Cutting Security Costs May Increase Risk

Press Release from iStockAnalyst.com

Controllers trying to keep a lid on security costs will find the challenges greater and the stakes higher than in other functional areas. An organization that goes below a certain minimum security spending will find itself assuming a level of risk that it simply can’t live with. Statistics reveal that companies suffer more burglaries, shoplifting, robberies, workplace violence, and insider theft during an economic downturn.

The controller’s challenge is to identify the most successful strategies for cutting costs without increasing risk.

What Amount of Spending Is Typical?
In a recent survey, Security Budgets & Cost-Containment Strategies 2010, I OMA asked security executives about their organizations’ total projected spending on physical security and asset protection in 2009, including planned capital expenditures and security operating budget.

While the size of the company determined its total security spending, the average total spending on security in 2009 was slightly more than $4 million, while the median was substantially less (roughly $1 million).

The median spending on physical security at firms with less than $10 million in annual revenue was $337,000, while it topped $1 million at firms with more than $1 billion in annual revenue (see Exhibit 1).

The survey also examined annual security spending on a per- employee basis, excluding visitors and clients but including temporary workers and other regular building occupants for whom security services and protection are provided. Overall, the average annual security cost is $645 per employee.

Half of all respondents reported spending less than $500 per employee, and half said they spent more (the median). The median cost for security on a per-employee basis is up 23 percent over the figure reported in lOMA’s national security budget survey conducted in September 2005.

How Much Is Enough?
The majority of security executives believe security spending is sufficient when the organization allocates more than .75 percent of its annual revenue to security. When companies allocate less, a majority of security executives respond that security resources are inadequate (see Exhibits 2 and 3).

Overall, 39 percent of organizations spent less on asset protection in 2009 than they did in 2008. Only 26 percent of organizations are spending more. The average change to the 2009 security budget is a decrease of 2.1 percent, according to respondents.

Bearing the brunt of the economic decline are the security departments at large and publicly traded companies.

Publicly traded companies reported a 1 0 percent cut to their 2009 security budget on average.

At production and manufacturing facilities, the annual median security spending per employee is $425, but the average spending among those in this industry who believe their spending is sufficient for a quality process is $789 per employee. Financial firms also appear to be under funding security. Only 7.4 percent of financial firms spend more than 1 percent of annual revenue on security; most spend less than 0.5 percent.

Additional Key Findings:

- A majority of business and professional services firms allocate less than 0.5 percent of revenue to security.

- Labor costs dominate the total money that companies spend on security, although the percentage allocated to personnel costs is notably less than a decade ago, when roughly 65 percent of an organization’s spending on security went to personnel costs.

- The annual cost of security is influenced substantially by whether a company leases or owns its facilities, says the survey. The cost for security ranged from $2.38 per square foot for companies that own all their space to $0.55 per square foot for companies that lease all their property (see Exhibit 4).

- Financial firms spend $480 per employee on security, while the average “sufficient” security spend is $584 per employee. Biotechnology and pharmaceutical companies had a similar level of discrepancy: spending $650 per employee on security annually but $800 per employee at firms where the security department says the security funding level permits a quality program.

- The perceived threat level is the most important driver of security spending among all types of organizations: nongovernmental/ not-for-profit; for profit, privately owned; publicly owned; and government/ public service. However, among for-profit, privately owned companies, the company’s financial fortune rates nearly on par with the perceived level of risk (2.10 versus 2.22). The gap is greatest among nonprofits. Of these organizations, risk rated 2.48 as a driver for security spending, while the score for financial performance was 2.03.

- Organizations spend $4.50 per employee annually on workplace violence prevention activities, training, and materials for the general workforce, according to respondents (median figure). Government and public service organizations reported spending less than other types of organizations.

- The average spent annually on security awareness (excluding workplace violence training and awareness) is $10 per employee.

As expected, for-profit firms spend the most.

- Companies that leverage the different strengths of both in-house staff and contract firms in their background check process report paying the least per new hire.

- Benchmarks suggest that if a company is paying more than $500 per officer in uniform-related expenses annually, then it may want to look closely at this budget item for a way to cut expenses.

How Are Businesses Cutting Security Costs?
lOMA’s survey collected data on security cost-control strategies. In addition to establishing benchmarks on the use of each strategy, the survey asked security executives how effective each was at controlling costs. Here are some of the highlights:

1. Replace Security Control Centers With Fewer Monitoring Stations. This registered the highest rating by a significant margin (see Exhibit 5).

2. Ask Employees to Do More. Some 77 percent of companies in the last two years have required their security staff to do more in an effort to cut departmental costs. The measure also made the top five for meeting cost-control expectations. To date, companies are still finding it an effective avenue to trim costs.

3. Switch Away From Videotapes and VCRs. This rated in the top five for cost savings, and 66 percent of organizations have done it in the past two years, making it one of the five most implemented measures over the last two years. According to respondents, switching away from videotapes and VCRs – in favor of DVRs for example – provides a return on investment that typically far exceeds expectations. Strictly in terms of cost control, respondents indicated that few strategies provide a greater payback surprise than replacing videotape as a surveillance platform. Cost savings should continue to increase as storing digital video gets more inexpensive due to better video compression formats and the cost of hard -drive space continues to decline. Meanwhile, maintenance costs for VCRs will only increase as fewer units are in service. The move away from videotapes is often a result of a move to IP based video surveillance. Cabling costs are three times as expensive in analog systems as they are in IP-based systems.

4. Revisit Security Contracts and Their Service and Technology Acquisition Process. Respondents say that three of the best ways to save money are in this area.

Not surprisingly, the least popular ways to cut costs are ones that require a substantial shift in operational strategy. Switching from doing things in-house to outsourcing or vice versa comprised four of the five items on the list of cost-control measures implemented least often.

The Pressure Is Clearly On
Security purchases that promise a return on investment must deliver as expected. Choices regarding where to allocate increasingly scarce security resources must be correctly weighed. Cost-cutting efforts must show real savings, but can’t create untenable consequences. Simply put, as a company’s profit margin gets thinner, so does a security budget’s room for error.