide valuable insight and assistance when establishing your study pattern. It is recommended each student read these books before commencing study.

A Learning Companion by Lorraine Marshall Pearson Education Australia 2006 www.pearsoned.com.au ISBN 0733969771 A Guide to Independent Learning by Lorraine Marshall and Frances Rowland, Pearson Education Australia 2006 www.pearsoned.com.au ISBN 1741033721 Program Recommended Reading (not included) Operational Risk Management: A Case Study Approach to Effective Planning and Response by Mark D. Abkowitz; April 2008; ISBN-10 0470256982; ISBN-13 978-0470256985 www.amazon.com Risk and Security Management Protecting People and Sites World Wide by Michael Blyth 2008 ISBN 0470373059 Corporate Risk Management by Tony Merna and Faisal F. Al-Thani 2008 ISBN 978-0-470-51833-5 www.fishpond.com.au Event Risk Management and Safety by Tarlow ISBN 0471401684 www.fishpond.com.au The Essentials of Risk Management by Michel Crouchy and Robert Mark 2006 ISBN 0-07-142966-2 www.amazon.com

© Treble J Enterprises Pty Ltd T.A. Training Business Security Consulting – TBS Consulting v110110

The following resources are available at http://infostore.saiglobal.com/store AS/NZS ISO 3100 Risk Management Standard AS/NZS 4360: 2009 Risk Management, Standards Australia AS/NZS Standards accompanying handbook HB 436:2004 HB 205:2004 OHS Risk Management Handbook AS/NZS 4360:2004 Risk Management, Standards Australia AS/NZS 4801:2001 Occupational Health & Safety Management Systems-Specifications with Guidance for Use AS 3806-2006 Compliance Programs HB 254-2004 Guide to Controls Assurance GB 158-2004 Guide to Internal Audit HB 221:2004 Business Continuity HB 240-2004 Risk in Outsourcing HB 246-2004 Risk in Sport & Recreation HB 141-2004 Risk Financing Guide HB 203:2004 Environmental Risk AS/NZS ISO 9001: 2000 Quality Management Systems – Requirements: GB 002-2007 The Business Excellence Framework HB 90.1-2000 The Small Business Handbook-Guide to ISO 9001:2000 AS 8015-2005 Corporate Governance of Information and Communication Technology Useful websites include www.riskmanagement.com.au www.dfat.gov.au/globalissues.html www.nationalsecurity.gov.au www.tbsconsulting.com.au www.investigateway.com www.stratfor.com www.saiglobal.com

© Treble J Enterprises Pty Ltd T.A. Training Business Security Consulting – TBS Consulting v110110

Assessments Section 1 - Written Tasks Question 1 Explain the goals and objectives that must be established prior to commencing a risk assessment. Be sure to include: • The process to be used to ensure client consultation, discussion and confirmation.

• Terms of reference that will ensure organisational procedures are observed.

Question 2 Is it important to identify risk based on an understanding of the operating environment and core business operations of the client? Explain your answer.

Question 3 Explain how your initial risk assessment information is collected and assessed for currency, accuracy and relevance in accordance with organisational procedures.

Question 4 Explain the process you would use to identify and assess risks relating to the risk assessment task based on a given terms of reference, the type, scale and timeframe.

Question 5 How do you determine the assessment criteria for measuring potential risk and consequence?

Question 6 Develop a table / matrix / procedure or similar that can be used to compare the risk management principles of threat, consequence and vulnerability as they relate to the major physical assets of an organisation.

Question 7 Based on your answer to Question 6, what assessment criteria do you recommend to measure the level of potential risk?

Question 8 What process do you recommend to identify gaps in a predetermined risk assessment plan?

Question 9 List three (3) examples of organisational changes that may be required while a business risk assessment is being conducted. What impact might these changes have on the business?

Question 10 When determining risk potential, explain how you assess information for validity, reliability and consistency.

© Treble J Enterprises Pty Ltd T.A. Training Business Security Consulting – TBS Consulting v110110

Question 11 A common obstacle to conducting an effective risk assessment can be the staff working within the organisation being scrutinised and assessed as part of the process. Generally, they don’t understand the nature of a risk assessment.

Give three (3) examples of obstacles that might be imposed by staff members. Explain the options available to you to overcome these obstacles.

Question 12 Why is it important to present your findings in a clear, concise language and format that is free of inconsistencies?

Question 13 List three (3) examples of how you would solicit feedback, additional information and queries with appropriate regard for client concerns and organisational interests.

Question 14 With a view to continuous improvement, explain how you would collate and collect data, information and ‘lessons learned’ as you develop countermeasures during the risk assessment process.

How could the identification of countermeasures be utilised by management future risk assessments?

Question 15 Once the risk assessment is complete and the recommendations finalised, explain how you would secure this information. Your answer should include but not be limited to: • Confidentiality o Who has access? o Security codes • Security o Physical o Location o Protection against fire etc • Storage o Virus protection o Data backed up • Legislative requirements • Organisational requirements

© Treble J Enterprises Pty Ltd T.A. Training Business Security Consulting – TBS Consulting v110110

Assessment Section 2 - Projects Mexico – An Anti-Kidnapping Device

The Mexican media has seen numerous reports of an implantable device that could be used to locate kidnapping victims. Kidnapping in Mexico is rampant, with high-profile cases like that of Fernando Marti, whose family co-owns a Mexican chain of sporting good stores, showing that the rich along with less wealthy are vulnerable.

Unfortunately, the device generating media buzz has some serious drawbacks — and may even be counterproductive.

The Mexican security company Xega has been promoting the device, which when activated sends out a distress signal. It is about the size of a grain of rice, is implanted under the skin using a syringe, and activated by an external device potential kidnapping targets wear at all times.

Tracking devices may serve a deterrent purpose, as amateur kidnapping gangs may abandon their trade due to the increased risk of being caught.

But there are numerous ways a determined kidnapper can foil such a device. Devices relying on radio signals (like Xega’s product) can be thwarted simply by keeping a prisoner in a basement or even the lower level of a parking garage, diminishing the device’s ability to be located.

Kidnappers also can use copper or metal foil to distort the signal. Metal detectors or signaltracking devices can also be used to check a hostage for bugs, which could be removed via extemporaneous surgery surely not up to health standards. Given the recent publicity surrounding such devices, kidnapping gangs will be on the lookout for indications of such devices; if they discover one, they are liable to start cutting.

All this assumes the victim is even carrying — and able to trigger — the activating device when the kidnapping occurs. Kidnappings happen quickly, violently and without warning. Victims can be bound and stuffed in car before realizing what has happened, leaving little time for the luxury of discreetly pushing a button. Even if the client is able to activate the beacon, corruption among Mexican law enforcement means a smooth police response is not guaranteed.

Ultimately, such tracking devices may increase the risk of abduction. Organized criminals have infiltrated the Mexican government, signaling they are capable of infiltrating private companies

© Treble J Enterprises Pty Ltd T.A. Training Business Security Consulting – TBS Consulting v110110

offering this type of service, giving them access to information about the whereabouts of highvalue targets — and perhaps even the ability to track potential targets in real time.

This new product provides yet another example of people relying on technology to provide security. But technology always has its weaknesses, and can even create new vulnerabilities.

This is not to say that emergency beacon technology has no place. Emergency beacons can be quite useful if planted in a car or a briefcase, for example, but not inside the human body, where they cannot be discarded if compromised or if they cause the victim to be cut. Ultimately, situational awareness and preparedness remain the best security precautions.

Situation Your client is a high profile Brisbane business man who became very successful in the hairdressing and personal grooming industries during the 1990’s. He does not have a security background and is considering travelling to Mexico City during the next couple of months.

While this is a business trip, he is able to take his family with him. His wife and two teenage daughters are looking forward to the trip but have some concerns for their safety. Your client found an information bulletin (above) while on the internet one evening and feels this device could be a valuable safety device for his family while they are in Mexico.

Assessment Task 1 The client has contacted you to conduct a security risk assessment and feasibility study on the personal anti-kidnapping device promoted by Mexican security company, Xega.

Your report should be presented in a manner that is user friendly to your client and should include but not be limited to: • Terms of reference • Risk assessment criteria • Hazard identification • Threat assessment • Vulnerability • Consequences • An action plan • Structure for the assessment • Recommendations Support your report with diagrams, tables, matrix, flow charts etc as required.

Approximately 1000 words

© Treble J Enterprises Pty Ltd T.A. Training Business Security Consulting – TBS Consulting v110110

Assessment Task 2 The case scenario mentions that kidnapping in Mexico is a serious problem that is on the increase.

Research the kidnapping events in Mexico during the last two (2) years. Utilise at least three (3) different sources that will provide valid and relevant data for your research.

Limit your research to white Caucasian females under the age of forty (40).

Identify any trends that come to light from your research.

Based on your research, develop a risk assessment and report for your client that determines the risk potential to his family if they travel to Mexico.

Be sure to address the risk management concepts of Threat, Consequence and Vulnerability.

Approximately 1000 words Assessment Task 3 List the series of questions you would ask your client to ensure an accurate understanding of his core business and his purpose for travelling to Mexico.

Assessment Task 4 For this question you will need to go to: http://www.youtube.com/watch?v=oLt6wG1xfxQ If this link won't open go to: www.youtube.com Enter: Mexico's kidnapping business - 11 Feb 08 One of the many problems to be solved while travelling in Mexico is who to communicate with and who to trust. Do you advise police of your travel plans in advance? Hire a local driver?

Utilise an armour plated vehicle? These decisions and many more are an integral part of your risk assessment and preparations for travel in Mexico.

Conduct research, contact other security experts, view the internet and read journals and information on travel in Mexico. Apply reasoning and logical analysis to your recommended method of transit while in Mexico. Support your recommendations with photos, diagrams, design specifications, statistics etc.

Develop a presentation that you will make to your client in a few days time. The presentation will made verbally when you meet with the client but this question requires a written presentation that will demonstrate your research and writing skills.

Approximately 500 words

Š Treble J Enterprises Pty Ltd T.A. Training Business Security Consulting – TBS Consulting v110110