Security and Risk Assessment in the Education Sector:
A Case Study

Children spend almost a third of their day at school on a school day. Add in sports and extracurriculars for the older grades, and some students spend more than half of their waking hours at school on weekdays. With schools being the primary place children spend their time, isn’t it crucial that these are safe places where parents, students, faculty, and staff feel secure and are prepared for possible emergencies?

Any child in school, right down to little ones in preschool, will have drilled a fire evacuation plan at some point in the school year. Fire evacuation plans are vital (and mandated), but a school’s emergency plan should not stop there. The unfortunate fact is that youth violence and school violence are real features of today’s world. While active shooter events at schools like Sandy Hook, Columbine, Umpqua Community College, and Virginia Tech are routinely sensationalized by the news media, the truth is that school associated violent deaths are rare. With that said, school violence that includes things like threats, attacks, fighting, bullying, and weapons on campus is a serious issue that schools need to address and mitigate. According to the Center for Disease Control, 12% of students have been in a physical fight at school, 6% of students skip school because they fear for their safety, 6% of students carry a weapon on school grounds, and 7% of students have been injured by a weapon on school property. So, while school associated violent deaths are rare, it behooves school administrators to have an emergency action plan in place for all types of emergencies, from natural disasters, to violence at school, to the unthinkable scenario that an active shooter enters the building or gains access to the campus.

A security and risk assessment is the place to begin when starting to address the issues of school violence and active shooters. A thorough and expertly conducted security and risk assessment helps school administrators and security personnel understand:

• threats general to the education sector
• threats specific to the school’s location, size, and type
• the school’s current emergency plan (or lack thereof)
• the school’s current physical security system and features
• the gaps between the school’s current security system/procedures and where they
  ideally want to be
• a plan to close that gap

Invictus Consulting, LLC conducted one such risk assessment for a private school located in the downtown area of a major city. The school has a 3-acre campus comprising ten buildings and roughly 400 students (ranging from pre-school to 6th grade) and 90 faculty members. The process of the risk assessment will be described in detail below, giving a more comprehensive explanation and illustration to some of the general points made above.

This particular school has a completely fenced in campus, controlled access (e.g., gate at the entrance), security guards, and a visitor management procedure. On the surface the school seems to be relatively secure, but since some of their students are the children of high profile parents, their campus is located in an urban area, and administration and parents are concerned about recent school shootings throughout the country, the school felt that they should enhance their security. The purpose of this particular risk assessment was to create an Emergency Action Plan for the school and create a gap analysis detailing the deficiencies in their existing security measures and protocols.

The risk assessment began with interviews with a few key players including the head of the school, the security supervisor, a security officer, and two administrative assistants. The purpose that may have been superficially communicated to the security staff but never explained or drilled, or there is no active shooter plan in place and the administration is either covering their backs or are mistaken about its existence. The cause of the discrepancy between administration and security personnel is important, and the cause should be uncovered and remedied. But the mere fact that a discrepancy exists between what some administration think is policy for security and what is actually occurring on a day-to-day basis in the school is the larger issue at hand. Especially when
it comes to emergency planning, miscommunication (or lack of communication) between the policymakers and everyone else is paramount; having an emergency plan does no good unless the students, teachers, staff, and security personnel practice putting the plan into effect.

In the school assessed here, there was a marked discrepancy between the knowledge and understanding of the administration versus security personnel in regards to emergency procedures for an active shooter. Security personnel indicated that an active shooter plan was in place, but administration and teachers indicated the opposite. The interviews also uncovered the fact that there was no communication between the first manned station (the security guards at the front gate in this case) and administration. This meant that an emergency on any given part of the campus was an isolated event and could not be quickly communicated to other areas of the campus.

In addition to interviews, the risk assessment included a campus-wide evaluation of existing physical security systems. A school’s outer perimeter (i.e., fences and gates) is the first line of security. This line of security was assessed for broken areas of fencing, trees or shrubbery growing up or over fencing, gaps in fencing, and locks on gates/access points. The perimeter issues uncovered during the assessment are common perimeter problems and included: broken fencing and unlocked gates (both of which are easy entry points for unwanted individuals and create a safety risk for the school); shrubbery or trees growing around or over fencing, causing a break in the line of sight (giving intruders cover to cross the perimeter) or causing the fence to break under the weight of limbs; and open gates, which give unimpeded access to the school grounds.

Cameras were the second level of security to be assessed during the site evaluation. Cameras were evaluated for functionality, view placement, and software. The site assessment uncovered CCTV issues that included: dummy cameras that were present but not functional; cameras that had tilted over time and were now facing a brick wall or other obscured view; cameras that had been obscured by foliage and were thus recording images of leaves; insufficient camera coverage (i.e., important areas without camera coverage); lack of recording duration; and lack of systems integration. These types of camera issues are unfortunately all too common in both schools and other entities.

Access control measures were the third level of security assessed during the site evaluation. This included an assessment of door hardware, access card readers, key fobs, systems integration, computer software, licenses, badge printing, control panels and reader boards, and the construction of all access controlled doors. This particular school had a problem with teachers and staff propping open access controlled doors – while faculty and staff carried electronic key cards with them, the safety of having locked doors was superceded by the perceived nuisance of having to unlock doors every time students or teachers entered or exited. Another problem for this particular school was that it had a somewhat large campus with multiple buildings, and there were multiple access control systems on campus. In other words, the access control systems were not integrated into one single system. One final issue with access control at this school was the lack of governance for lost and stolen credentials. Lost or stolen credentials were simply reissued with no system in place to oversee why or how frequently credentials needed to be reissued.

This particular school did not have intrusion detection systems or mass notification systems. Had either type of system been present, it would have been assessed as the fourth level of security during the site evaluation. In a location that has intrusion detection systems, assessment is done for integration, monitoring, alarm locations/zones, keypads, sounders, and sensors on all alarm systems including contact alarms, motion detectors, and tamper alarms. If mass notification systems are present, this system is also assessed in a similar manner. Common issues found with intrusion detection systems generally revolve around teachers, employees, and administrators having insufficient knowledge of how the systems work and who monitors the systems. While this may seem like a minor problem, it often leads to broken or disused alarm systems, since no one really knows who is in charge.

After the interview process and site evaluation process, Invictus Consulting analyzed all of the data. Analysis of the data allows for the creation of recommendations to improve systems, processes, hardware, etc. It also allows Invictus Consulting to create an Emergency Action Plan specific to the school’s design, campus, and culture. Both of these were done for this particular school. In addition, engineering designs were created for each building specifying recommendations that included hardware, cameras, and electronic access control measures. These engineering designs were incorporated into CAD drawings of each building that had been supplied to Invictus Consulting by the school.

Following the thorough site evaluation, interview process, risk assessment, and engineering design, all data and results were presented to the administration and Board of Directors during an Executive Debrief meeting. During this meeting, which lasted roughly 2 hours, the administration and Board of Directors were given the opportunity to fully understand the process of the assessment, the findings, and the recommendations made by Invictus Consulting. The final report presented at the Executive Debrief meeting included:

• A full risk assessment (i.e., a consequence analysis, threat analysis, and gap analysis)
• Data and analysis of data
• Emergency Action Plan
• All recommendations based on the assessment (e.g., visitor management, access control,
  perimeter issues, etc.)
• CAD drawings for engineering

The particular school assessed for this case study requested a training session for their faculty and staff after accepting the new Emergency Action Plan provided by Invictus Consulting. Having understood the need for an Emergency Action Plan, the administration and Board of Directors were keen to have the faculty and staff made aware of the new plan and drill it so that each teacher and administrator knew their specific role in the plan. This training was provided by Invictus Consulting in a workshop format on campus. Additional active shooter training (Advanced Law Enforcement Rapid Response Training [ALERRT]) was provided to the security personnel.

While it was not part of the contracted services for the school in this case study, Invictus Consulting has provided other school and businesses with follow-up services after the risk assessment and recommendations. Specifically, Invictus Consulting has provided budget numbers for recommendations, written an RFP for the specific recommendations made (so that the school can put the project out to bid), and project managed the implementation of recommended upgrades. The school assessed for this case study did implement most of Invictus’ recommendations, and by doing so they improved the safety of students, faculty, and visitors on their campus, and they established a new culture of safety throughout the school.