INGO ADVISORYIndependent Security Intelligence & Risk Analysis

Open resources · Professional development

Security Training Hub

Material for people who have to run security with limited time and no dedicated team: anonymised case studies from East Africa and the Horn, checklists that fit a briefing, and a training pack you can take offline.

Horn of Africa capability pack

Illustrative analytical example — demonstrates method, not operational guidance for a specific organisation. Everything here is open access and free to reuse with attribution. It is training material for professional development, not a substitute for your organisation's own security guidance.

Anonymised East Africa case studies

Each one follows a real method through a real problem, with organisations, places and dates removed. Use them as briefing material: read the situation, stop before the actions, and ask the team what they would do.

Case study

Case Study: Negotiating Access Along a Contested Somali Corridor

A checkpoint-by-checkpoint map, a single agreed script and one named negotiator per segment — how a stalled distribution route reopened without paying for passage.

Read the case study

Case study

Case Study: Rebuilding Journey Management on a High-Exposure Urban Route

Fifty movements a week, no written approval rule. The fix was three questions, a check-in window and a named person who could say no.

Read the case study

Case study

Case Study: Fixing the First Hour of Incident Response

The information existed; it just reached the wrong people in the wrong order. A one-page first-hour card and a single reporting line closed the gap.

Read the case study

Case study

Case Study: Partner Vetting That Survives an Audit

Proportionate due diligence on local partners — three tiers, documented reasoning, and a decision the organisation could defend two years later.

Read the case study

Case study

Case Study: Verifying Delivery Where Staff Cannot Travel

Third-party monitoring in an area international staff could not reach — sampling, unannounced visits, geotagged evidence and a rule against monitoring your own work.

Read the case study

Case study

Case Study: A Crisis Exercise That Found the Real Weaknesses

Three hours, one room, no scoring. The plan was fine — the phone tree, the delegation of authority and the family-liaison role were not.

Read the case study

Case study

Case Study: A Site Assessment That Cost Very Little to Act On

Most of the findings on a Horn of Africa compound review needed procedure and habit, not construction — and the cheapest fixes carried the most weight.

Read the case study

Case study

Case Study: Turning Early Warning Into a Decision Rather Than a Feeling

Eight named indicators, agreed thresholds and three pre-authorised responses — so a deteriorating environment triggered action instead of debate.

Read the case study

Field checklists

Short enough to use under pressure. Print them, put them in the vehicle, work through them out loud.

Before movement

Run through this before any road movement outside a familiar urban area.

  • Route assessed for this journey, not copied from the last one.
  • Departure time varied from the previous run on the same route.
  • Road status checked on the morning of travel with someone who uses it.
  • Fallback location named for each leg, and the driver knows it.
  • Abort criteria written down and held by the person in the vehicle.
  • Two independent means of communication carried and tested today.
  • Check-in schedule agreed, with a stated overdue time and a named escalation owner.
  • Medical plan for the route: nearest capability, who calls, what number.

Arrival at a new site

First hour on the ground at an office, guesthouse or partner compound.

  • Stand-off and approach observed: who can get how close, and how quickly.
  • Access control tested rather than described — walk to the gate and watch.
  • Safe room or protected space identified, and staff shown it.
  • Emergency exits usable, unlocked and unobstructed.
  • Guarding arrangement understood: who employs them, what they are instructed to do.
  • Neighbouring occupants noted, including any government or security presence.
  • Communications tested from inside the building, not the car park.
  • Local emergency numbers verified by calling them once.

Incident: the first hour

The sequence that matters most, and the order it should happen in.

  • Everyone holds at the nearest safe location — nobody moves towards the incident.
  • Account for people by name, not by vehicle. Write the count down and time it.
  • One person takes the decision-maker role and says so out loud.
  • Open a written log immediately; memory is not evidence.
  • Suspend movement across the location until the picture is clear.
  • Confirm the staff count twice before notifying anyone outside the team.
  • First notification states what is known, what is assessed, what is unknown.
  • Families notified only after accounting is confirmed, through one channel.

Checkpoint interaction

For staff and drivers, briefed together rather than separately.

  • Documentation current and carried, with copies held separately.
  • One person speaks; everyone else stays quiet and still.
  • No payments; the documented position is stated calmly and repeated.
  • No photographs, no filming, no visible note-taking.
  • If asked to divert, decline and turn back rather than follow.
  • Report every interaction afterwards, even the uneventful ones — the pattern is the value.

Structured learning route

The security cycle, session by session

  1. 01 Context analysis. Where are we working, with whom, and who holds influence? Output: Context statement, actor map, stakeholder and acceptance position.
  2. 02 Threat assessment. Who or what could cause harm, with what intent and capability? Output: Threat list with UK threat level and reasoning for each.
  3. 03 Risk assessment. How exposed and vulnerable are our people, assets and programmes? Output: Risk register with likelihood, impact and residual risk.
  4. 04 Mitigation. Which controls reduce likelihood or impact, and who owns them? Output: Control set, movement rules, thresholds, named risk owners.
  5. 05 Monitoring. What would tell us the environment is changing? Output: Indicator set with review triggers and reporting rhythm.
  6. 06 Incident management. What happens in the first hour, and who decides? Output: Escalation ladder, contact tree, decision log, action cards.
  7. 07 Review. What did the incident or trend teach us? Output: After-action review, corrected assumptions, revised controls.
  8. 08 Updated risk assessment. Does the register still reflect reality? Output: Reissued assessment with dated change history.

Early-warning indicators to practise on

  • Armed-group operational tempo. Attack frequency and ambition are the clearest signal of intent and freedom of movement.
  • Security-force deployments and withdrawals. Force posture changes create vacuums that armed groups and criminal actors move into.
  • Federal–state political tension. Political disputes translate quickly into contested security control and administrative obstruction.
  • Inter-clan and resource conflict. Land, water and revenue disputes are the most common cause of localised violence for field teams.
  • Corridor disruption and illegal taxation. Corridors are where most staff exposure and most supply risk actually sit.
  • Urban civil unrest. Unrest closes cities faster than any other event type and threatens staff commuting.

Access constraints to recognise

  • Checkpoints and informal taxation. Multiplying control points, inconsistent authority and payment pressure on transporters.
  • Road closure and route denial. Conflict activity, military operations or seasonal damage removing usable corridors.
  • Active conflict areas. Contested districts where presence is possible only through negotiated, time-bound arrangements.
  • Administrative restriction. Permits, travel authorisations, registration renewals and reporting demands used as gatekeeping.
  • Armed-group influence. Non-state control requiring acceptance work, principled negotiation and clear red lines.
  • Staff movement restriction. Curfews, escort requirements or nationality-based limits that reshape who can deliver.

Who this is for

Field staff and drivers

Movement, checkpoint and arrival checklists, briefed in the language people actually work in.

Country office managers

Case studies as briefing material, plus the security cycle as a management agenda.

Security focal points

Early-warning indicators and access constraints to structure weekly monitoring.

New security staff

The whole pack as a self-study route into how this work is done in practice.

Open resources Worked Somalia case study Risk register tool Security management cycle