Incident Management

Incident Management

Close protection operatives (CPOs) will, at some time, have to manage an incident of some description. 

Incident or dilemma?

The types of incident can vary and may not be a serious, just a problem or dilemma that the CPO needs to resolve. To clarify the differences between an incident and a dilemma:

An incident is a situation that requires immediate action.


A dilemma is a predicament causing a problem, which requires resolution.

CPOs should acknowledge that many incidents they encounter are not incidents at all but just problems to be overcome. 

For example, a Principal’s vehicle breaking down is not an incident but a problem that is quickly resolved. The standard operating procedures (SOPs) in place should offer the course of action to take should this problem occur on that particular assignment. 

However, a Principal involved in a road traffic collision (RTC) is an incident. This event is not only a threat of injury or life; it is an incident that may involve writing an incident report.

Are CPOs suited to dealing with incidents?

CPOs are required to have attributes such as being observant, meticulous, good communicators, problem solvers, quick thinking and calm under pressure. Such characteristics enable a CPO to manage an incident professionally and swiftly.

Personnel fulfilling a CPO role must understand the difference between an incident and what is merely a problem to be resolved. When dealing with dilemmas, the CPO is often a facilitator and not just a protector.

Types of incident

CPOs often find themselves as the first person to respond to an incident. A CPO, due to observations and planning, may foresee incidents. 

Some incidents are not foreseeable. Still, CPOs must be able to react swiftly and professionally.

Foreseeable or not, because by the nature of the role, especially when working in a small team or working alone, a CPO will often be the first person to react and attend the scene to assist.

Close protection operatives can and will encounter many incidents when working with Principals. Incidents that may arise during close protection operations include, but are not limited to:

  • Vehicle incidents;
  • Environmental conditions;
  • Conflict (dealing with conflict within the team, with the protected person and third parties);
  • Managing unexpected illness;
  • Attack on protected person (verbal and/or physical);
  • Loss of property;
  • Breach of security.

So, the CPO may need to react to life-threatening situations such as road traffic collisions (RTC), medical emergencies, fires, or criminal activity. However, non-life-threatening incidents are more common. Some incidents may not be directly related to the Principal. Still, a CPO may be expected to respond.

Responsibility for Incident Management

CPOs have a responsibility to preserve the life and safety of the Principal (and possibly their family), themselves and their teammates. Being able to take command of an incident is vital for ensuring the safety of the Principal. If a CPO is flapping or panicking during an event, the Principal and possibly the team will lose faith in the CPO’s ability to operate. 

Every assignment, no matter how small or brief, will have SOPs of some description in place. Even a solo CPO on a short assignment must have in mind a process or contingency plan of how they will react and deal with an incident should one occur.

For example, a lone CPO, or IBG (Individual Bodyguard) is inside a restaurant with their Principal, and there is a fire in the restaurant. The CPO should already know and have in their mind all of the following:

  • the nearest exit
  • a secondary exit if that is blocked
  • the location of firefighting equipment
  • the driver’s telephone number
  • the location of where the driver is parked
  • and the nearest accident and emergency department

Ultimately, CPOs are a living, breathing insurance policy. They are employed and paid to cover the ‘what if’ situations. When that situation happens, they should be able to react immediately. If a CPO does not have the answers, does not positively respond and has not planned accordingly, they have failed in their duties and will soon be looking for a new job.

Managing an incident

By using their skills and specialist traits, a CPO can evaluate as an incident unfolds and how to deal with the incident by following the pre-determined SOPs or emergency operating procedures (EOPs). 

Having assessed the situation, the CPO can evaluate options and formulate the response. The CPO should then communicate the steps to resolve the issue to the Principal, security team and perhaps external agencies, or remove the Principal from the incident.

For example, the CPO may follow a standard procedure such as:

  • Clear the area
  • Cordon the area off
  • Control the cordoned area
  • Confirm the incident is closed 

The CPO should be performing a dynamic threat and risk assessment, identifying new threats and changes to risk as they go.

Post-incident Management Process

Following an incident, having restored normality, a CPO may need to compile reports or liaise with third party agencies. The diligent CPO must also evaluate why the incident occurred. Should they have planned differently? Did they not cover or consider every ‘what if’ scenario? Identify shortcomings and learn. Adjust the SOPs, the team, or risk assessment accordingly.

Experienced practitioners despair at close protection operatives who do not carry a pen and note pad. These two simple items should be part of every CPO’s daily equipment. The information required following an incident will be vital. Just going from memory may not be accurate or sufficient. Taking notes at the earliest opportunity will enable a CPO to provide a more detailed account of an incident when requested to write an incident report.

Of course, with mobile devices, you can take notes, photos, and videos. But it is difficult to take notes on a mobile when the phone is being used to call for assistance or update the Principal’s office or the operations room about the incident! Remember batteries run out, especially during heavy use on assignments with long days. On this point, pens can also run out or leak on your shirt, jacket, or bag. Consider using or at least carrying a pencil as a failsafe.

Close Protection Services

Westminster Security provide close protection services in London, throughout the UK, Europe and Worldwide.


Westminster Security Ltd are not close protection training providers. Content provided is for informational purposes only. Please do not take this content as an operational guide. Some sensitive details have been omitted or changed for confidentiality and security reasons.