Reviewing security measures and learning from experience

An event without major incidents is a welcome result. It does not, however, automatically show whether all security measures worked as intended. For further development, it is therefore worth looking at delays, technical limitations and situations that staff handled by improvising.

Recording observations during operations

During an event, routes, visitor movements, noise levels or staff responsibilities can change. This may also affect assumptions made in the security planning.

The UK Health and Safety Executive (HSE) recommends checking agreed measures during operations for implementation and effectiveness. Who carries out the checks, how and how often should follow from the risk assessment [1].

Short, factual records help: What was observed? Which function was affected? What action was taken and what result was found? Suspected causes should be kept separate from confirmed observations.

Read more: From security concept to working event operations and Situational awareness at events: more than a video wall.

Basing the debrief on specific procedures

A fictitious example: a warning only reached the incident control team after an additional phone call, because the intended radio contact could not be established. The situation was handled. For the next deployment, it still needs to be clarified why the transmission failed and whether the fallback route was sufficiently prepared.

The debrief should therefore look at both difficulties and solutions that worked. This includes the perspectives of operational staff, technical support and management. The HSE also recommends a joint debrief involving the parties concerned [1].

A factual review asks about causes and opportunities for improvement. Any examination of individual responsibilities remains unaffected by this.

Following findings through to implementation

A finding only becomes an improvement when a specific measure follows. To that end, a responsible person, an implementation date and suitable evidence of effectiveness should be agreed.

In the example, this could mean checking radio coverage and operating procedures, defining a fallback route and testing the adjusted reporting chain before the next deployment. Which solution is suitable depends on the cause identified.

Read more: Turning protection goals into security requirements and Measuring security quality: why functions matter more than equipment.

This creates a traceable learning process: observations from operations change the next round of planning, and the effect of the adjustments is checked again. A record documents this process; it does not replace carrying it out.

The HSE guidance supports ongoing monitoring and the debrief; UK legal requirements are not presented as German obligations. No fixed inspection intervals or revision obligations are claimed. The example of the warning is fictitious.