What Does This Mean For Organisations?

What Does This Mean for Organisations?

The Terrorism (Protection of Premises) Bill will impose that organisations consider the threat of attacks and take forward proportionate measures to reduce the risk. The current proposal consists of five requirements, this states that public venues and large organisations within the scope of the bill will be obligated to:

1. Engage with freely available counter-terrorism advice and training provided by the Government and the police.

2. Conduct vulnerability assessments of their operating places and spaces, considering the impact to the public.

3. Mitigate the risks created by the vulnerabilities using ‘reasonably practical’ measures.

4. Have a counter-terrorism plan.

5. Plan for the threat of terrorism.

Standard Duty Premises

Standard duty premises will be required to undertake “basic, low-cost activities to improve preparedness”. This means undertaking and maintaining a “standard terrorism evaluation”, which will need to be provided to all those who work at the premises. This evaluation must be reviewed whenever a “material change” is made to the premises and at least annually. This should include:

the type of terrorism most likely to occur at the premises,
terrorism prevention measures in place at premises,
harm reduction measures, and
procedures to be followed if a terrorist act occurs.

The scope also requires terrorism protection training which must be provided to “relevant workers”. There is no requirement for these workers to be paid, so volunteers could be within the scope of this definition. It is defined that a person is a “relevant worker” if they “have responsibilities that make it appropriate for them to receive terrorism protection training”.

Enhanced Duty Premises & Qualifying Public Events

Larger premises and qualifying events will need to comply with all elements of the standard duty, as well as several additional measures. These are;

a terrorism risk assessment must be produced,
a named individual must be appointed as the designated senior officer for the premises or event and will be responsible for regularly reviewing and updating the terrorism risk assessment,
organisations must implement reasonably practicable security measures to reduce the risk of, and harm caused by, terrorist acts occurring at or near the premises or event, and
responsible persons must prepare and maintain a security plan, which must be provided to the regulator.

The bill states that this obligation should not impose a “disproportionate burden” on the persons in control, however, it is expected that security plans will be required to include;

Procedures for alerting the emergency services
Procedures for alerting persons at, or in the immediate vicinity of, the premises or event;
Procedures for securing the premises or event, where it is safe and appropriate to do so.

How Will Compliance Be Measured?

A risk assessment based method is encouraged.

It is currently proposed that “compliance would be demonstrated by providing assurance that the threat and risk impacts have been considered, and appropriate measures have been considered and taken forward (implemented or plans in place for their progression)”.

These risk assessments will need to be recorded and retained by organisations to demonstrate that action has been taken, should evidence ever be required. They will also need to be reviewed at least once a year and when circumstances change either with their external or internal risk context.

Internal risk context - for example, following an expansion of an organisation’s premises and/or staff numbers, or a change in the business model, such as a restaurant starting to serve customers outside.

External risk context - for example, a significant terrorist attack in the UK or a change in the Government national terrorism threat level assessment.

What Happens in an Investigation?

It is currently anticipated that an inspection regime would be required to evaluate whether those within the scope of the Terrorism (Protection of Premises) Bill are meeting its requirements.

When investigated, organisations will be expected to demonstrate the steps that have been taken to prepare for and/or respond in the event of an attack.

This may also include providing completion certificates from appropriate staff training courses, evidence of physical security measures and evidence of an attack response plan. Where steps have not been taken, they will be expected to explain why.

The term ‘reasonably practicable’ requires owners / operators to weigh a risk against the effort, time and money needed to mitigate each risk. If measures are not deemed ‘reasonably practical’ they will not be expected to be implemented. The Government concedes that it doesn’t want to significantly add to the cost of hosting events, but financial considerations have to be balanced with the need to protect lives. Therefore simple, cost effective measures are favoured.