Security Risk Consultancy
Security risk assessment and consultancy, South Africa.
Independent assessment of what is actually exposed, how likely it is to be exploited, and what to do about it first, whether or not SPS is the one who does it.
The problem
Most security spend is committed before anyone has established what the risk is.
A family office adds officers because an incident happened to someone they know. A company installs cameras because a board member asked what was being done. A private client increases cover after a frightening week and never reduces it. In each case money is committed against a feeling rather than an assessment, and the actual exposure, which is usually somewhere else entirely, stays open.
Security risk consultancy exists to put an assessment in front of that decision. SPS identifies what is exposed, how an opponent would realistically exploit it, what the consequence would be, and the most economical way to close it. The output is a prioritised set of decisions, not a catalogue of adjectives.
Recommendations are ordered so that a client can act on the first three without committing to the whole list. Frequently the first three are procedural and cost very little. Occasionally the honest recommendation is that the current arrangement is adequate and should be left alone.
Assessment types
- Individual, family and principal risk profiling
- Residential and estate security reviews
- Corporate site and office reviews
- Remote-site and rural operation reviews
- Route and journey risk analysis
- Event and venue security reviews
- Review of an incumbent provider's arrangement and compliance
- Travel risk assessment for a specific country or route
- Written reports suitable for board or family-office review
Method
How an assessment is conducted.
Scope and terms
What is being assessed, what is deliberately outside it, who may be spoken to, and what the client wants the report to be able to support. Agreed in writing, including confidentiality.
Information gathering
Site and route observation, interviews with the people who actually run the routine, review of existing arrangements, contracts and compliance, and open-source context for the area and the sector.
Threat and vulnerability analysis
Realistic opponents and methods for this client, in this environment, matched against the specific weaknesses that would make those methods work. Not a generic threat list.
Consequence and likelihood
What the outcome would be if a given vulnerability were exploited, and how likely that is, so that effort goes where the product of the two is highest.
Prioritised recommendations
Ordered by impact against cost and effort, separated into what should be done now, next and eventually, with an honest note where a recommendation is optional.
Report and briefing
A written report the client can take to a board, an insurer or a family principal, and a verbal briefing for the people who have to act on it.
Independence
An assessment that can recommend against us.
A consultancy report written by the company that hopes to win the resulting contract has an obvious problem. SPS handles it by being explicit: an assessment is a separate engagement with its own scope and fee, and a recommendation that the client should keep their existing provider, reduce cover, or appoint someone else entirely is a legitimate and reasonably frequent outcome.
Where SPS would be the natural provider for a recommendation, the report says so plainly rather than pretending otherwise. The client is then in a position to test that recommendation against the market, which is what they should do.
Regulatory context we assess against
- PSIRA registration and grading of any provider and its officers
- Firearms Control Act compliance for armed roles, through SAPS
- BCEA, the Labour Relations Act and the sectoral determination for private security, administered by the Department of Employment and Labour
- COIDA registration and cover
- Occupational Health and Safety Act duty of care for employee travel
- POPIA handling of personal and operational information
- SASSETA and QCTO accreditation where training is claimed
Questions
Security risk consultancy, commonly asked.
How long does an assessment take?
A single residence or route is usually days rather than weeks. A multi-site corporate or remote-site review takes longer, mostly because the useful information sits with people who are not available on demand. Scope and timeline are agreed before work starts.
Will you review our existing provider?
Yes, and it is one of the more useful things a client can commission. The review covers arrangement, compliance and whether the service being paid for is the service being delivered.
Do we have to appoint SPS afterwards?
No. An assessment is a standalone engagement. Clients regularly use an SPS report to improve an arrangement with a provider they already have.
Is the report confidential?
Yes. Confidentiality terms are agreed at scoping, and the report is handled under POPIA. SPS does not publish client identities, locations or findings, which is also why this website contains no case studies.
Can the report be used for insurance or board purposes?
It is written to be. The report is structured so that a board, an insurer or a family office can follow the reasoning from exposure to recommendation without needing a security background.
Do you assess sites outside South Africa?
SPS has operated in Eswatini, Lesotho, Mozambique, Zimbabwe, Botswana, Namibia and Zambia. Assessments outside those countries are considered on a case-by-case basis and SPS will say when a requirement is better served by someone with a permanent presence in that country.
Next step
Start with an assessment, not a quotation.
Describe what you are responsible for and what is worrying you about it. The first conversation is confidential and carries no obligation.