Audits. From the design phase, Hayes knew that a comprehensive, annual audit of the entire security program would be necessary. He wanted an independent third party to conduct the audit but found that none of the applicants for the job met his requirements. “Everyone who bid for the job could analyze risk, but none of them knew anything about the food manufacturing industry,” he says.
Hayes went looking for an auditor. He found the American Institute of Baking. “They knew a great deal about food manufacturing and already conducted food safety audits, so we only had to educate them about security.”
The annual audits cover the security of the physical sites, food processing, and raw materials. Procedures related to personnel, including background screening are reviewed. The entire security organization is also examined.
Tabletop exercises. To keep senior executives involved and to help them practice their roles in a disaster, security hosts tabletop exercises every few years. The next one is slated for mid 2011.
During these exercises, 20 of the company’s key executives meet to respond to a fictitious emergency. The most recent exercise involved one of the company’s manufacturing plants. Security devised the scenario of an explosion at the plant. The situation was presented in a series of television news clips in which the information was doled out to executives.
The first video showed a fire and reported that five people were missing and presumed dead. The facilitator then stopped the video and asked the executives what they would do next. After the group exhausted its options, the next video was shown giving more detail.
Over the course of four video clips, different issues arose—a disgruntled employee, a possible terrorist. After the last clip, the facilitator revealed what “really” happened. It was an explosion caused by an accident. Based on this final bit of data, executives discussed how they made their decisions and whether they would change any of them.
Over the years, the group has learned that often it’s the simple things that get overlooked, says Hayes. “Someone who should be on the contact list has been left off or a phone number is missing.”
Executives also practice the facility’s fire emergency procedures. The facility has conducted regular fire drills and trained with first responders. Most recently, they tested some aspects of the policy that calls for employees to report to nearby parking areas and reassemble for a head count in the event of a fire alarm.
The facility had elaborate signage directing people based on shift and work area. However, the practice exercise revealed that the facility had not considered what to do if the entire site was engulfed in flames and employees could not meet in the parking areas. Based on this exercise, executives made sure that facilities designated off-site locations where employees could assemble in an emergency.
Getting corporate support for the security program was not difficult. “We didn’t have to emphasize how important our reputation is,” says Hayes. “Executives know that people do not need our product. They choose us based on our brand.”
Teresa Anderson is senior editor at Security Management.