Royal Mail Internal Information
Criminal Investigation Team
4.2 Planned Operation Risk
Royal Mail
Assessments (PORA)
Version 1.0 Final
March 2011
Review Date: March 2012
Ray Pratt
Head of Investigations Policy & Standards
Royal Mail Security
Mobex ADDR I
Mobile : GRO
© Royal Mail 2011 — 4.2 Planned Operation Risk As
\ssessment (PORA)—RM V1.0 ~Page 1 of 2
POL00122561
POL00122561
POL00122561
POL00122561
Contents
Key Accountabilities
1. Introduction
2. Risk Related Intelligence Checks
3. Guidelines for Completing the Planned Operation Risk Assessment
Form GS099
4, Planned Operation Risk Assessment Review Form GS099A
5. Exceptions to Completing a GS099
6. Guide to High, Medium and Low Risk
Change Control
Glossary
an.
aa
NaA0©oON
© Royal Mail 2011 ~ 4.2 Planned Operation Risk Assessment (PORA) — RM V1.0 — Page 2 of 12,
Key Accountabilities
POL00122561
POL00122561
Who is
accountable?
What do I have to do?
When do I have to
do this?
How do I do this?
All members of
Royal Mail Security
Ensure you comply with
these procedures
Ongoing
As detailed within
these procedures
© Royal Mail 2011 ~ 4.2 Planned Operation Risk Assessment (PORA)- RM V1.0 — Page 3 of 12,
POL00122561
POL00122561
Planned Operation Risk Assessment
1. Introduction
14
1.2
1.3
1.4
1.5
24
2.2
The Health and Safety at Work Act 1974 states that employees have a responsibility to
ensure their own safety and that of anyone whom their work brings them into contact with.
Generic Safe Systems of Work (SSoW) exist for specific operational activities undertaken by
RM Security (Investigations) personnel and detail the mandatory controls and measures to
be used. However, due to the varying circumstances which apply, it is necessary for each
individual pre-planned operation to be risk assessed through the Planned Operation Risk
Assessment (PORA) process. The SSoW can be found on the Royal Mail Security
Sharepoint site under Criminal Investigations Procedures and Standards (P&S).
The PORA process is mandatory in any RM Security led operation which may involve a
planned or potential apprehension of a known suspect, interview under caution or premises
search on non- RMG Ltd premises. The Investigator In Charge (IIC) of an operation is
responsible for the risk assessment and should ensure that all reasonable enquiries and
checks to identify, assess and if necessary, mitigate the risks during investigation operations
are undertaken. Initially the risks are assessed by the correct completion of a PORA form
GS099. Following this, as the case unfolds, the IIC must ensure that any material changes
to the risks in the case are reassessed and communicated to the investigation team by the
correct completion of a PORA Review form GS099A. The form should also be completed if
there is a change to the “Operational Responsibilities” (Table 9 on the GS099), as this will
ensure that new members of the operational team are fully briefed in the case. A PORA is
required for each suspect involved in the operation, however one is not needed if only
searching or visiting RMG Ltd premises or accommodation occupied by a Post Office Ltd
(PO Ltd) Branch. However they are required for the private residential accommodation co-
located with a PO Ltd Branch and any other business address.
It is important to note that the formal pre-planned risk assessment by means of the
completion of the GS099 PORA form and if necessary the GSO99A PORA Review form
are not the only risk assessments undertaken in the case. All Investigators should
continually dynamically risk assess the operation as is it actually occurring, for
example, have observations prior to apprehension or information gained in interview
before a home search revealed anything which affects the risk score and as such
actions to mitigate the risks.
Remember the IIC can and should make a judgement to halt the operation if
circumstances dictate.
Risk Related Intelligence Checks
The IIC is expected to actively anticipate and manage the risks in each operation
undertaken. The risks to Health & Safety (H&S) in an operation have been categorised into
the following four areas;
2.1.1 The suspect (see paragraphs 3.5 to 3.8 below).
2.1.2 The address(es) to be visited (see paragraphs 3.9 to 3.12 below).
2.1.3 The geographical area(s) to be visited (see paragraph 3.13 to 3.16 below).
2.1.4 The Investigation activities (see 3.18. & 3.19 below).
In order to anticipate and manage the risks effectively Investigators should conduct any risk
related intelligence checks and/or enquiries that they feel are necessary as part of the PORA
process. The following checks are available and thought to be the most relevant to RM
Security cases;
2.2.1 Local Management check — to include the likely response to being apprehended. It
may also identify other information such as health issues, including suspected drug or
alcohol habits, or outside interests e.g. martial arts and domestic circumstances
which may impact on H&S.
2.3
3.1
3.2
3.3
3.4
3.5
3.6
POL00122561
POL00122561
2.2.2 PNC Individual checks — may identify “warning” indicators or previous convictions of
both suspects and others at the address. It may also identify other information which
impacts on H&S such as any history regarding the certification (or refusal) of firearms
or orders recalling persons to hospital.
2.2.3 Local Police Intelligence check — may identify risks regarding the suspect or other
incidents or persons at the address(es) and the geographical area(s) to be visited. It
may also identify other law enforcement interest.
2.2.4 Human Resource Service Centre (HRSC) check — may identify conduct, health and
domestic circumstances.
2.2.5 Full Equifax check — this check can be used to identify current occupants at an
address to be searched or visited. A “Full Investigation” Equifax check should be
undertaken.
2.2.6 PNC Vehicle check — this can reveal registered keepers of vehicles at a specific
address.
2.2.7 Benefits Agency or Local Authority check — may also identify occupants at
addresses to be visited.
2.2.8 SOCA Flagging Database check — again may identify other law enforcement
interest, which in itself may have H&S implications. This check should be reserved
for the cases where it is suspected that Investigators are dealing with serious or
organised crime.
2.2.9 Land Registry checks — these will identify the owner of property.
2.2.10 Company House check - this check may identify company officers who may be at
the location.
The question of what checks are necessary is a matter for the IIC; however every effort
should be made to conduct the checks detailed at 2.2.1 & 2.2.2 above in respect of the
suspect (and others known to be at the address) and 2.2.3 in respect of the suspect,
address(es) and geographic area(s) to be visited. Please note if it is not possible to conduct
a satisfactory Local Police Intelligence check, (this may be because the local Police will not
release any information), then the planned operation must be considered “High Risk” and
Police assistance must be sought. Further information on Risk Related Intelligence checks
including how they are conducted can be found in Appendix 1 to these Procedures &
Standards.
Guidelines for Completing the Planned Operation Risk Assessment Form
Gsog9g
Whilst much of the GS099 is self explanatory, the following points provide clarification.
Part 1 — Case Reference/Project Number and Suspected Offences
The Case Reference Number is the SIMS project number or the PO Ltd equivalent. The
“Suspected Offences” section should indicate the primary offence(s), for example ‘Theft from
the Post’ etc.
Part 2 — Suspect Details
This section is self-explanatory. If any of the required details are not known, this should be
indicated accordingly. Remember a separate GS099 is required for all suspects.
Part 3 — Risk Related Intelligence Checks Undertaken
Investigators should indicate with an X which risk related intelligence checks have been
conducted. Details of any information revealed should be recorded in the relevant risk
assessment table later in the document.
Part 4 — Risk Assessment on Suspect
Investigators should detail any information that they have on the suspect, which may have a
bearing on H&S. (When referring to the results of PNC individual check only, information
relevant to H&S should be included in the PORA form).
Once all the information has been obtained then the risk should be assessed and an “X”
placed in High, Medium or Low. Guidance on scoring the different level of risk can be found
in Section 6 below.
© Royal Mail 2011 ~ 4.2 Planned Operation Risk Assessment (PORA) — RM V1.0 — Page 5 of 12
POL00122561
POL00122561
3.7 Comment should then be made on the rationale for arriving at the assessment score and if it
is thought that further controls (in addition to the Controls & Measures detailed in the
Criminal Investigation SSoW) are appropriate to mitigate any risk, then they should be
detailed. Examples of such could include using additional resource at the approach stage or
having the suspect brought to them rather than approaching the suspect in the office
environment. Please note that under this section it is never appropriate to state
“nothing known” or words to that effect as in all cases something pertaining to the
suspect will always be known. It is this information that should be assessed to arrive at
a rationale for the risk score.
3.8 Part 5— Risk Assessment on Address(es) to be visited
Investigators should detail any information that they have on the addresses to be visited
which may have an impact on H&S. One of the main risks in this category will be from the
other occupants of such addresses, but it may also include such things as details of
dangerous animals.
3.9 Once all the information has been obtained then the risk should be assessed and an “xX”
placed in High, Medium or Low.
3.10 Again, comment should be made on the rationale for arriving at the assessment score and if
it is thought that further controls, (in addition to SSoW) are appropriate to mitigate any risk,
then they should be detailed. An example may be by requesting Police assistance if another
occupant at the address to be visited is known to be violent.
3.11 If more than one address is to be visited then two or more addresses can be included in
Table 5 as long as it is clear which information and risks relate to which address. Again it is
never appropriate to state on the form “nothing known”.
3.12 Part 6 — Risk Assessment on Geographic Area(s) to be visited
Again, Investigators should detail what is known about the area to be visited. This
information may well be known to Investigators with local knowledge but it is expected that
the most valuable source of information will be a check with the local Police. This check may
identify such things as street gang activity, high crime areas or community tensions.
3.13 Once all the information has been obtained then the risk should be assessed and an “X”
placed in High, Medium or Low.
3.14 As with the assessments above, comment should be made on the rationale for arriving at
the assessment score and if it is thought that further controls (in addition to SSoW) are
appropriate to mitigate any risk, then they should be detailed. An example may be the
decision that Investigators will only visit a high crime area during daylight hours.
3.15 If more than one geographical area is to be visited then all the details can be included in
Table 6, as long as it is clear which information and risk relate to which area.
3.16 Part 7 — Personal Protective Equipment
The IIC should state in this section whether, and if so what, Personal Protective Equipment is
to be worn during the planned operation and additionally provide an explanation for reaching
that decision.
3.17 Part 8 — Police Liaison Point
If appropriate, Investigators should brief the local Police of planned operations. In all
circumstances the PORA should include contact details of the local Police in order that
Police assistance can be summonsed quickly in the event that it is needed. Prior contact
may also avoid a “blue on blue” incident.
3.18 Part 9 — Risk Assessment on the Planned Investigation Act
This table is used to indicate what activities are planned or anticipated and to provide a risk
assessment of those activities. The table details;
3.18.1 The planned activities
3.18.2 The operational team contact details.
3.18.3 The operational responsibilities of the team members.
© Royal Mall 2011 ~ 4.2 Planned Operation Risk Assessment (PORA)— RM V1.0 — Page 6 of 12
POL00122561
POL00122561
3.18.4 The Mandatory Coded Warning; in all cases a specific phrase or other clear signal
must be designated to alert all persons in the operational team of an unforeseen risk
situation. This signals immediate withdrawal. The team must be able to leave
premises in an emergency by ensuring, if necessary they have control of the keys.
3.19 The table also includes a section for Investigators to complete if anything is known about the
investigation activities specific to the operation, which has a bearing on the risk in the case
and any controls put in place to mitigate the risk, over and above the controls in place in the
Criminal Investigation SSoW. This may include such things as health (for example physical
disabilities or pregnancy), skills or training issues impacting on an Investigator’s ability to
undertake specific tasks or issues like adverse weather conditions etc. Again the risk should
be assessed and an “X” placed in High, Medium or Low.
3.20 Part 10 — Investigator In Charge (IIC) Declaration
This table requires confirmation that the IIC has given full consideration to the Procedures &
Standards 4.1 Criminal Investigation Duties Safe Systems of Work (SSoW) relevant to this
operation.
3.21 The IIC must also confirm that all persons in the operational team have been briefed on;
3.21.1 The background and nature of the operation.
3.21.2 Their individual roles and responsibilities.
3.21.3 What risks have been considered.
3.21.4 What measures have, or are to be taken, to address/minimise risks.
3.22 Finally it is the responsibility of the IIC to ensure that a manager of the appropriate grade
(within the Business Unit concerned) is aware of the proposed action and the risks involved
and provides authority. The authority levels are as follows;
3.22.1 Where any risk area is evaluated as Low or Medium — Line Manager
3.22.2 Where any risk area is evaluated as High — Senior Manager (level 9 or above)
In addition in High Risk cases Police Assistance must be sought.
3.23 All persons in the operational team should be handed a copy of the PORA (and any relevant
reviews, see section 4 below) prior to the operation. These should be copy controlled and
recovered by the IIC on the conclusion of the operation.
Reviews of the Planned Operation Risk Assessment Form GS099A
4.1 Planned Operations may extend over periods of time. The GS099 PORA form represents a
risk assessment at the start of Planned Operations and as such it does not allow for
developments in the case, which may have a bearing on the level of assessed risk.
Examples of such things that are material and may increase the level of risk are;
4.1.1. A previously unknown address is identified which will require a search.
4.1.2 The suspect is observed meeting with unknown people on delivery in suspicious
circumstances.
4.1.3 Contrary to intelligence the suspect's demeanour is excitable and aggressive.
4.1.4 Observations reveal that the suspect may be abusing alcohol or drugs.
In addition a review should be undertaken if there is a change to Operational Responsibilities
as detailed in Table 9 of the GS099. This will ensure that Investigators new to the operation
are appropriately briefed on the “risk” issues associated with the case.
4.2 In such cases the Investigator should ensure that the risks are reassessed by the completion
of a GS099A PORA Review. Below is general guidance on completion of the form.
4.3 Part 1 - Case Reference/Project Number and Suspected Offences
Note should be made of the case reference number, the name (if known) of the suspect
offender, the suspected offence(s) investigated and detail the number of previous reviews
completed in the case.
(Investigators should submit reviews whenever there is a material change which may affect
the risk scoring in a case and as such it is anticipated in some cases there will be more than
one review.)
© Royal Mail 2011 ~ 4.2 Planned Operation Risk Assessment (PORA) — RM V1.0 — Page 7 of 12
4.4
4.5
4.6
4.7
4.8
5.2
5.3
POL00122561
POL00122561
Part 2 — Previous PORA Risk Scores
In this section the risk score of the most recent GS099 PORA or GSO99A PORA Review
form should be detailed on the new review.
Part 3 — Review of the PORA Risk Scores
Investigators should detail the material information or the change in “operational
responsibilities” which instigated the review and any change to the risk levels. In addition
they should consider if additional controls should be put in place to mitigate the risk, or if the
risk level is reducing, any controls which can be lapsed and detail these in the narrative box.
Part 4 - Investigator In Charge Declaration (IC)
This table requires confirmation that the IIC reviewing the operation has given full
consideration to the Procedures & Standards 4.1 Criminal Investigation Duties Safe Systems
of Work (SSoW). The IIC is then required to certify that all involved in the operation have
been fully briefed in accordance with the criteria on the form.
Finally the IIC is to confirm that they have discussed the case with a line manager. If any risk
is assessed as high risk then the case must be discussed with a Senior Investigation
Manager and Police assistance must be sought. The IIC must also confirm that authority to
proceed has been granted.
Any GSO99A Reviews should be associated with the original GS099 PORA documentation
in Appendix A.
Exceptions to Completing a GS099
It is only in circumstances when it is operationally impossible or impractical that an exception
to completing the GS099 process is allowed. Such a situation may be when observation is
being conducted in an area where the suspect was previously unknown, but is identified as a
result of the observation. It may be appropriate to apprehend this suspect without breaking
surveillance and as such it will be impractical to complete a GS099. (In such circumstances
Investigators must ensure that they have enough staff available to deal with a potential
apprehension. It will also be prudent to have the Police on standby). In the circumstances
where a previously unknown suspect is identified and there is a significant break in the
observation then the IIC must ensure that the GS099 form is completed.
In cases where it is impossible or impractical to complete a GS099 then the IIC investigators
should endeavour to seek the authority from a more senior person before action is taken.
Additionally, as a minimum, every effort should be made to carry out checks 1, 2 and 3 as
detailed at paragraph 4.2 above, remembering if it is not possible to complete a Local Police
Intelligence check on any of the suspects addresses then Police assistance should be
requested. In any event, Investigators must remember that they have a duty of care to
everyone involved in the investigation and must make every reasonable effort to establish
and manage the risks, including conducting ongoing dynamic risk assessments during the
operation.
Should it not be practicable for a PORA to be completed the IIC is required to make an entry
in their official notebook to demonstrate every reasonable effort was made to establish and
manage the risks. The notebook entry should cover;
5.3.1 Why it was not practicable to complete a PORA form.
5.3.2 The results of any intelligence checks carried out.
5.3.3 Any information known impacting on risk.
5.3.4 The name of the person contacted to authorise the activity, if appropriate.
5.3.5 The Mandatory Coded Warning to withdraw.
5.3.6 Confirmation that all persons in the operational team have been informed of the risks
and any controls and measures to be followed.
Guidance on High, Medium and Low Risk Scoring
© Royal Mail 2011 ~ 4.2 Planned Operation Risk Assessment (PORA) — RM V1.0 — Page 8 of 12
6.1
6.2
6.3
6.4
6.5
POL00122561
POL00122561
Investigators should note that in the risk assessment process, what is not known may
be as important, if not more so, than what is known. This issue therefore must be a
consideration during the risk assessment process. As such if Investigators are not
reasonably confident of what they are going to meet at the various stages of the planned
operation then escalation of the risk score may be appropriate.
Investigators should note that the following paragraphs detail when particular circumstances
may merit a high, medium or low scoring. The list is not prescriptive or exhaustive. Ultimately
the risk scoring of an operation will be the responsibility of the IIC taking into account all
circumstances relevant to the operation.
In the following circumstances it is thought that the planned operation should be scored as
High risk;
6.3.1 There is a knife or firearm threat from the suspect or any person with access to any
address to be visited.
6.3.2 Intelligence checks reveal warning indicators, previous convictions or cautions for
physical violence by the suspect or any person with access to any address to be
visited.
6.3.3 It is thought that firearms will be at any address to be visited.
6.3.4 It is thought that the suspect has attempted, or has self harmed in the past.
6.3.5 The geographic area to be visited has community tensions which put Investigator’s
personal safety in doubt.
6.3.6 Investigators are aware of any other circumstances that indicate violence could be
used against them.
6.3.7 The Police do not provide a satisfactory local intelligence check at suspect addresses
to be visited.
Where any risk is assessed as High a Senior Investigation Manager should be
consulted and the assistance of the Police sought before any investigation activities
which bring Investigators in to contact with the suspect are commenced.
In the following circumstances it is thought that the planned operation may be scored as a
Medium risk;
6.4.1 There is intelligence that the suspect or any person with access to any address to be
visited is hostile or aggressive, but have not resorted to physical violence in the past.
6.4.2 The suspect or any person with access to any address to be visited has convictions
or cautions for disorderly behaviour.
6.4.3 The suspect or any person with access to any address to be visited has convictions
or cautions for drug offences.
6.4.4 The suspect or any person at any address to be visited is thought to abuse alcohol.
6.4.5 The suspect or any person at any address to be visited has an interest or hobby in
martial arts, boxing or such like sports or pursuits.
6.4.6 It has not been practical to conduct a local manager check on a member of staff.
6.4.7 It is thought that the suspect has suffered from mental illness or depression in the
past.
6.4.8 It is thought that the suspect or any person at any address to be visited has a
contagious disease.
6.4.9 It is thought that dangerous pets will be present at any address to be visited.
If all the Risk Related Intelligence Checks and any other enquiries fail to identify any specific
risks then the planned operation may be scored as Low risk.
Where the Planned Operation is assessed as Low or Medium risk line manager’s authority
must be obtained before any investigation activities which bring Investigators into
contact with the suspect are commenced.
© Royal Mall 2011 ~ 4.2 Planned Operation Risk Assessment (PORA)— RM V1.0 — Page 9 of 12
Change Control
POL00122561
POL00122561
Status
Final
Version
1.0
Owner
Ray Pratt
Authors
Michael F Matthews
Release Date
March 2011
Document Privacy
Internal
Authorisation
Title Name
Signature Date
Security Ray Pratt
March 2011
Distribution List
Name
Version Date
All Royal Mail Security via Security
Sharepoint
v1 March 2011
Documentation History
Issue V1
Status Final
Release Date Mar 2011
Effective From Mar 20114
Document Change History
Issue / Version
Summary of Change
V1
Document Produced
Glossary
Abbreviation or Term
Meaning
RM
Royal Mail
POL00122561
POL00122561
SSoW Safe Systems of Work
Ic Investigator in Charge
H&S Health and Safety
Document Summary
If you have any queries please contact:
Mick F Matthews
Procedures & Standards Manager
Royal Mail Security
6A Eccleston Street
LONDON
SW1W 9LT
Postline:
STD:
E mail
© Royal Mail 2011 ~ 4.2 Planned Operation Risk Assessment (PORA)— RM V1.0 ~ Page 11 of 12