What to Do After a Terrorism Risk Assessment

After a terrorism risk assessment, the step before approving security measures is to mark every arrival, waiting and exit area on the deployment map. On 22 May 2017, a bomb in Manchester Arena's City Room killed 22 people as a concert ended. The public inquiry found serious failures in how threats, locations and security responsibilities were connected.

A terrorism risk assessment examines relevant attack threats, vulnerabilities and possible consequences to inform decisions about protective measures.

Check the security plan against the whole attendee journey

The usual next step is to select measures, assign responsibilities and prepare the security plan. That can include access checks, staff deployment, surveillance, reporting arrangements and emergency procedures. These choices should follow the threats and vulnerabilities identified in the assessment, rather than a list of equipment available to buy.

ProtectUK's treatment guidance calls for selected controls, implementation details, resources, an owner and a review date. It also requires a judgement about the risk remaining after treatment. This is a practical move from assessment to work that named people can carry out.

For each proposed measure, carry the assessment reference into the plan. Record the location and time alongside it. This lets the reviewer check whether the action addresses the scenario that justified it, rather than approving an unconnected list of tasks.

Before signing that plan, compare its map with the journey people will actually make. Include arrival routes, queues, pickup points, shared foyers and departure routes. Mark when each area is occupied. A location that is quiet during the performance may fill quickly when the event ends.

Beside each area, record who controls access, who provides security and who receives reports of suspicious activity. Confirm those answers with the people concerned. A venue's boundary and a contractor's task list may cover different areas. A police presence may also vary between events.

The approval check is whether the deployment plan covers the people, places and times described in the assessment. If a busy area has no confirmed arrangement, return that gap to the person deciding the plan. Do this before positions are assigned and staff are briefed. The same connection between an assessment and action matters in the wider risk assessment process.

Threat scenarios give security choices a clear basis

A useful assessment lets a manager explain why a measure belongs in a particular place. It connects a possible attack, an exposed group and a weakness that the measure is intended to address. This makes proposed spending and staff assignments open to challenge.

The ProtectUK assessment process separates threats and existing controls from vulnerabilities and consequences. Its guidance also warns that a generic approach needs adaptation to the organisation. A template provides a starting point. The venue, event and operating conditions still need to be described.

This work can bring security and event operations into the same discussion. A proposed entry check changes how quickly people enter. A changed pickup arrangement affects where families wait. Those effects belong in the decision, alongside the intended security benefit.

Keep the assessment's explanation of each security measure when preparing the deployment plan. A colour or score alone gives the supervisor too little information. As with acting after risk evaluation, the decision needs reasons that apply to the action being approved.

Check the attendee journey against the scope of your proposed security plan. Start the Walk →

Who protects people outside the ticket checks?

The scope of an assessment can be too narrow before anyone rates a threat. Start with the building, and the options may concentrate on its entrances and interior. Start with people attending the event, and the assessment must also consider where they gather nearby.

This does not mean the venue can control every street. It means the plan should state which nearby areas matter and what cooperation is needed there. An area outside the venue's control is a reason to contact its operator, landlord or relevant authority. It is not evidence that people there are protected.

Make this check concrete by tracing one arrival and one departure on the map. Include a person who needs step-free access and someone collecting a child. Ask where each person might stop, wait or change direction. These are planning prompts, not claims about a particular event.

Test the scope against people's movements before deciding which security measures to add. The framing of the problem determines which locations and options receive attention. A revised scope could produce a different staffing plan, queue arrangement or agreement with another operator.

The Sports Grounds Safety Authority warns that poorly managed searching can increase crowding outside a ground. Entry measures can therefore create another exposed location. Check expected waiting areas and arrival flows when selecting them, rather than assuming that more checks always improve the whole journey.

Also compare operating hours. One team may finish when the audience leaves the performance space, while another starts its departure duties later. Ask both supervisors to confirm the arrangement for the intervening time. Put the answer in the same map used for briefing.

A location is covered only when the relevant people have agreed what they will do there and when. Distinguish a discussion about accountability and responsibility from an agreed task that staff can perform.

Manchester Arena exposed gaps between security responsibilities

The Manchester Arena Inquiry's first volume examined security before the attack. Departing attendees and people collecting them used the City Room. Ticket and large-bag checks were beyond it, at the Arena concourse doors.

SMG's Security Risk Analysis considered nearby terrorist threats, which the inquiry said included a bomb in the City Room. It was not used in daily terrorism risk assessment. The concert-specific assessment omitted terrorism.

Showsec's general written terrorism assessment covered employees, but it lacked one covering event-goers and other affected members of the public. British Transport Police had day-to-day policing responsibility there. Coordination between SMG and Showsec was inadequate, including knowledge of police deployment.

SMG should have sought permission to move the security perimeter beyond the City Room, or considered other measures there more closely. The inquiry also identified CCTV, patrol and pre-exit check failures.

These findings do not describe a sound, completed assessment defeated by an unforeseeable boundary problem. They describe inadequate assessments and failures to connect known threats with practical arrangements. The relevant question for a current plan is whether its stated protection scope produces agreed work in every important shared area.

For a current event, ask each party to mark its work on one shared map. Keep unresolved areas visible until someone with authority decides how they will be addressed. Do not let separate documents give each team a different understanding of the same place.

Record a gap in shared-space protection as a decision requiring an answer before deployment approval. Do not close it because another organisation appears on the site plan. Ask its representative to confirm the task, timing and reporting arrangement.

Set the protection scope before approving deployment

Bring the assessment, attendee journey and deployment map to the approval meeting. State the purpose: protect people attending and leaving this event, within a scope that the parties can actually support. Then use the Universal Decision-Making Method to connect that purpose with the proposed plan.

1. Frame: Name the people, locations and event phases included, and record important areas beyond direct control.
2. Tentative Elements: Compare feasible measures and cooperation arrangements, including changes to where people wait.
3. Assumptions: State what must hold about crowd movements, staffing, access and other organisations' actions.
4. Sufficient Certainty: Decide what evidence is needed before approving the plan, including confirmation from each responsible party.
5. Implement+Monitor: Assign deployment, reporting and review tasks, with conditions that require the plan to change.

Check the proposed arrangements with the supervisors who must use them. Ask each to describe one busy shared area and the response to a report there. If their answers differ, resolve the difference in the plan and briefing. Record the approved scope and outstanding conditions in the Decision Record.

ProtectUK's review guidance calls for checking controls after implementation and monitoring changes in threats and operating conditions. Set a review when an arrival route, waiting area, contractor or event format changes. A different crowd pattern can make the previous scope unsuitable even when the building stays the same.

Approve security deployment only after its scope matches the attendee journey and its shared responsibilities have been confirmed.

Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.