Worked case study · Somalia

Journey risk, incident response and duty of care for an NGO in Somalia

One task, followed from the journey plan through an incident to the duty-of-care obligations behind it — the way a security manager would actually document it.

Horn Relief Initiative (HRI) is a fictional organisation, and the staff, dates and events in this case study are invented so the method can be shown in full. The context, risks and controls reflect established practice and publicly reported conditions in Somalia. Nothing here is advice for a specific organisation.

Client profile (fictional)

Horn Relief Initiative (HRI)

A fictional medium-sized international NGO with a country office in Mogadishu and a field office in Baidoa.
Around 40 national staff and 4 international staff, delivering nutrition and water programmes through two local partners.
Unarmed, civilian posture. No guarding contract beyond static site guards; no armed escorts; no evacuation contract of its own.
One country director, one security focal point at 50% time, and no dedicated security manager — the position this case study is written for.

Journey risk assessment

Move two national staff and one international programme adviser from Mogadishu to Baidoa for a four-day partner review, returning by air.

Movement decision. Air movement outbound and inbound. Overland travel on the corridor was assessed and not approved for this task: the purpose was a partner review with no time-critical dependency, so the corridor exposure could not be justified.

Leg	Principal risk	Controls applied
Residence to Aden Adde International Airport	Proximity and IED exposure on the airport road	Departure window varied from the previous rotation; route confirmed on the morning of travel; two vehicles, no branding, doors locked, windows up; abort to a named fallback compound if the road is closed.
Mogadishu to Baidoa by air	Schedule disruption leaving staff overnight unplanned	Only same-day onward movement approved; contingency accommodation identified in Baidoa before departure; no arrival after last light.
Baidoa airstrip to field office	Short-notice incident on the airstrip road; unfamiliar drivers	Field office driver assessed and named in the plan; movement in daylight only; radio and phone check on departure and arrival.
In-town movement, Baidoa	Crowd or security incident near settlement sites	Site visits limited to two per day; no visits during distributions; agreed abort criteria with the partner; no armed presence at any site.

Journey risk register

Ref	Risk	L	I	Rating	Mitigation
JR-01	IED or small-arms incident during airport transfer	3	5	SEVERE	Timing and routing varied; morning route check; abort authority with the vehicle commander.
JR-02	Flight cancellation stranding staff overnight	4	2	MODERATE	Contingency accommodation confirmed in advance; no unplanned overnight in transit.
JR-03	Incident at a settlement site during a visit	3	3	MODERATE	Visit outside distribution hours; separate entry and exit; abort criteria agreed with partner staff.
JR-04	Medical emergency in Baidoa	2	4	MODERATE	Local capability mapped; referral and air-transfer arrangement documented and tested by phone before travel.
JR-05	Communications loss between legs	3	3	MODERATE	Two independent means carried; check-in schedule with a stated overdue time and escalation owner.

Approval chain

Step 1
Journey plan submitted 48 hours before movement by the requesting manager.
Step 2
Reviewed by the security focal point against the corridor and city assessments.
Step 3
Approved by the country director, who records acceptance of the residual risk in writing.
Step 4
Overdue time, escalation owner and abort criteria stated on the plan itself, not held separately.

Incident response

On day two, an explosion is reported near a government building roughly 400 metres from the route the team was due to travel. One vehicle is on the road; the other is at the field office. Phone networks are congested.

The first hour

0–5 min
Vehicle commander reports position and status on the second means of communication; both vehicles hold at the nearest safe location rather than driving towards or past the site.
5–15 min
Security focal point accounts for every person on the movement plan by name, not by vehicle. The count is written down and timed.
15–30 min
Country director opens the incident log and takes the decision-maker role. Movement is suspended across the location. Nobody is sent to look.
30–45 min
Partner staff and the field office are contacted for local information. Nothing is passed to headquarters until the staff count is confirmed twice.
45–60 min
First written notification to headquarters: what is known, what is assessed, what is not yet known, and what has been decided. No casualty speculation.

Decisions taken, and why

Hold or move: hold until the road is confirmed, because the team had no time-critical dependency.
Suspend or continue programme activity: suspend site visits for 24 hours; partner delivery continues where the partner assesses it as safe.
Withdraw or remain: remain in Baidoa. Withdrawal would have required road movement, adding exposure to reduce a risk that had not affected the team.
Notify: staff families notified only after accounting is confirmed and only through the agreed single channel.

What changed afterwards

Incident written up within 24 hours using the standard fields, with the timeline as recorded, not as remembered.
Two control failures identified honestly: the check-in schedule was too infrequent for urban movement, and the second communications means had not been tested that morning.
Both changes made to the movement procedure within a week, with an owner and a date, and evidenced at the next management review.

Duty-of-care plan

Duty of care is not a document; it is a set of obligations someone is named against. This is how they would be recorded for Horn Relief Initiative (HRI).

Before deployment

Pre-deployment briefing covering the country and city assessments, not a generic package.
Medical and dietary information held, with consent, by one named person.
Proof-of-life questions and next-of-kin details recorded and stored securely.
Personal security training appropriate to the environment, refreshed rather than one-off.

In country

Written movement rules, curfew and approved locations, briefed on arrival.
Check-in schedule with a stated overdue time and a named escalation owner.
Residence and office security standards surveyed and recorded, with defects tracked to closure.
Access to a functioning way to raise a concern without going through the person it concerns.

Incident and aftermath

Crisis-management plan with named roles rehearsed at least annually.
Medical referral and transfer arrangement documented with a named provider and tested.
Psychological support available after an incident, and offered rather than waited for.
Family liaison through one channel, with one person accountable for it.

Governance

Residual risk accepted in writing by the country director, and reviewed quarterly.
Security incidents and near misses reported into one register, including the ones nobody wants to write up.
Partner staff covered by the duty-of-care conversation, not treated as outside it.
Annual review of whether presence remains justifiable against the risk accepted.

Security manager profile Somalia risk assessments Journey and corridor risk Security briefings