When our team is conducting Security Assessments or Threat and Risk Assessments, we always ask, “what are your most important assets”, almost without exception the response is “our people”. However, when we begin to discuss the issue of “duty or care” clients often refer to their safety programs and are not linking duty of care to their security programs. We take that opportunity to educate them on how the legislative requirements of “duty of care” always significantly impact workplace physical security programs. This article primarily refers to the Canada Labour Code (which impacts federally regulated workplaces) and the common law implications within Ontario, however it is important to note that similar requirements exist in all Canadian jurisdictions.
The concept of an employer’s “duty of care” in relation to workplace physical security has become increasingly important as organizations confront risks ranging from workplace violence and harassment to unauthorized access, threats, robbery, domestic violence and other circumstances capable of causing physical injury to employees. Physical security therefore cannot necessarily be treated as a matter separate from occupational health and safety. Where a security threat creates a foreseeable risk of physical injury, the employer’s occupational health and safety obligations likely require the employer to take preventive and protective measures.
Understanding the Duty of Care
The duty of care under occupational health and safety legislation is fundamentally preventive. It is not limited to responding after an employee has been injured. Employers are generally expected to take reasonable steps to identify hazards before they result in injury.
For example, Ontario’s Occupational Health and Safety Act (“OHSA”) establishes general employer duties and expressly extends those duties to workplace violence. Ontario employers must also maintain a workplace-violence policy and program, conduct risk assessments and implement measures to control risks identified through those assessments. The legislation further requires an employer to take every precaution reasonable in the circumstances where the employer becomes aware, or ought reasonably to be aware, that domestic violence may occur in the workplace and may expose a worker to physical injury.
Section 124 of the Canada Labour Code provides the starting point for federally regulated entities: “Every employer shall ensure that the health and safety at work of every person employed by the employer is protected
The result is an important practical principle: the absence of an actual physical-security incident does not necessarily mean that an employer has satisfied its duty. The legal obligation can arise from a foreseeable risk.
It is important to note that the concept of Duty of Care does not stop at the physical confines of a facility, it extends to any work related sites which also includes business related travel.
Physical Security as an Occupational Health and Safety Issue
Historically, physical security was sometimes regarded primarily as a property protection or asset protection function. Modern occupational health and safety legislation increasingly requires organizations to consider the effect of security risks on workers. These risks can include:
- unauthorized persons entering a workplace;
- threats or acts of violence against employees;
- robbery or attempted robbery;
- aggressive customers, patients, clients or members of the public;
- employees working alone or in isolated locations;
- inadequate access-control systems;
- inadequate lighting or visibility;
- uncontrolled access to restricted areas;
- threats arising from former employees;
- domestic violence that may enter the workplace;
- inadequate procedures for summoning emergency assistance; and
- security deficiencies identified through previous incidents or near misses.
The relevant question is not necessarily whether an organization has employed professional security personnel or installed security mitigation measures (such as CCTV). Rather, the question is whether the employer has taken reasonable steps to identify and control foreseeable risks within the workplace. This distinction is significant. A workplace can potentially have a sophisticated security system and still fail to address an obvious hazard.
Foreseeability and Risk Assessment
Foreseeability is particularly important when determining the scope of an employer’s physical security obligations. An employer will generally be in a stronger position to demonstrate compliance where it can show that it has systematically assessed security related hazards and implemented controls proportionate to those hazards. What this means in real terms is that a risk assessment should be a living process rather than a one-time exercise. Changes in staffing, operating hours, location, clientele, neighbourhood conditions, building configuration, technology or the nature of the work may alter the security risk.
What Reasonable Security Measures May Look Like
Federl and Provincial/Territorial legislation generally does not require every employer to implement the same security infrastructure. The appropriate controls depend on the identified risk. Depending on the circumstances, reasonable measures may include:
Access Control: Organizations may need mechanisms to control access to workplaces, restricted areas, employee only spaces and sensitive facilities. Depending on the risk, this could involve locks, access cards, visitor-management procedures, reception controls or other access-control measures.
Physical Barriers: Doors, partitions, protective barriers, controlled entrances, secure reception areas and other physical measures can help separate employees from members of the public where there is an identified risk of violence.
Surveillance: Video surveillance may be appropriate where it is reasonably connected to an identified security hazard. Surveillance should, however, be implemented consistently with applicable privacy requirements and workplace policies.
Emergency Communication: Workers must have an effective means of obtaining assistance where there is a foreseeable risk of violence or other physical danger. Depending on the workplace, this could involve panic buttons, radios, telephones, personal emergency devices or established emergency-call procedures.
Lighting and Visibility: Poor lighting, concealed areas and obstructed sightlines can increase security risks. Where these conditions contribute to an identified hazard, employers may need to address them as part of the overall control strategy.
Staffing and Supervision: Security is not exclusively a technological issue. Staffing levels, supervisory arrangements, procedures for opening and closing premises, lone-worker protocols and the positioning of employees can all affect physical safety.
Working Alone and Isolated Work
Employees who work alone or in isolation may face elevated physical-security risks because immediate assistance may not be available following an incident. For that reason, lone worker situations warrant specific attention in a physical-security risk assessment. The employer should consider:
- the location of the work;
- the hours during which it occurs;
- the nature of contact with the public;
- known violence or crime risks;
- access to emergency communications;
- procedures for checking on the worker;
- procedures for summoning assistance; and
- circumstances under which lone work should not be permitted.
The above criteria will also impact business related travel, including to events such as conferences.
Workplace Violence and Third-Party Threats
A significant feature of modern occupational health and safety legislation is that the source of the threat does not necessarily have to be another employee. Customers, patients, clients, contractors, visitors, members of the public and other third parties may create workplace-violence risks. This is particularly relevant to organizations operating public facing facilities. A physical security program that focuses exclusively on employee misconduct may fail to address a substantial category of foreseeable workplace hazards.
Ontario’s legislation, for example, requires employers to address workplace violence through policies, programs, risk assessments, reporting procedures and measures designed to control identified risks. It also recognizes circumstances in which a worker may encounter a person with a history of violent behaviour in the course of work.
Training and Emergency Response
Physical security controls are only effective if workers understand how to use them. Employers should therefore consider training in areas such as:
- recognizing potential security threats;
- workplace violence prevention;
- de-escalation and emergency response;
- use of communication and emergency equipment;
- access control procedures;
- reporting security incidents and near misses;
- emergency evacuation or shelter procedures;
- procedures for dealing with threatening visitors; and
- procedures for obtaining immediate assistance.
Training therefore forms part of the employer’s overall control system rather than being an optional supplement to physical security measures.
Incident Response and Continuous Improvement
The employer’s responsibility does not necessarily end once a security incident has occurred. A serious incident, threat or near miss may provide evidence that an existing control was inadequate or that the underlying risk assessment needs to be reconsidered. Employers should have procedures for:
- obtaining immediate assistance;
- protecting workers from further harm;
- contacting emergency services where appropriate;
- reporting the incident internally;
- preserving relevant evidence;
- investigating the circumstances;
- identifying deficiencies in existing controls;
- implementing corrective measures; and
- reassessing the underlying hazard.
Documentation as Evidence of Due Diligence
One of the most important practical aspects of an employer’s duty of care is the ability to demonstrate what it did. Organizations should maintain appropriate records concerning:
- security and workplace violence risk assessments;
- policies and procedures;
- employee training;
- inspections;
- security incidents and near misses;
- corrective actions;
- maintenance of security equipment;
- emergency exercises;
- consultations with health and safety committees or representatives; and
- periodic reviews of security controls.
Documentation does not, by itself, establish compliance. However, it can demonstrate that the organization had an established process for identifying hazards, evaluating risks, implementing controls and responding to deficiencies.
The potential ramifications from not following the proper Duty of Care requirements do not just impact the individuals involved, or the organization’s reputation, there are also potential “institutional liability” issues that may result in lawsuits or even criminal charges.
Conclusion
Across Federal/Provincial/Territorial jurisdictions, the precise statutory language differs, but several recurring principles can be identified:
- employers must identify reasonably foreseeable workplace hazards;
- physical violence and security threats can constitute occupational health and safety hazards;
- employers must implement controls appropriate to the risks identified;
- workers must receive appropriate information, instruction and training;
- workplace violence and security programs must be reviewed when circumstances change;
- employers may have obligations arising from threats originating outside the workplace, including domestic violence;
- incident investigation and corrective action form part of the employer’s preventive responsibilities; and
- the adequacy of physical security measures must be assessed in the context of the particular workplace and the risks that workers actually face.
Ultimately, the duty of care is best understood not as a requirement to guarantee that no security incident will ever occur, but as an obligation to take appropriate, legally required and reasonably practicable measures to identify and control foreseeable risks.
For employers, the central question should therefore be: If a foreseeable physical security hazard exists, can the organization demonstrate that it identified the hazard, assessed the risk, implemented appropriate controls, trained its workers, monitored the effectiveness of those controls and acted when circumstances changed?
