Securi9'_

Journal
ELSEVIER

The security-strategy interface: using qualitative process

models to relate the security function to business dynamics

J.H. Powell..... J.P. Bradford b

• . 1I0Mafdll.... ; od ;O,...,.;M

......
Aa:epIcd ....... ..-be:i 10 tile ,..rMiolI 0/. atntqy' within a -IW'Y '*'"
rc:liaoo: e:- ~ IIbility of IlJoe ~ "'nctionf
of the .....~ to cunlrilulc ~ _ of thMllnle«r. ThiI; oonll'ibu1iQa Qlmcb II IIIl1d110 the ICCIIriIy fmocI:il>D ., iI
<loa 10 awkc1iDc ..... producbon. Thl: toOls ....::a<uy 10 support WI axItribulioQ IIIUS( be easy 10 _ , -nil ~ in llJoeir
OIllput, In rootn5t 10 lIM: more ~ lOOlI mel frameaooru appropriote for lbo: &foboII mal. decisiool makinI of the
COO'lIIW'Y. A partirular techn>que. tDoom .. Oual~ System Dynamk:a{OSD) iI presenled. Tboe _lbod illCflI to be IIimf'Ie

mediwll for bricfi..,1eIli<x lIIIDItm'etll. ~ ~ if doe.cribed. "'"'*

in _. intuitive in applieation and l\Ilurai alld eff«tiYe in ill llClion plannios prodllC\l. II prooidel a _lUI and IIXtaible
a practical CIK Mudy, bMed on tbe ..........,_01 of
a product ufely \huIt 10 a Iar~ ..permartel. C 1998 Elsrno:, Sciena: Irc:Iand Ltd. AU ripll __""d.

L Saw My . . . .....,. let rt'ss
Scntev rihia lbe: portfolio of. ownpanya .aM-
tiQ is IIIUaIJy _ ali .. • . . ·1b'1titta IIpOI die impor-
tant .iI:a.oa iD eontJul with die day-to-<by opw.OOIllS
ul the OfPtliAtiol1. It • to do witb problem$ (II"
opponllllitic:l MIicb IIa¥t a kla& .i mle aDd wlUc:b
require Iarp aUocaliom of ~ and SJIllD' of
control. SlratelY is to do with lhe biI isweJ.
As such it has been Ken in tbe pal II Ihe hems
domain of senior memben of the U«\Itive, to the
alellt thaI a whole'corpus of $ln.teP;: Ihintiog (the
Desipt JoChool) <M.iatzberlo 1994) aees IInlegy as e~·
dUlively the preroptive of the CEO. Stategy i5
pwed down from the: top IlId il iI Ihe role of the
SlIIbordi.Dates merely to ialpleJnetu an idea wbleb
tpriDp fuIJy fOl'lbed rn:.:. the out-tray of the top
e-=uti¥e. Altemati¥c cootemporaf}' lllood. praenl
·Ceo. I ... _ .
!he idea of all orpniaatioa in whid!. RnteP: mo-
otpb eUler,., from all. Ievd5 and fnnctiont. of the
orpnisatioa aaudinc to their dcl'« of (I)Otad wilh
the outJide Mldd aDd their "",",Iired knlJwied&e ol
the operati0n5 ol die pany. n- ~
modeb of an j1iol> mati. an IIOIW !!lOre
widely iklt'CptnI (Quiao, 1\llIO; Qu.inn et at, (992).
Tbe "meg)' of the COll1patl)' is :lUll as • two-way
proceu. Ardlilti:tural hlirleWOrkJ arc p;lSSCd down
ff'Dll:l the top, while pt'OpOIIis for the elementl of
ltflllety and judgements of feuibilily are passed up-
w.rdl. III this model the top mant&tment are seen as
mucb to be lIClcctilll from a menu of pullltive "rile·
pes ali they are iDvelltitl& new ooes from la"IU:h.
Under suclI • concepl of stratepe deci$ioIl makiltJ aU
ol the fImctioas iDdudUil tile IOmCtimClI lIta\«lcd
-tty functioa within !be ...... paay arc in I poIitioa
10 ooo!ribule 10 the ~ ilnttl)'.
Withill adll framc:=0lk. tbeo, the seo.aricy "","IL
ill aJoapitk the opentioIlt mro • r or ...... hal
a Rip(' -.aiIy as -.B II • ri,bl 10 ooouibluc 10 the

"*
O95J.l~/9Ifl".oo
'I' SotH·I"unlHOU·4
•• ~ sa.- Irdoad Ucl. AI .... .-..L
clementi of a <;()fJIplUIy strategy. In each ease sl,l(h
contnllutions mll5l be limited to the function's area of
competence and relevance. but there arc strong con-
neclionS between the security function and tbe com-
petitive advantage and competence of the firm. Just
as a company luis to defend alllinsl commercially-dc.
rived preSSllres (Poner, 1979), w it must not ignore: in
its bu~eSll planning the il'DponaDCC of threalS and
prnsurc:s whicb o~te ouuide th.ilt COIlImertial
structure, what will be called here exogenous threats.
Moreover there is a po5$ibility that with the correct
tools, core competenccs deriving from tbe SCCllrity
fuoction of a company, and in particular that of threat
pallem recognition un make a positive contribulion
to the competitive advantage of the romp.my.
The tools needed to assist this contribution must be
able to cope with more IhM the analysis of the
strategic context. and tbe generalised issues of com-
petitive advantage. indmt!}' structure and core com-
petence&. General strategic questions demand gener-
alised tools: specific qucslions demand specific tools
and approaches. The strategic tools of value chain
analysis and industry analysis (Mintzberg et 101., 1998)
are essential to the undentanding of the wider strate-
gic picture and the setting of the overall architeclure,
bUI tbey are not specific enough in their OIItput for
the specific functions of the complUly, and hence for
the IIOClIrity fuflction in particulaf.
One of the !.ignificant chantcteristics of the impact
of business is!;uei upon the security function (and
indeed other functionS of the company) is their dy-
namic nature, Customer demand Wlllles and WllllC5,
peer companies shift from postures of co-operation to
more ovenly competitive stances and the threats to
which the security function must respond rise and faU
in intensity. The contribution of Ihe security function
to the ovcl1lll Slrategy, then. is to make sense of the
specific impact of the exoseoous tbreats and identify
the impact of tboK threats upon the sustainability
and future SI/CCC$l!l of !he cornpany. For that purpose
an easy 10 use dynamic analysis tool is required which
can weave security dynamics into the wider busil\CSl;
P'=.
1. S,...... ~ _O'dlllMa
...
There are a number of candidate approaches to
ana\y$ing wch dynamic proc:e&:Ca. Comparative sur-
veys of approaches and rnc:thods (Wilson, 1990) and
more general coosideratioos of modelling aa part of
tbe decision making process (Roscnhead, 1989; Riv-
ett, 19')4), are readily ....ailable. Generally speaking,
quantitative modelling metbods are not partic:ularly
effective because of !he nature of the variablel in-
vuJved in strategic proces$C$ (and, indeed, in sccurity
iuelO. Both domains are concerned with a wide l1Inge
of variables which it is difficult, if not impoaible, to
quantify. While, for e:tample, we rnay be able to say
whal our price- margin in the market pIao;e viJ-i.-vis
the competitors' producu may be, it is often difficult
to be sure about the clolely IlUOciated underlying corn
advantage. It is even more difficult to state numeri-
cally the level of a more qualitative but critical vari-
able such lIS, say, Ihe intensity aDd nature of threats
to our bluiness from new entrants to the industry. A
qualitative model is more likely to have the breadth
and flexibility of content DUded for the represcnta-
tion of strategic and sccurity dynamic$, and although
the precision of numerical models may be desired,
that precision, in the area of strategy at least, is often
illlllOl)'.
The extensive work on soft systems models of vari-
ous types (Checkland, 1981; Oledland and Scholes,
1990) have shown themselves to be most effertive in
tbe bands of expert users, but can be costly in time
wllen used sporadically by a user wtw.:l5e day-tCHlay
interest lies elsewhere.
&tensive experience with security professionals bas
shown that an extension of Ille well-known systems
dynamics influence diagram (Coyle, 1996) is well·
suitcd to Ihe representation of the dynamic interac-
tions between sccurity issues and company strategy.
The method has proved easy to learn by security
professionals from a wide variety of bacqrounds and
in use gives a !lOUnd and contnbutory llCtioo planniD8
produl:t whil:h linb security thinkUIg with strategic
issues. Moreover, the system representationS are ac-
cessible to lI()ft-usera, 10 that it ill In etftdive tool for
presentations to senior cxecutives. Lastly. the analysis
process which it uses is intuitive and transpbrent,
providing a natural framework for reponing by both
written and spokn media.
This paper brieDy describes the qualitative systems
dynamica (QSD) influence diagram method 11$ gener·
ally used in 5«Urity applications together with the
extension to ronvention.al loop anaIysU. This ap-
proach is then iIlU5U'llted with a ClI$C study cumpk of
the interaction between produC1 safety issues and
overall businesl performa~ for a large supermarket.
The central part of !be QSD approach is the reprc-
scntarion of the dynamic procc1se~ within the S)'ltem
under consideration through the medium of an infI.u-
ence diagram. It is appropriate here to dClcribc only
the general approach alId grammar of these diagrams.
leaving advice on their generation to authoriries such
aa Coyle (1996), who offers particularly cIcar and
practical instruction. In trials with security profession-
als the generation of the influence diagrams has not
only proven to be natural and eaay. bIIt has of itself
 I.H. A>ood, I,," IJo
enhanced their u.odcntandin&: of the socwiry dy.
IWIlics d..n.n, lhe pt0tu6 of model buildiq. The
spc:c:ific embodimeol of tbe mclhod ~poned bere Iw
beeo Ipplied 10 • wj(Je vanery of cues. illdudln&
airporI seeurity, C'OIIIptlitDl" inteUigellClC and producl
Aic:ly, IS -U I f 10 • oUlllbn" of IIIOre smeral 1Nsi-
_ app!ialions. aad Sysaems Dynlmics in ~ra1 ill
• _n-ac:cepted aad 11M' fuI ""d'Oiquc: with •
plelbon of s....t t..fiaI .pptiratilxa.
The purpoIe of the iaft...ence lfia&tIm .. 10 _
mari:tt 11. WI'! in whicIt fat10n witbiIl • dy!lamic
sysr.~ atfecI OIX aaotba-. Let lIS ..........1' the dy-
TI.l!m .... of IIIacb 011 produa inlqrity. lay the IIeIin:
of III IDimaI riJhb pi 're IJOUP 10 diacredit I
msmclic produa. Whilo:: mall)' bl:tors will de(( the
Aiery of lbe product. il will certaiDly be the: IJIOI'C
¥U1rlenbIe if il beoomes attractive 10 the: preMWe
poop IS I lIrJC!' 1be vuInerabiliry here ill lhe likeli-
hood thaI our prodllCl: iIIlttded 5·"'tttStully, and 10
includes both the mlllCe !bat it will become: the
objecl of lUI attlCk aDd the likelihood of that ItllCk
5\Kttediq. Tbere i&, lheo, I rdatioD$hip between
'vulroerabiliry of product' and 'anrac:tr.·eness of larget',
whJch iI sllown in an influence diagram (Fig. I),
Note lhl! the arrow CQfIlleCling the vari.blu has a
p1~ .tJII IIt.a<:bed to it. This indicatea not that either
of the variables will necasarily ~ (they might
or might nol) bul rather thaI if 'll1raetiYc_ of
lIJlCt' ~aseJ there will be • OOll5equentia! in·
nuse in 'vulnerability nl procNer. If the correlilion
between variables ill Drptive (i.e. 15 oac YUiablc riles
the odicI' flBd, I negative • is IUac:bed 10 the
arrow. For aample, if !be jXIIic:e are pcroeiYed by !be
prel5Ure poop 10 be putiaalarly mpced in the pre-
~1IliOII of IllacQ on !be producl: iD 'I' lioa,!ben il
micht be ..1ppOHd thai tile IU~_ of tbe
product to Iliad ..,11 fail siDce !be litellbood 01
del:eaioD, or die Tet(IIIIfaS nquiftd 10 IDOI1IlI I IIlC-
ee.fuJ. ItII(l would incRlIC- This ill sbown in F... 2-
I..qjtiIute VIriabk:& in an iaftIItuce diacnm are
l!lose wIIidt oould be *""' on I Jellk, Wlroile it III"J'
_ be P 5 ibIe aaually kl nxasun: 'IeWrity of terror-
is! threal', for UMIpIc:, 15 I number, it iI pouotillly
apnuibIc ... Ic¥d on I diding M:IJe.
lnfIueaoe diaJnms CIlDlain I number 01 thne vari-
ables 6nted by InOW$ ~ !he a:wreIation
between them, .nd these diagramI. will invariably
...
.-'.,-
_.
.- /
f\l.1. ApooolM!""" ".i= _ _ ~,
1': I s...n,..-... 10 (1M) lSl-l60
"'
-
""'1.,' •. ..,_'1 1
•
' •• '1
....taia klopa.. 1'bc:Ie ~ Kb of variabIa wbicb are
aIIllIeCIed by InOW$ ill I c:ydie fa$l!ioa F". .. ] ihDM.
typicaJ eDlllpIe. tine __ see tIlII • rile iD tbc CQt of
aoodJ will deae_ the profit (1lJ otber Ihint;s bem,
equal), aDd that if I product is makioJ bip prOOl5 il
will become aD altrXtive lItFt for !be animaJ ri&hts
prcaure croup. As above, if the IltrlC'liw_ of the
W]et product is iDaeased it is ISSCrted that lhe
vulner.bility of the prodl>Cl will illCKuc. Lastly, lhe
loop is closed by linking 'V\Ilncnbility of product' 10
'con of goods', the IlJUIIlCnl bdn. that a vulnerable
ptoduct will require enr. re!iOl1lCl:S 10 ensure its
lollfery, lilly by the provision of detCC10r closures, or b,
• more 5CCII£e channel of d~ribution. Fig. 3 then
shO'll'S that there is a clo5cd loop of .rwwa .... hich
connect these variables.
There are two rypcs of loops. If I loop COIlIains
only pasiiM llITOM, it is easy 10 see that • $lllall
chan&e in one variable "';11 c:ascade .rouod tbe loop
increaio& !he vlllue 01 lbe othtt YIriablcs. 1£ lhcTe
_rc DO otlw:r oontrollin& fx1or, lbe inc:rcua arouDd
!he loop wuu)d rciaforce oae anodlcr ud ~ woukI
be I 1C1lt· r;y for the ..mabka in the loop 10 iDcrax
(01" 10 Ocaeasc) witboul lilllit (see F.. 4).
If, lhen, on .....minatio!l of !be iAlllleDOe diaJn.m.
_ see kIop; .nic:tt QlIDIain oal)' poIilM:: :;anvoos, _
sbnWd IIOCe that !be dynataica wttidt lbc:y leprc::Ktd
wi! IIave I WDdcIlCY 10 IWI IWIJ, eitber .. I poUt:ivc
direction 01" iD • ncptM diJettioct (de1Xndiac on !be
diJ«tiun in wbidt lbc:y swt). SucIt Ioopa are referred
10 15 'UlIAabIe' 01" 'tunaway' klopI.. 0bie1'Yation 01. the
fOCopc:iiid, for lbal partiaIIu dyBUIic loop 10 NO
away witbouI. limit .. I dear inl;Ii(:aliolllhal it requitc$
Il1IJ'IIIeIMnt anentioa, ei!ber beca._ it is • plxDc:>-
menon .... hidt we 1ridt 10 promote 01" 10 I¥UiO. 1lIis
tendency will tmll to be CClIlDkncICd in reality by
OIber facIors, -'IllDe derivio& from the etf«u of Olber
loop dyaantia within the uiIIins IlIOdeI and othas
front unexpre5lCd limitins ma:ltanlsms bul the \IIldcr,
lying instabiliry of the loop is nnertheless aD indic:a-
tion thai the corresponding btJ5irIeK dyrwnica are
appropriate itertlli on the manapmenl agenda.
A loop wIticlt has • single neplive IiJII, bowever.
willl'JOl neeessarily cdlibit unstable behaviour, There
mlY Ix: a tendency for the loop to "'bUise if tbe
 i.H. "'-It, J.P. I1NJftJtrJ I ~~ II) (/993) /5/-161)

.. . . ..... . ..

1
.1

-... --./."-.1
• ., II~ IIlI 1 ...
r·. ~
.

. " ...
fla. (, ~ the ~Ion d • omall dIaflte IfOIlIId an
_ _ (ru.-.y) loop.

down a oomplicaled system into individual dynamie

elements.
•
....-. - In ellaracterising 11 partjeWar loop as inherenlly
unsuble or potentially Rable, it ill DOt intended to
imply lhat the loop will, within the eontext 01 the

/
system, exhibit ally particular behaviour. Frequently
the inherent instability will be OOII.tained by the effect

.-
....... ·n,
I'll- 1. A IDop cnl'Ol:l<d r""" ... inlIuer><e di.>&Jam.
effect of the negatively OOlttIaIOO OOIIlIeCIiOII is suf·
ficiently ill:n:.m,:. Unlike the runaway loop, there is the
potential for !hili latter IypC w be IIllIIUIFd 10 a liable
limited condition, and such a loop is known in the
systems dynamialliteralure u a 'malIllI'=d' loop.
Funher eMll1inalioo will reveal that, in examining
the stability of a loop. two negatives will cancel one
another OUt, 50 that the oawre of a loop, i.e. whether
it ill inherently unstable or potenlially 51able. can be
detelIllined by applying the folklwing rule:A loop
which has no ~tives or lUI even nwnber of negalive
signs atladled to the l\ft'OW5 is • rutlaWll)' loop. If it
IIlllI an odd number of negatives it is 1I. managed loop.
An example of this limple loop analysis is coo-
~ in the ca&e S1udr below.
This nile then provides the basil for • simple
unssment of the nature of the dynamic prove.....'
within a sys!ClII. Those loops which are identified lIS
being potentially UIIStabIe represent elements of a
IDI.IIIgement ageDda aimed al promoting those mech·
anisms whieh we wish to happen, and altenulllil\&
those dynamics wl1id:l we wish to suppre$. By extract·
ing (by iDIpe<:tionJ from the inftuenee diagram aU the
Joops and characterising them lIS <k:sen1led above, the
essential cbancteristics of a compOCated system can
be IIDOO\Iered. 1be extraetion of the loops breaks
of the rest of the l)'IIeDl, but the inherent beluwtour
of the loop provides a IDtlUIS of determining the
pouible aetions open to an interested manager. Fig. 5
shows an eDIIlple of a managed (and lienee poten·
tially stable) loop by way of lII1 eumple.
3. J. Ac/Of" IINl1y:Iis
A further step of loop ana/ysilI is ooneemed with
Ihe degree 10 which interested panks, the actors,
have a motivation and/or a IIO""t'r to Iffect the dy-
namics of the system. The objective here is 10 disooYer
management actions whieh can influence lhose par·
tk:!; 10 the benefit of the client orp.ni#lion. 115 aim is
10 identify the parlicular clemenu of the dynamics or
the system over which interested partie$ have oontrol
in order to promote that power or atlenWite it acc0rd-
ing 10 our interest. Additionally, the motivalion of the
parties is taken inlo account, since it may be within
the pqweT of a party 10 affccl a particular element of
the dyrwuia but DOl in their inlerest. The process of
analysis is _nlially simple.
Firstly a list of interested pllrties iJ compiled. In the
example of the product safety system commenced
above. the interested parties may be:
$, the market;
S, the !leCIlrity function of the company;
C, lhe PR function of the company;
A, the decision matel'll of the animal rishts pres-
suce group;

F.. 5. A ma"..J ~ """'lIliftifla 0IlIy.- .....tm .....
P, the police: and
M, the new$ media.
n.e analysis is essentially an iterative one. If a
significant party is left out of the lllIlIlysis al the
becitlllini and it beoocnes IlPPllIcnt thaI the gap is a
significaol ODe, thai par1y can be included at a later
stage. Practice shows that this iterative procca is of
OOI\$idcrable benefit in representing the management
problem: idelllification of the interested panies fur-
ther informs the system understanding 50 thai all
influence diagnm may be enhanced, which in 111m
fwtber informs the understanding of which partie$
llH: significant in determining an actioI:J plan aimed at
mal\aging the system.
The seoond $lage of the lUWysilI is 10 examine each
loop aDd identitY whkb panie$ have aD interest in its
behaviour. Each arrow in lbc loop then has attached
to ;1 the name of each party who ClUl inll.uence thai
eJcmcnt of the loop. Using the loop of Fig. 6 as an
eumple, we might artadl the interested parties to the
arrows of the loop lU Ibown in FJg. 6.
For example, il might weD be the judgement of the
company'l accutives that the COD.lle<:1ion between the
att.nlctivenesl of the product as a larget and its coose-
,,,
-
--
wto... 7,
quenlial wlnerability is under the influcooe of the
police and the security fuooion of the company
togetbcr with lh.e pressure group (P, S and A), since
the activities of the IiCClIrity and the poli<:e hlwe tile
potential 10 alter the lkgree 10 wbich the pressure
group will see the product as a viable target. Similarly,
the extent to which the link between profitability of
the company and the atiractiveneS6 of its prodllClS a5
a target will be subject to the effectiveness of tile PR
function of the company (C) in auppressing inap-
propriate news stories together with lhe compliance
(or otherwi~)of the media. ll>e ~e group dearly
also has an influence qver this lillOW.
'The purpose of attaching the IlllIIlCS of the influen.
tial parties 10 ea<:b arrow is 10 provide a cue fur
management actiom which can be laken so 3$ to
promole or attenuate the influence of the loop. In the
eumpk: of Fig. 6 it mi&ht be concluded that since the
pressure goup (A) haye an intere51 ill wppressin8, the
effect of the loop and ~ they have In influence
<:NCr the element of Ibe loop which links competitive
advantage to romumer demand, we m;y.t R'llQI'!ably
"pea to see lI;\ion by the presIUIll pvup to weaken
the a.mversion of our competitive advatttage inlo $3le$.
This may show itself in the placement of Degative
 IR. "-'t I.t'. S,04f.ui IS«wiIy~/(}(199d) H/-/(t)
e::--dooo,.01
~+
ca" tid..
....ll8\ji .
~ ~ft~
messages in the media, so that any conjunl;tion of
interests belwecn M and A in this respect is made
more significant. Our management action might then
include a specitK: intervemion by our PR function (C)
to rounter any tenOcll(')' of the press to lmen to
interested stories by the pressure group before such
ncp.tiYc ~ses arc placed. Sll(h aetiCHI might in.
dude early briefing to cllltlre that the company's facts
are plal:Cd before the ~ in advucc. oo.m to
morc specific IDCaSUrn 10 cnsure that indMdua! re-
portcn give our company a sympathetic hearing.
Thirdly. II u!ICfuI ancillary analysis stcp is to takc
each particular loop and adopl: a stated specific view·
point upon it. For cxam:pIc, in the loop of Fig. 5 we
would clearly wish to adopl: a viewpoint of the 5CCIlrity
function of the company. but we might equally well
willi to improve our undcntanding of the situation we
are seeking to Ill.llMgC by taking .. number of other
viewpoints, for cumplc, the prcs:wrc group or a ('ll)Ifto
pc1i1or. The ob;cttivc of this third analysis step is,
again, to identify the componcnu of an action plan
whidl can contribute 10 our particular objectives in
....
the management of the systcm which we have rcpre-
scnted.
Before examining some of lhe por.«:!iealitics of the
approach wttidl ha~ cmerged from cxpcricnoc with
the method. a Clllle study is prnc:nted in order to.oow
tbe metbod more fully and in order 10 provide a
furthcr cumplc of the analysis stages.
This study reports an &llI!ys.is of tbe impact of
product safcly coosidcrations 00 the tmsincss »>an-
ning of • large food distribut;oa company, mown
here 115 Fo<x!Q), in partiatlar respccl of • large
multiple retail outlet in Orlordshirc, UK.. The 5lore
has a very wide ~ of prod\lCtS and is typjcaI of the
large supermarket complexes rlCar 10 .lmosl cvcry
large lawn in &rope. Inevitably. pan of ita a1ensive
prodl.lC1 range wiIJ. include itclllJ whictJ may, witbout
wamin&, beeome the target of prodl.lC1 integrity at-
tacks, cithcJ from. Illy. an a.nimaI ri&hu group dilsal·
isfied with the product;oa or testina process or from
 J.H."'-il,lP.M.
nliooal or Unlional vmdictiw: atIXb from indMdu-
ak. W'IIile Ihc: Slore has DOt been, and docs IIOf apec1
10 be !be Rlbjoct of ~ altacb. lYdI considenliom
are 'Widely indWcd in opcntiollal pLonnin, oflbcx
retail oulkQ.
............
TIM: opc:nlioDal planni", probk:m eaa l!lindon: be
~
By ·1 _1M ....1..... ~ tlo< _ _
FoodCo - - . iokMiIy .. II ....... - " " ~
"'*" b Ill< I j.
Inilial discussions suge6ted a suitable Slarting point
as the attractiveness m
the larget - wblll malr.C$
FoodCo a potential YiClim? It emersed thaI three
facton ClOIllribvtcd to the altBaivenesti of the Wpcr-
market u a talJCt.
F'trSl was a CXMlSidcration of tbc prllCalS Il50Cd in !be
lIWIufacture of its product nDF and its ClIViromncn-
tal ctfect. 1'hiIi comprised a broad audit of the tedJ-
..;qua IIKd by IUJlIltien .mio:h may QIIR a octtioll of
lOCict)' 10 ..... a Inrof campait:n ~ !be dla.ia.
For ..... mpae. the II5C of b6cKhed paper bleac:bcd in
!I)'pelle products, oe the: laC of ccnain iodiscrimiMle
Iishio.f mc\hod$ ...tDr;h QUIC unacttptable coUouen!
fatalitie5 /MY incite action by pr-essure poops.
TIM: second fxt:or was tlu.t of !be raw materials
tbclll5e!vQ. PublX: la5Ic::s may differ, lor cDalpIc, over
!be II.pproprillteness of the lI§e of cemin animUs,
either as a food ilOUrt:e or u other raw material. A
HTIalJ 3Cgl'DCnt of the community may chooloc 10 wage
a ampalgn against a particular relailer as being the
Jrl()$t high profile ilUpplier of the good which causes
IlUCb Qlfence. Lastly. the tcstina methods are of sig-
nificalllCe in nisirl& the threat foe lhe retailer. Stock·
iog OOIWDCbaI which inY'Olve lesting 00 animals is
probably !be _ high profile aample of such
phenomcOll iII IllCCIll tima.
1'hiIi audil of vulDerabWty suges;ted that FoodCo
0ClIlId indeed be at rid; from Mdt actMty. The AIpCT-
mad:e(', FDmlI attraetiYe_ as • WF1 ieadIi 10 a
~DtiaI iDcreI$C iII the V\ilnerabWty of partial-
Iar producu. 1'hiIi product vub:nbility feem diuclIy
inlo the aast:QlDCn' ~ of the I&fety of !be
prod....
4.1.I,1JIeitlJfl-ce~
"The influence: diagram of Fis. 1 emerged fmm
CJDr\$identlom of a number of associated media·
nismlI:
(a) the relatiomhip befWUn cost of pxls, tbe price
ill the martet, lUld the resu1tins demand and
evenlual profit 10 FoodCo. This dynamit" QI\ be
r oI/~~/I(J998)JjJ-1MJ
"'
5C'>eD in the top right KlClioa of FIg. 1 (not:e a in
the figure) by followUl& the dlain of lJTOWI; '«lSI
of JIJOd:5 -- price iD market -- ClOOI~titiYeadvan,
tage __ alOSllmct demand __ profit'.
(b) 'The CXJN""'•• I between the (actllll) vu1rlerabi1.
ity of lbe product, eoasumcn' perexpOons of
product safety and lbe intenetiDn berweeu that
~ ~ and the ckgee of nepti¥c media
auentiort. 1'hiIi can be teen {oote b in F.,. 1) by
foUowing the dlaiD: \'\Ilnenbility of wF'-~r·
cei¥cd produd safety-<iuality/fe.alures and by
obM:rvi", toward the left of Fil. 1 the effea or
'negalive media allention' mfucinl lbe 'per-
ccivi:d prodllCl safety',
(e) Conlidcncx in the produeu sold by FoodCo is
Ilffected both by attacks on FoodCo and anacts
on the rela.il food indllStty in general. Thus we
see in Fi&- 1 (note c) a sct of conne:dions (in the
botlom left) between 'no of terrorisl allacq 011
company' and 'number oflClTOrisl actions iII the:
ilKIu5tri, Thc:se in tllfll affect the: media iDterest
('time on media') and the product safety.
(d) the effect of FoodCo's PR fullCtioD 011 the: IIIICdia
.is lIOI to be iplra!1.lld towanb !be richl lX1Itre
of F.. 7 CDole d) ClllI be teeD lbe variab6c
'ddellJive OOll!Cnt of~, whidl ;, iDiIi-
pted by ·neptM. IIIICdia anenUon' and whidI
will raull io ao iDc:rtase in the '~ra:ived
product safety' of FoodCo's produeU..
While the four main mech.ani$/n$ above p«Mdcd
the ~ for the diagram, many otber arrows QlI be
_n conneetinJ the variables. Fot example, the 'at·
lractivene", of the largel' (centre right of Fig. 1) is
arfected by the unaa:eptll.bility to the pressure group
or the processes of manufaclure, raw maleriaJs. eN"
lesting metbods.. Tbe altTlClNeDess of the: hUICI is.,
however, reduced by the atent to which the police
are eoncenrnrioa upon wpp.--ing suc:b activity ('p0-
lice CllpFlDmt'). ComelSoCly tbe animal ripUi ae-
liviJU may be prooooked 10 attad; if FoodCo', 'profit'
.is hlah. DOt least because this represents a more
damapng ioIavmtioa. 011 their pan. Alleotioll is alto
draWlIlpCcificaDy to the lXJml«Iioa between 'V\i!Der.
abilit)' of product' aDd 'OOIC of pNi', a CJlIIlOecIioa
wtUetl recopile:s that a ~ vulocrablc product ,.,iJ1
require addiliooal, roRIy meaJ!!fC$ to ensure ilS Afety,
such I!II deteaor do5Ures. or graler application or
5CCllrit)' stalf's time.
'The result of suc;h corWdentioo. <Wer a period of
apprm. 6 h of group work, is the $ln.octure of lhe
influence diagmn of F'lJ. 1, Funher lXlD5ideration of
the potential conlribulion of the: acton (So S. C. A. P,
M) defiDed above, leads 10 tnc description of the
atenl to which tl\o$e acton OOlllrol the conn.eetion.
This ill 5bown in Fie. 8 by the attachment or
the
 ~­
•
appropriate tenens} for the actors to the arrow SYIII-
bolising the connection. The previous eumplc (Fig. 6)
can ll(l'W be Soecn to be an extract (rom the full
diagram of Fig. 7, and illustrates the process of 'poli·
ticisation' of the diagram.
4./.1. Loop llM!yjU
Inspection of Fig. 7 reveals a number of closed
\oop5. hut for the P'llJl"*' of illustration only one ClllI
be discussed here, although thoe discLl$Sion allcJ'l>e SUT-
roulldill& the loop of Fig. 6 provides an lKlditional
example. 1lle llClual ~uation anal~ i50laled all tbe
loops in Fig. 7 and e:camined ca(:h in a way ~ilar 10
the analysis shown here.
•
... -
--
,..
4.1.2. T. Alrraclk'C,,~ of Ultgel ..... t'l</nmlbilil)' of
proJUi:t ..... no of ~rrt>riJt DtIlICks On company. This
closed loop oontllms only lI.JTOWI with + signs. Simple
loop analy$is thus indicates thai the panicular mecha-
nism which it describes is ullSlllbJe. If il were not for
the controlling context of the rest of the system and
for compensating mlUlllgemenl action, this loop would
reHect the inc:reasi1Jl; tendency COf an existiDg lar&e1
to appear even mon: attractive 10 an aggressor. We
note that two of the atJQWS are controlled by both A
(the animal rights pressure group) and by S the
security function of the company, an obselVation
which merdy reflects the struggle for control of the
vulneQlb,lity of tbe: product and its tendeDC)' to be
 lB. ~ I.P.BnMqonJ f$«wilflotmw/ IOf/99Il! JjJ-/6IJ
--
.••'1."-
-;/
alladr.ed. In this respect the loop alIa.lym hu, appar·
ently, little to tell tk SOCIIrity function, mher than to
point up to ~nior management the importance of
weakening tbe lXmIledion between tk vulnerability
of the product and the actual attacks on the CQlIlpany.
<Jose eDIllination, however, shows that the role of S,
tbe $eCUrity fUIlC'lion is different .in the two arrows
(see Fig. 8).
In the connection 'allraetivencu of target'
..... ·vulnerability of product', the role of the security
function is to render the product lellS allractive as a
target. wllereas in the connection 'vulnerability of
product' ..... 'no (If terrQris! attacks', the r(lle (If the
SOCIIrit)' function is to protect a vulnerable target. The
paraUel can he drawn hetween camouflage as a means
of rendering it military target In!. observable, and
hen~ less liable to be allllCkcd and the protection of
that target in the eventuality that it is attacked. This
distinctioo may ~ll inform the management agenda
of the se.:urity function by defining more clearly iu
separate IVies and in tum constitute the basis for
specific proposals for appropriate fundina:.
T1te last element of the loop connectS'no of terror-
ilt attllCks' witb 'attractiveness (If target', an arrow
which is under the control of the pl'C'S5ure group (A)
and N>odCo's PR function. C. 'The role of the PR
function here is to protect where it can tbe image of
FoodCo as a soft or atlractive target. For example, C
may well promote the picture that the previous at·
tad(,\: on Food0.> have shown them lessons to which
they have reacted, and that there are undeclared but
nevertheless effective improvements to product !lafety
already in pLa~.
We _, then, by an anaIy$is of this simple loop that
while the sewnty function and the PR function of
FoodCo IJUI)' be geographically separated (one in ~.
fordshirc. the other in central lDmJon) they have an
intimate operational connection in terms of prevent·
ing the loop discussed here from becoming Ul\COn·
trolled. JlIlil as the 5«tJrity function will be highly
skilled ~t the OOIltlngellC)' planning foe, say, fire or
computer fr~ud, so it can mobilise the capabilities of
tlte PR ftmction of tlte CQlIlpany to contribute to the
contingency pllllllling for product safeI)' anach.
Moreover, when tbe conversation takes place between
the head of 5eCllrity and the bead of PR in the Laller's
London office, the diagram of FiB. 7 can proride an
accessible and visual ~ation of the need for the
two futlC1iom (unusually perhaps) to work together. A
jointly advocated action plan may emerge which seeks
to adapt corporate pol;ey to inject rC$l)urce5 intO the
PR function to mount a product safety awareneSi
campaign lIIllOfIpt iu clIlitomers in order to provide
an early_warning ltIe(:hanism.
4./.3. Coru:/usiQ,u qf ,mtJ/y5Is
Analysis similar to that of tile previotls section for
other loops led to a number of proposals foe action,
some of which had been dis<;u$sed previously and
some of which emerged anew from the analysis. 1be
-
following list provides a selection of tbose concIu·
(a) A dose connection is Il«USilry beIWCen the
lIC1Mtics and planning of the security function
and that of the PR function. In addition to
attenuating the $ClISitisation of pressure groups
to the allratliveness of Food0.>'s products. it was
also appropriate for the PR function to form
part of the eontingency plannins for a product
safety ana<:L
(b) C1o&e cooperation ill neeeS$3I}' betweeD the $e.
rurity functions of the industry as a whole, be-
cause of the effect on tbe atlractiveness of OIIC
company because of attacks on OIhen' products.
(e) "The elJectiveness of the .soecurity function is inti.
mately connected with the bllliiness success of
Food0.>, as evidenced by the mechanisms sym-
bolised in Fig. 7 and in OIlier loops. This pro-
vided good arguments for increases in the fund-
ing of tbe securil)' function Oil grounds of im-
proved business effectiveness as distinct from
merely repr«entittg an 'insurance' payment. The
security function was thus seen as a direct CQQ-
tributor 10 busffiess success ratbcr than as a
'IWO-legged overhead',
(d) Specific but subtle advice to customers regarding
wluit they should do if they Qllserved that product
seals _re oot intact was cousidered appropriate.
with the obvious proviso that such advice must
001 be seen to imply any actual threat.
(e) The loop 'time on media' to 'police engagement'
indieated that the .-:urity function's very posi-
live relations with the police authonties COIIld be
used to the advantage of FoodCo in the event of
 a produd safeI)' threat in order 10 provide ad-
vallC% warning and thereby increase the level of
police inte~t and engagement in the problem.
The FoodCo ease study reported above illustrates a
number of issues of praelice. First, the QSD method
can be secn to deliver results at any appropriate level
of modelling that the user ehoo::J!;cs and is able to
contribute to. The FoodCo model, for e.umpk, did
not _k 10 imlllene it:lelf in the demil of shipments
of goods. amountll sold and so fonh. Rather, it fo-
cused on the high level policy issll<'s and sougbt to
identify the interactions between the business dy-
namics of the client and the seeuril)' issues. These
eme~d naturally from tbe prCl<leSS of building the
influence diagram model. New variables and links are
added, and the$: initially reflect enning understand-
ing of the dynamics of the situation. In analysis.
howe---er, new loops, representing uru;een, or at lellSt
unelCpressed dynamics will then emerge, and tbe un·
derstanding of the client is thereby inereased. This
growth of undentanding appears wtJatever tbe level
of expertise of the client or the analyst. If tbe FoodCo
problem had been to identify more specifi<: policies, as
opposed to the general ones invited in the ltClUal case.
the model would have been more specific, would have
demanded more specifie knowledge to construct and
yet would have produced a new level of understanding
in a similar way.
Second. the model repre!ients a 'lingua franca' lIS
well Iili a sensemaking tool. Often The medium of the
model can allow, as in the case of the jointly-derived
security/PR agenda in the FoodCo example, a c0m-
monly understood fra"""......rk, if not for agreement,
then at least for oonstruetm dialogue. The abilil)' of
The models to represent conflicting views of the dy-
namics within a proceSll is particularly useful for group
work.. A particular trick that it is nC<:e$Sll1)' to point
out to new participants is that if two members of a
group oonstt\lCling a diagram are in disagreement, the
influence diagram approach allows the two conflicting
vkws to be represented in the diagram at the same
time. By delaying a decil;;on as to which of tb., \WQ
conflicting views is the more important. powerful or
amect, the rich_ of tltoe two viewpoints togethct
can be exploited withoot personal friction. Frequently
practice has shown that the two disagreeing members
win come to understand the opposing """chanisms
and accept that while the allernatm view may not be
the most powerful dynamic in their view. it is at Ieut
a recognisable part of a more complex system.
Third, the constnKtion and analysis is remarkably
quick to perform in pra~,icc. The FoodCo example
took approximately 3 half-days in total. The product is
often highly diroocd towards action and, moreover.
action which is aimed at the manipulatinn of a partie--
ular and commonly understood clement of the prOCC5ll
under scrutiny.
Constructing the influence diagrams is not difficult
and security professionals from a significant number
of organisatKms, intluding goycrnlll(:nt bodies and
private companies have u~d it s~lly on anum·
ber of casct<.
The QSD appToodl offers an intuitive analysis ap-
proach "'hich is accessible to security professional and
others. and which provides a ready means of address-
ing tIM: interactions bctweell the busillCSS process as a
whole and the security process specifically. To the
security manager aspiring to more general manage-
ment responsibility it offen., additionally, a means of
building on the product of general slrategic and busi-
ness process tools such as Value alain Analysis and
Industl)' Analysis (Minttbcrg et aI.• 1998). These tools,
while providing elCelient general understanding of
the global busine5S context and pro«ss, are often
insufficiently specific to provide a basis for practical
action plans and QSD can provide that link with
practice.
0>0d<W>d, P., 19t11. S~ems Thaw".. SysI<:'" 1'fllCli«:. J. wit<)'.
ChidlcOlcr.
CIIcdland, P, SdI<>Ic>. J, 1990, S<>tt Sysl<dlO Mc'ho><lolacY in
""'i<HI. J. wiley, ChidIeoIer.
Coyle. ll. t996. s,..c..... ~ Modclihc: ... 1'T...:tnI Ap-
ptOIclI. CIl.IIpnwo and HIlI, r - .
MinlZtcrc. H.. 1'Jlll,. The IUic and Foit ol SU•• cpe Pbnniol,.
Prcnria>HoII, Ne-' York, PI' )lH~.
MiIllZtclJ, n. Quirm, J.. Gb<.m.L S, t9lltl. The 51"",,&!, PtocaL
He_I HelftPll<al. !'fc-nrice flall.
Poner. M.. 19J'\l. ''-CornpcMiwl F _ Shopt Sr"'!qy. Han'ln!
awo- Itaoiocor, Mardo-Aprii.
o.m.., J.. IlltlO. Srr..... {.... 0-,.: '-"Iic>t t""'.""'rltal;"'"
llomcwood. tm...
Quinn, J, M~1f, 0 .. F........ D., tm. The kamin, ~i<>n.
Eur Ill........ 1.to. 1<I6-1511.
Ri>'ell. p" t'Jlll,. The cm'I eI DcciII<loI _Di",. J. "',.".. CbId>-
-,.
R...,.,l>cad, J.. 19I19. Ratior:Ial AIIal)W {(;If a !'n:Jl>tcawIliait W"dd.
J. Wiley. ClIichc<Icr.
WiIIoo, 8, t99fl. SyAcrna: Conccpu M<l~ and ~
lION, 2r>cI ed. J. Wiley. a...........