From prescriptive rules to responsible organisations – making sense of risk in protective security management – a study from Norway

Figures & data

Table 1. Power’s three logics of risk management.

Logic	Fact production	Mode of disappointment
Anticipation	Knowledge of the future	Unexpected events (surprise)
Resilience	Uncertainty and ignorance	Disaster
Auditability	Decision responsibility	Blame

Table 2. Interviews – key characteristics^a.

Type of institution	Interviews	Interviewees	Organisations	Education	Gender
Ministry	9	9	5	Social science 10	25 Male
Public Agency	17	15	7	Technical/practical 9	9 Female
Research Institute	3	3	2	Law 5
Private sector/Standardisation	11	7	5	Military 4
				Police 3
				Humanities 1
				Medical 1
				Business 1
Total	40	34	19	34	34

^a When referring to interviews, M stands for ministry, A for agency, P for private/standardisation and R for research institute.

Table 3. The SRA standard.

The SRA standard defines risks as “the relationship between a threat against a given value and this value’s vulnerability towards the specific threat” (NS 5832:14:4) This builds on routine activity theory within criminology and Manunta (Stranden 2019). A risk assessment consists of: a value judgement, where values should be identified and ranked (see Table 4) security goals being set, pertaining to “what is a desired or acceptable state of affairs for the values of the entity during or after an unwanted incident” (NS 5832:14:6) a threat assessment and choice of threat scenarios the vulnerability assessment uncovering to what extent the values are vulnerable in the scenarios chosen the risk assessment, based on the value-, threat- and vulnerability assessments judgements of uncertainties

Table 4. Values.

A value is defined as “a resource which, if it is exposed to an unwanted impact, will result in a negative consequence for those who own, manage or have a benefit from the resource” (NS 5830:12 p. 4). Values can be material or immaterial, examples are life and health, physical objects, classified information, monetary values, infrastructure, reputation and “operative capability” (Standards Norway 2012, (Norwegian National Security Authority et al. 2015)).

Values may be interdependent. Something within one organisation may be valuable “upstream” to another organisation. This is most prevalent in digital chains. Value judgements thus need to take cross-organisational dependencies into account.

Stranden, R., 2019. Sikring: en innføring i teori og praksis. 1. utgave. Oslo: Gyldendal.

 Google Scholar

Norwegian National Security Authority, Norwegian Police Security Service, and National Police Directorate, 2015. Terrorsikring. En veildning i sikrings- og beredskapstiltak mot tilsiktede uønskede handlinger [Terror protection. A guideline in security- and preparedness measures against intentional unwanted actions].

 Google Scholar