1. Best Practice:

    

   A Risk/Threat/Vulnerability (RTV) assessment is one of the most important elements of a comprehensive safety and security plan/program.

   • Focused on the venue, transportation, food and beverage, lodging and events.
   • Comprehensive assessment of the risk environment, utilizing an all-hazards approach to identify vulnerabilities, adjust strategies and processes and develop contingency/mitigation plans to address risks and vulnerabilities.
   • Identify the hazards with the event’s activities, locations of the activities and perform

    

   Objectives:

   • Pre-planning, anticipate and preparation.
   • Must know and understand the safety and security risks, threats and vulnerabilities of the operating environment of the venue, transportation, lodging, event and attendees in order to address them through mitigation strategies or acceptance of risk.
   • Without the assessment one cannot effectively develop and implement a security and safety plan. Failure to recognize and respond to risk to health, safety and security may be evidence of either negligence or incompetence in event planning.

    

   Implementation:

   Involve event Risk Management and/or security department(s) in this process, if one exists.

   Insurers may provide resources at no, or minimal cost. NCS4 offers a DHS/FEMA-funded Risk Assessment course.
   
   

   Keep all of your prior assessments.

    

   Applicability/Scalability:

   This should occur regardless of the size of venue or type of event.
   
   

   Scalability is not necessarily a function of size or attendance.
   
   

   The same elements are present for both small and large events/facilities. Scaling comes into play during implementation/ mitigation/acceptance.
   
   

   If you have a static event site (one you use over and over) it will just be a matter of updating after your first assessment. However, if your event location changes for each event, it will be more time consuming. As you return, you will only need to review and update.

    

   ---

    

2. Best Practice:

   Create or utilize your risk assessment/crisis management/security team to conduct a Risk/ Threat/Vulnerability Assessment to determine and evaluate vulnerabilities, threats and areas of risk exposure.

    

   Objectives:

   A knowledgeable team to assess and address risks, threats, vulnerability, gaps.

    

   Implementation:

   Conduct an annual overall assessment as applicable and an event specific one before each event, evaluate and accept, mitigate or make changes as necessary.

    

   Applicability/Scalability:

   Make sure you use qualified personnel to conduct the assessments.

    

   ---

    

3. Best Practice:

   Conduct a Risk/Threat Assessment for vulnerabilities for ALL events including a detailed criminal, terrorism, fire, structural, environmental, safety and medical assessment. Take an all-hazards approach. Review the list in the EAP and ensure they include (as applicable):

   • Site(s) assessment and environment
   • Demographics of attendees
   • Number of attendees
   • Resources assessment
   • Environment/weather assessment
   • Historical assessment
   • Equipment assessment
   • Lodging assessment
   • Travel/transportation assessment

    

    

   Objectives:

   • Risks and threats exist, but until identified and ranked for mitigation there is a potential for disaster.
   • In our context, Risk is the possibility of loss resulting from a threat/vulnerability, security or safety incident or event.
   • Security, safety and health Risk Management is a systematic and analytical process that considers the likelihood that a threat will endanger an asset, individual or function.
   • Risk = Consequences x Probability

    

   Implementation:

   Break down assessments into three components:

   • STATIC – these generally remain fixed with small variations over time, such as: venue, event, sur- rounding area, attendee type, etc.
   • JOINT – this involves working with government organizations, com- munity organizations, utility companies, transportation providers and surrounding neighbors
   • DYNAMIC – this involves things that can change quickly, such as adverse weather, demonstrations,
   • criminal acts or terrorist acts, etc.
     
     

   Local DHS Protective Security Advisor (PSA) can assist.

   Applicability/Scalability:

   Consider risks/threats as high or low RISK compared to high or low FREQUENCY - compared to high or low IMPACT.

    

   Eight common categories of risk to consider:

   • Historical - what types of incidents have occurred in the community, at the venue, and other similar events in the area
   • Geographic - what could happen as a result of the event’s location
   • Technological - what could result from a process, system, or equipment failure
   • Human Error - what
   • can be caused by a staff error; have they been trained; do they know what to do; and have they been tested on training objectives
   • Physical - what can result from design/construction of the venue, utilities, tents, fencing, seating, rigging or staging
   • Regulatory – what regulatory issues are there (i.e., laws, ordinances, OSHA, NFPA)
   • Environmental – what can result from climate/ weather issues (heat, cold, wind, ice, tornado, flooding)
   • Business – what can result from bad practices, damage to brand, dissatisfaction of clients/ attendees

    

   ---

    

4. Best Practice:

   Typical Risk Management cycle includes:

   • Identify the threats/vulnerabilities
   • Establish what are the vulnerabilities to address
   • Identify measures to mitigate, reduce or accept the risk/vulnerabilities
   • Develop response plans to address risks/threats not mitigated or accepted
   • Evaluate security/safety measures and exercise mitigation plans

    

   Objectives:

   Completeness

    

   Implementation:

   Larger events will be more complex and some smaller events as well, depending on attendee type.

   Applicability/Scalability:

   Applicable all size events.

    

   ---

    

5. Best Practice:

   Once risks/threats/vulnerabilities are identified and understood, develop a corrective or mitigation plan to address those considered unacceptable or of concern/needing attention.

   • Identify external resources needed for mitigation and/or response
   • Coordinate with local community partners and public safety agencies

    

   Objectives:

   Deal with risks, threats and vulnerabilities.

    

   Implementation:

   This will be part of the basis for the Emergency Action Plan (EAP).

    

   There are many governmental and private sector resources available to assist.

   Applicability/Scalability:

   This will help you identify the level of scaling required based upon the assessment and need for mitigation or acceptance.

    

   ---

    

6. Best Practice:

   Conduct event management meetings prior to each event with sufficient lead time to address Risk Management issues and address mitigation where required

    

   Objectives:

   Planning and preparation is a year-round function.

    

   Implementation:

   Events at different venues occur year-round, so these meetings should occur for each event. As necessary, schedule weekly or at intervals appropriate for scale of events

   Applicability/Scalability:

   Based upon size, complexity, attendees and RTV assessment will determine depth and frequency of meetings.

    

   ---

    

7. Best Practice:

For repeat events at the same venue, update and disseminate, as required, to key leaders and appropriate components/ partners.

The same is true for transportation modes used.

Objectives:

Currency and awareness.

Implementation:

Use the last assessment as a starting point to update and build upon.

Applicability/Scalability:

Do not just assume the results of the last assessment.

1. Best Practice:

   Establish a “Risk Assessment/Crisis Management Team,” consisting of:

   • Facility/Event – key personnel (internal stakeholders, security, operations, facilities, technology/communications and equipment staff) 
     

   AND any of the below as applicable based upon event size, components, threat, attendees, weather, geography

   • Lodging – security, operations, facilities, staff, technology/communications
   • Transportation – (bus/ coach, subway, train, air) mode, operations, security, staff
   • Audiovisual/staging/rigging provider
   • Local/state/federal (as appropriate) law enforcement
   • Fire Department, Fire Marshal, EMS
   • Emergency Management
   • Utilities/public works
   • Include marketing, business affairs, exhibits, maintenance and general manager’s office

    

   Objectives:

   • Effective anticipation and predictability.
   • Be all inclusive; have buying and input from subject matter experts.
   • Team approach is essential.
   • Preparedness.
   • Reduces legal liability.
   • Include components as required.

      

   Implementation:

   Most appropriate person to head this up is the Event Manager, or consider hiring a consulting team, but they will still need to meet with and interview all the components. If multiple jurisdictions, ensure that they are all included.

    

   Having an assessment is better than no assessment at all. Then continue to build upon it.

    

   Applicability/Scalability:

   Smaller events and venues may not have all these resources but put a team together with available resources and personnel.

    

   Small events/meetings may mean that the event planner/manager serves this role.

    

   The first time will be time consuming, but after developing an outline (much of which is set forth in these best practices), it will go quicker

    

   ---

    

2. Best Practice:

   This team should conduct the risk assessment and prepare a written report as necessary, at least annually, preferably before each event.

    

   Objectives:

   This is the beginning of a continuous journey

    

   Implementation:

   The assessment at a minimum should be conducted at each new event/venue and updated at each revisit. All other plans will base their response on this report; it will be a guide as to what needs to be addressed in what order and expenditure.

   Applicability/Scalability:

   Essential, regardless of any factors. This assessment once complete should be shared with key stakeholders.

    

   ---

    

3. Best Practice:

As part of the risk assessment, create a team to review social media, monitoring for situational awareness and threatening information.

Objectives:

Monitor and assess threats.

Implementation:

Consider for team makeup: law enforcement, human resources  and venue management personnel.

Applicability/Scalability:

Important for large and risk-adverse events, but relevant for all.

1. Best Practice:

Create checklists to be used during assessments for the various components of the event/venue.

• Review and refresh annually

Objectives:

For completeness and consistency.

Implementation:

These are important and worth the time and effort to prepare. Once complete, continue to use them over and over. They especially help new individuals conducting assessment for the first time.

They also serve as an outline for planning.

Applicability/Scalability:

Applicable to all size events.

1. Best Practice:

Develop a comprehensive profile including detailed lists, staff/attendees and key locations of critical assets with detailed maps/ blueprints of each level showing venue/lodging facilities, routes of ingress and egress, location of communication equipment, parking areas, transportation, traffic flow and areas surrounding the venue.

Objectives:

During a crisis it is too late to gather profile information and specific blueprints/diagrams to develop a plan for something that was not previously considered or evaluated.

Implementation:

Catalog and correlate plans to ensure that the Operations Center is notified of changes/modifications to this information, so all documents stay current.

Key leaders/designees should have a working knowledge of their areas of responsibility in the assessment.

Applicability/Scalability:

Applicable to all size events.

1. Best Practice:

Event planners/organizers should obtain legal and insurance advice during and based upon the RTV assessment that include the following:

• Liability for acts or omissions
• Liability for injuries to staff or patrons
• Liability toward financial costs associated with your response to incidents
• Liability for the effects of an incident(s)

Objectives:

To reduce legal liability and obtain necessary insurance coverage.

Implementation:

In collaboration with insurance provider and legal counsel.

Applicability/Scalability:

Applicable to all size events.

Based upon your RTV assessment, legal counsel and insurance providers can provide you with advice concerning appropriate coverage.

1. Best Practice:

    

   Establish a Threat Response protocol for risks/ threats/vulnerabilities identified that need to be addressed prior to the event and for all potential incidents for event day occurrences. Include these in Emergency Action Plan (EAP).

   • Develop decision trees for each incident type

    

   Objectives:

   • Accountability.
   • Determine and document what level of risk is acceptable and how to address unexpected issues.
   • For accepted risks, describe why and how they are excepted.

    

   Implementation:

   See Incident Response categories in EAP section.

   Assign identified threats, risks and vulnerabilities to appropriate individuals to effectively address.

   Applicability/Scalability:

   This affords preplanning that can avert disastrous outcomes for any events.

    

   ---

    

2. Best Practice:

Consider if protective measures and emergency response can be accomplished using your existing resources or, if additional, enhanced resources and capabilities are needed.

Identify who has the additional resources, how can they be acquired and pricing.

Objectives:

Adequate qualified staffing.

Implementation:

Resources for information are FBI special event office, local public safety agencies, venue security manager or county Emergency Management agency.

Applicability/Scalability:

Applicable to all size events.