Risk Communication in Security Operations

Introduction

Risk communication is a critical component of a Security Operations Management System (SOMS). Under Clause 7.4 of ISO 18788, communication must extend beyond operational orders and incident reporting—it must include structured, transparent, and timely communication of risks.

Risk communication is the process by which information about threats, vulnerabilities, and controls is shared internally and externally, ensuring that stakeholders can make informed decisions and align actions with the organization's strategic, tactical, and operational objectives.

Why Risk Communication Matters

  1. Supports Decision-Making - Ensures leaders at all levels (Board, Divisional Managers, Supervisors) understand risk exposure and mitigation strategies.
  2. Strengthens Risk Culture - Embeds risk awareness into daily operations.
  3. Aligns Objectives - Links strategic risks to tactical and operational actions.
  4. Enhances Stakeholder Trust - Builds credibility with clients, regulators, and communities.
  5. Supports Human Rights & Compliance - Ensures risks related to use of force, community impact, or legal compliance are visible and managed.

Elements of Risk Communication

1. Internal Risk Communication

  • Board and Executive Level - Receives consolidated risk reports, dashboards, and assurance updates.
  • Divisional/Departmental Level - Tactical risks communicated through risk registers and regular reviews.
  • Operational Level - Daily toolbox talks, incident debriefs, and risk alerts to guards and supervisors.
  • Audit and PMS Integration - Risk findings communicated during performance reviews, linking competence gaps to training needs.

2. External Risk Communication

  • Clients - Formal risk reports, compliance dashboards, SLA risk indicators.
  • Regulators - Legal and compliance risk reports as required by law.
  • Communities - Communication of risks affecting public safety and rights (community forums, grievance mechanisms).
  • Partners & Contractors - Shared risk registers and joint incident reporting protocols.

Tools and Channels for Risk Communication

Risk communication relies on resources (Clause 7.1) and must use appropriate tools to ensure clarity, speed, and auditability:

  • Risk Registers - Strategic, tactical, and operational registers updated and shared at defined intervals.
  • Dashboards & Reports - Visual summaries for executives and clients.
  • Workshops & Briefings - Risk workshops, after-action reviews, tabletop exercises.
  • Digital Platforms - Incident management systems, GRC software (e.g., ISOLTX risk modules).
  • Communication Resources - Radios, mobile phones, satellite phones for urgent risk alerts in field operations.
  • Campaigns - Risk-awareness campaigns for specific high-risk behaviours (similar to Clause 7.4 Awareness).

Documentation and Audit of Risk Communication

To meet Clause 7.2.4 (Evidential Documentation), risk communication must be:

  • Recorded: Minutes of risk committee meetings, dashboards, alerts, reports.
  • Classified: Stored under correct retention schedules per the Archiving Act.
  • Auditable: Evidence of who communicated, what was communicated, and when.
  • Evaluated: Link communication effectiveness to Internal Control Effectiveness (ICE) and audit outcomes.

Using the Audit Evidence Reliability Model (AERM), risk communication evidence is strongest when it includes:

  • Confirmative Evidence (Level 6): Signed minutes, external audit confirmations.
  • Physical/Mathematical Evidence (Level 7): Risk dashboards, system logs, automated reporting trails.
    Less reliable forms, such as verbal communication, must be documented and supplemented by stronger evidence.

Risk Communication and Behavioural Change

Like awareness campaigns, risk communication must change behaviours and decision-making:

  • Guards adapt patrols when new threats are communicated.
  • Supervisors escalate incidents faster due to clear escalation protocols.
  • Executives allocate resources where high risks are communicated transparently.
  • Communities engage more openly with security providers when risks and mitigation steps are explained.

Conclusion

Risk communication under Clause 7.4 of ISO 18788 ensures that risks are visible, shared, and acted upon at all levels of the organization and with external stakeholders. It is more than reporting—it is about embedding risk awareness into culture, enabling informed decisions, and building trust.

By linking risk communication to resources, evidential documentation, and awareness programs, organizations ensure that risk information is accurate, reliable, and auditable—a fundamental requirement for certification, compliance, and operational credibility.