Chemicals of security concern awareness course
Authored: December 2013
Table of Contents
Course Overview ............................................................................................................................... 1
Introduction ...................................................................................................................................... 1
Frequently asked questions ............................................................................................................. 1
Course learning outcomes ............................................................................................................... 2
Module One: the importance of the Code ....................................................................................... 3
Background ...................................................................................................................................... 3
What is the Code? ........................................................................................................................... 4
The threat of terrorism ..................................................................................................................... 4
Chemicals and homemade explosives (HME) ................................................................................. 6
Terrorism and homemade explosives (HME) .................................................................................. 7
Applying the Code............................................................................................................................ 7
Security risk management ............................................................................................................... 9
Reporting and the National Security Hotline .................................................................................. 10
Resources, advice and guidance ................................................................................................... 11
Key concepts summary.................................................................................................................. 13
Brain teasers .................................................................................................................................. 14
Module Two – applying the Code to business owners, managers and professionals ............ 16
Overview ........................................................................................................................................ 16
Building a security culture .............................................................................................................. 17
Security risk management ............................................................................................................. 18
Assessing risks .............................................................................................................................. 19
Treating risks ................................................................................................................................. 20
Security measures ......................................................................................................................... 20
Reporting ....................................................................................................................................... 29
Supporting your staff ...................................................................................................................... 30
Key concepts summary.................................................................................................................. 31
Case study ..................................................................................................................................... 32
Brain teasers .................................................................................................................................. 33
Module Three – applying the Code to frontline staff ................................................................... 35
Overview ........................................................................................................................................ 35
Revising the threat ......................................................................................................................... 35
Being security aware...................................................................................................................... 36
Security measures ......................................................................................................................... 38
The retail environment ................................................................................................................... 39
Case study: Hardware & Paint Pty Ltd .......................................................................................... 40
Point-of-sale procedures ................................................................................................................ 41
Case study: Ellie and the customer ............................................................................................... 42
Chemicals of security concern awareness course
i
Suspicious behaviours ................................................................................................................... 43
Reporting ....................................................................................................................................... 44
Difficult customers.......................................................................................................................... 45
Key concepts summary.................................................................................................................. 45
Case study ..................................................................................................................................... 46
Brain teasers .................................................................................................................................. 47
Module Four – applying the Code to the transport industry ...................................................... 49
Overview ........................................................................................................................................ 49
Revising the threat ......................................................................................................................... 49
Being security aware...................................................................................................................... 50
Security at the depot, yard and loading dock ................................................................................ 51
Delivering and transporting chemicals ........................................................................................... 52
Security en route ............................................................................................................................ 54
Suspicious behaviours ................................................................................................................... 55
Reporting ....................................................................................................................................... 56
Key concepts summary.................................................................................................................. 56
Case study ..................................................................................................................................... 57
Brain teasers .................................................................................................................................. 58
Module Five – applying the Code to laboratories in universities, health and industry ........... 60
Overview ........................................................................................................................................ 60
Revising the threat ......................................................................................................................... 60
Being security aware...................................................................................................................... 61
Physical access, personnel access and inventory controls ........................................................... 62
Security measures for your environment ....................................................................................... 63
The University of XYZ .................................................................................................................... 64
Your role ........................................................................................................................................ 65
Suspicious behaviours ................................................................................................................... 65
Reporting ....................................................................................................................................... 67
Key concepts summary.................................................................................................................. 68
Case study ..................................................................................................................................... 68
Brain teasers .................................................................................................................................. 69
Chemicals of security concern awareness course
ii
Course Overview
Contents
Introduction
Frequently asked questions
Course learning outcomes
Introduction
This course has been developed by the Australian Attorney-General's Department in consultation
with state and territory governments and industry. It is designed for frontline staff to raise
awareness of the National Code of Practice for Chemicals of Security Concern (the Code), and how to
apply it.
The Code provides guidance to sectors that work with one or more of the 11 high-risk chemicals that
could be used to make homemade bombs. It sets out a process to help Australian businesses take
practical steps to prevent chemicals being misused by terrorists to make explosive devices.
The information within this course aims to provide participants, including business owners,
managers and frontline staff, with an understanding of the serious and real threat of diverted
chemicals. It addresses key concepts, including:
 the importance of the Code
 the national security threat posed by misappropriated chemicals
 the implications for businesses, and
 how to reduce chemical security-related risks.
The course will also explore practical security measures, how to implement them, and help build
your understanding of your role and responsibilities in keeping chemicals out of the wrong hands.
The course is structured around a series of interconnected modules, which build on core concepts
and key learning points. This structure provides a flexible approach to completing the training. The
frequently asked questions (FAQ) section below is designed to help you determine the most
appropriate modules for your particular work context, and also provides more detail about the
course.
Frequently asked questions
This section answers some commonly asked questions about the course.
How is the course structured?
Each module presents key information about specific topics and concludes with a summary of the
key concepts covered within that module. Each module also includes a short quiz to test your
knowledge of the subject.
Chemicals of security concern awareness course
Course overview
1
Which modules do I need to do?
Module one contains essential background information, and should be completed by everyone
before proceeding to other modules.
The list below outlines which modules are recommended for specific groups:

business owners, retail managers and front line retail supervisors should complete
modules one, two and three

frontline retail staff should complete modules one and three

transport business owners and supervisors should complete modules one, two, and four

frontline transport staff should complete modules one and four

staff working in laboratories should complete modules one and five, and

laboratory managers and front line supervisors should complete modules one, two
and five.
How long does it take to complete each module?
Each module should take between 15 to 20 minutes to complete.
Is there a test?
At the conclusion of each module there are some simple multiple choice questions designed to
check your knowledge, including how you would apply your learning to a ‘real world’ example or
case study. These 'brain teasers' are not tests and are not scored.
How can I provide feedback?
You can provide feedback about the course by using the feedback email hyperlink within the
resources and guidance section in module one. Your feedback is welcome, and will help to
continuously improve the course.
Where can I get more information?
The chemicals of security concern website provides information about a range of chemical security
matters, including training resources and guidance.
Course learning outcomes
By the end of the course, you will be able to:
 recognise the importance and application of the Code
 define the roles and responsibilities of business in applying the Code
 identify tools and processes for effectively managing risk
 facilitate security awareness within the business context
 identify the responsibilities of front-line staff in applying the Code, and
 identify where to access resources and avenues for support, guidance and advice.
Chemicals of security concern awareness course
Course overview
2
Module One: the importance of the Code
Contents
Background
What is the Code?
The threat of terrorism
Chemicals and homemade explosives (HME)
Terrorism and homemade explosives (HME)
Applying the Code
Security risk management
Reporting and the National Security Hotline
Resources, advice and guidance
Key concepts summary
Brain teasers
Background
Following extensive consultation, the Australian Government, together with state and territory
governments, business and industry peak bodies developed the National Code of Practice for
Chemicals of Security Concern (the Code). It was publicly released in 2013.
The Code provides guidance to sectors that work with one or more of the 11 high-risk
chemicals. It encourages organisations to consider their own risks from a national security
perspective, and to take steps to reduce those risks.
Based on good business practice, the Code is considered a best practice guide to practical
measures that businesses can take regarding chemical security risk management. Adopting the
Code is voluntary.
More information about the Code is available on the chemicals of security concern website at
www.chemical security.gov.au.
The key objectives of the Code are to promote effective chemical security practices throughout
the chemical supply chain, with a focus on the following three areas:
 protecting against the diversion of chemicals for terrorist or criminal purposes
 encouraging cooperation between businesses and organisations that handle chemicals
and law enforcement agencies, and
 educating and training staff to be alert to the warning signs of suspicious behaviour and
to report all incidents.
Chemicals of security concern awareness course
Module one
3
What is the Code?
Keeping chemicals of security concern out of the wrong hands is paramount. Everyone involved
in the sale, storage, transport and supply of chemicals has a role to play in keeping Australia
safe.
The Code plays an important role in how Australian governments and industry address national
security risks associated with chemicals. Designed to help prevent chemicals from falling into
the wrong hands, the Code provides guidance on how to enhance measures that industry has in
place to prevent, detect and deter terrorist use of chemicals.
This module examines how to apply the Code to your environment, and the threat that diverted
or stolen chemicals pose to Australia. It also introduces the National Security Hotline and
provides a range of additional information sources.
The threat of terrorism
Many chemicals we use every day have been used in terrorist attacks such as those in Bali,
London and Mumbai. These have resulted in fatalities, injuries and property damage.
One of the key responsibilities of Australian governments is to provide a safe and secure
Australia. This includes protecting Australians from overseas and home-grown terrorism.
Every day, a large number of Australians legitimately access and use industrial, agricultural and
veterinary and household chemicals. However, a small percentage of these chemicals have been
diverted for unlawful purposes, including terrorist-related activities.
The Code defines 96 chemicals of security concern, which are potentially dangerous in the
wrong hands. The list of 96 chemicals of security concern can be found here.
Chemicals of security concern awareness course
Module one
4
Of the 96 chemicals identified, 11 are considered particularly high risk because they can be used
by terrorists to make homemade explosives or toxic weapons.
The 11 high-risk chemicals are listed in the table below:
Chemical
Ammonium perchlorate
Hydrogen peroxide
Nitric acid
Nitromethane
Potassium chlorate
Potassium nitrate
Potassium perchlorate
Sodium azide
Sodium chlorate
Sodium nitrate
Sodium perchlorate
As the threat of terrorism continues, it is increasingly important that all people working in the
manufacture, import, storage, transport, sale and use of chemicals be alert to chemical security.
Chemical security across the supply chain can be improved by ensuring all people who work
with chemicals understand their responsibilities, commit to identifying potential risks and put
security measures in place.
Chemicals of security concern awareness course
Module one
5
Chemicals and homemade explosives (HME)
This section examines the chemicals of security concern in more detail, and explores some
common myths about chemicals and the threat of HME.
The table below lists the common, legitimate uses of the 11 high-risk chemicals.
Chemical
Typical uses in Australia
Ammonium perchlorate
Fireworks and explosives, rocketry, laboratory and diagnostic
reagent
Hydrogen peroxide
Paper and pulp bleaching, laundry, food and beverage,
cleaning, hair and beauty, mining, pool and spa,
pharmaceuticals, water treatment, cleaning
Nitric acid
Mining, cleaning, metal processing and treatment, chemical
processing and supply
Nitromethane
Pharmaceuticals, analytical laboratories, racing fuel in high
performance racing, hobby shops, and as a fuel component in
radio-controlled models
Potassium chlorate
Fireworks and explosives, laboratory and diagnostic reagent
Potassium nitrate
Fertilisers, fireworks and rocketry, food preservation
Potassium perchlorate
Fireworks and explosives, smelting, a laboratory and diagnostic
reagent
Sodium azide
Smelting, a biocide in hospitals and laboratories, dairy farming,
printer cartridges and airbags
Sodium chlorate
Mining, metal treatment, paper production, food chemical,
laboratory and diagnostic reagent
Sodium nitrate
Fertilisers, fireworks, food preservative, rocket propellant
Sodium perchlorate
Mining, smelting, laboratory and diagnostic reagent
People who work in pool supply, hardware or hairdressing businesses will likely recognise some
of these chemicals within their own stock. These 'common' chemicals may be accessed from a
wide range of sources for legitimate and everyday uses.
Chemicals of security concern awareness course
Module one
6
Terrorism and homemade explosives (HME)
Contrary to popular belief, large quantities of chemicals are not required to manufacture HME.
Overseas HME incidents demonstrate that relatively small quantities of chemicals can produce
devastating results. Well-known examples of this include the explosive devices used in the
2005 London bombings and the 2013 Boston Marathon bombings.
Closer to home, the 2005 Bali bombings also demonstrate the terrible impact of HME. The
improvised explosive devices used in this case were not large in size, but caused catastrophic
damage and loss of life. In addition, many of the chemicals used were 'common', which presents
additional risk factors.
It is well documented that the internet provides access to information about how to use
chemicals to make explosives at home. While it is extremely hard to restrict access to online
information, Australia can make it harder for terrorists to access the chemicals required to
manufacture HME. Limiting online access to chemicals is a key factor in reducing HME
production, and the threat it poses.
The information below lists some recent attempted HME attacks on Australians:
2008 - Abdul Nacer Benbrika and others
Benbrika was convicted in 2008 on the charge of intentionally being the leader and a member of
a terrorist organisation. During the trial, jurors heard recordings of Benbrika discussing the use
of explosives, including whether he could obtain 500kg of ammonium nitrate.
2006 - Faheem Khalid Lodhi
Lodhi was convicted of terrorism offences in 2006. The court found evidence to suggest he had
planned to bomb the national electricity grid.
A large amount of incriminating material was found in Lodhi’s possession, including a
handwritten terrorism manual for the manufacture of homemade poisons and explosives. Lodhi
provided a false name and fictitious address to a chemical company in order to buy chemicals,
informing them that he planned to use the chemicals to start up a detergent company.
2005 - Omar Baladjam and others
A series of raids across the Sydney metropolitan area resulted in nine men being arrested and
later charged with conspiring to commit a terrorist act. It was alleged that the men had sourced
chemicals and materials that could be used in the preparation of an explosive device.
2004 - Jack Roche
Roche pleaded guilty to planning a terrorist act. He had planned to use homemade bombs to
target the Israeli Embassy in Canberra.
You can access more information on this topic here at the chemicals of security concern
website.
Applying the Code
So far, we have examined the objectives of the Code and its role in raising awareness of the
threat of chemical misappropriation. We’ve identified the 11 high-risk chemical precursors, and
seen that these present a real threat because they can be used as ingredients to manufacture
HME.
Chemicals of security concern awareness course
Module one
7
This section identifies how the Code can be applied by organisations and businesses.
Firstly, the Code contains guidance to help businesses protect chemicals from theft and
diversion by understanding security risks and putting practical security measures in place. The
Code applies to any quantity of the 11 high-risk chemical precursors at the concentration levels
set out in the table below.
Chemicals
Concentration levels
Ammonium
perchlorate
Ammonium perchlorate where it is in a water-based solution and the
ammonium perchlorate is at a concentration of at least 10 per cent, and
ammonium perchlorate (in any other form) at a concentration of 65 per cent or
above.
Hydrogen
peroxide
Hydrogen peroxide in a water-based solution at any concentration, and
hydrogen peroxide (in any other form including a liquid mixture) where the
hydrogen peroxide is at a concentration of 15 per cent or above.
Nitric acid
Nitric acid at a concentration of 30 per cent or above.
Nitromethane
Nitromethane at a concentration of 10 per cent or above.
Potassium
chlorate
Potassium chlorate where it is in a water-based solution and the potassium
chlorate makes up at least 10% of that solution, and
Potassium chlorate (in any other form) at a concentration of 65% or above.
Potassium
nitrate
Potassium nitrate where it is in a water-based solution and the potassium
nitrate makes up at least 10 per cent of that solution, and potassium nitrate
(in any other form) at a concentration of 65 per cent or above.
Potassium
perchlorate
Potassium perchlorate where it is in a water-based solution and the
potassium perchlorate makes up at least 10 per cent of the solution, and
potassium perchlorate (in any other form) at a concentration of 65 per cent
or above.
Sodium azide
Sodium azide at a concentration of 95 per cent or above.
Sodium chlorate Sodium chlorate where it is in a water-based solution and the sodium
chlorate is at a concentration of 10 per cent or above, and sodium chlorate
(in any other form) at a concentration of 65 per cent or above.
Sodium nitrate
Sodium nitrate where it is in a water-based solution and the sodium nitrate
is at a concentration of 10 per cent or above, and sodium nitrate (in any
other form) at a concentration of 65 per cent or above.
Sodium
perchlorate
Sodium perchlorate where it is in a water-based solution and the sodium
perchlorate is at a concentration of 10 per cent or above, and sodium
perchlorate (in any other form) at a concentration of 65 per cent or above.
All businesses that handle these and any of the chemicals of security concern should include the
risk of terrorism in their business security planning.
The Code applies to all businesses or places of employment that manufacture, import, store,
transport, sell or use any of the 11 high-risk chemicals.
Chemicals of security concern awareness course
Module one
8
The Code highlights the important concept of security risk management.
In providing guidance on how to improve a business’s security risk management, the Code sets
out a number of areas where action can be taken, including:
 personnel awareness training
 theft and diversion procedures
 employee and contractor checking
 receipt of chemicals
 inventory control measures
 physical access
 personnel access
 point of sale procedures
 sale and distribution, and
 transporting chemicals of security concern procedures.
It is important to note that individual businesses and industries should use the Code as a guide
for effective security management. Using the steps outlined within the Code is voluntary; it is
not a prescriptive or mandated process.
Each individual business should conduct its own practical and realistic assessment of its specific
security risk management processes, and how they may be improved. Following the principles
of the Code allows businesses to tailor security management to their specific context.
Security risk management
Security risk management is an ongoing process. It involves putting practical and effective
measures in place to address security risks. Effective security risk management must be part of a
business’s 'culture'; that is, an integrated part of everyday processes and practices.
The Code provides valuable guidance on increasing security risk management. However, it is up
to individual businesses to identify specific risks and vulnerabilities, and to make practical and
informed choices about how to improve security.
Each business needs to put security measures in place that address its specific risks. This
ensures a tailored approach to risk management, whereby distinct risks are
appropriately addressed. For example, managing the security of products that contain high
concentrations of chemicals of security concern will be different to managing the security of
products containing low concentrations of that chemical.
Effective security risk management
The most effective security risk management approach is one that is fit for purpose. There is no
‘one size fits all’. Businesses can achieve a best fit approach by assessing their specific practices,
products and facilities to determine the risks, and then tailor security measures to their
particular scenario.
Chemicals of security concern awareness course
Module one
9
For some businesses, an effective security risk management approach may be as simple as
restricting the number of staff with access to chemicals, or implementing employee background
checks. In other cases, an effective approach may include increased physical security, such as
improved inventory controls. Educating staff about how to identify and report suspicious
behaviour is another measure that may be an effective approach to security risk management.
The Code sets out a two-step security risk management process that can be applied to every
business. It is entitled ‘assess the risk and treat the risk’.
Security risks are examined in more detail in module two.
To summarise, security risk management within the Code IS:
 a sensible ‘best practice’ guide
 an aid in the identification and treatment of security risk, and
 a resource for individual businesses and organisations.
Security risk management within the Code is NOT:
 a 'how to' list for treating security risk
 a ‘one-size-fits–all’ risk assessment tool, and
 a guide that provides all the answers.
Preventing a terrorist from gaining access to chemicals starts with effective security
management, including measures that are periodically reviewed to ensure they remain up-todate and relevant.
Effective security management not only prevents chemicals from being stolen or
misappropriated, it also plays an important role in keeping Australia safe.
Reporting and the National Security Hotline
Effective security risk management includes reporting security breaches and suspicious
behaviour. Incidents that should be reported include (but, are not limited to) attempts to
purchase chemicals without a clear or valid purpose, breaches of electronic security systems or
physical security barriers, or incidents of unauthorised entry into restricted areas. Security
breaches and suspicious behaviour should be reported to the National Security Hotline (NSH) on
1800 1234 00.
Information at the ‘grassroots’ level – including, information provided by people working within
organisations that deal with chemicals – is important. This information may be part of a bigger
puzzle that helps to reveal a complete picture. What may seem unremarkable on its own, may
be significant when pieced together with other pieces of information.
The NSH is the single point of contact for members of the public to report possible signs of
terrorism. It also provides information on a wide range of security concerns.
Trained operators are available 24-hours a day, and take every call seriously. Information is
passed on to Australia’s police and security agencies for analysis and further investigation. You
can remain anonymous.
Chemicals of security concern awareness course
Module one
10
Reporting all suspicious activities and incidents regarding chemicals to the NSH should be part of
standard workplace procedures. Managers, supervisors and staff need to be aware of the
importance of reporting and aware of the role of the NSH. This can be achieved through staff
education and training sessions.
Reporting is vital, and it’s everyone’s responsibility! ‘If you suspect it, report it’.
Threat levels in Australia
Australia uses the National Terrorism Public Alert System to guide national preparation and
planning for a terrorist threat. The system is a range of four levels that communicate an
assessed risk of terrorist threat to Australia, including:
 Low – a terrorist attack is not expected
 Medium – a terrorist attack could occur
 High – a terrorist attack is likely, and
 Extreme – a terrorist attack is imminent or has occurred.
The system also dictates levels of precaution and vigilance required to minimise the risk of a
terrorist incident.
The Australian Government regularly reviews alert levels.
More information about the current alert level and what it means for businesses and the
community is available at here.
Resources, advice and guidance
There is a wide range of information and guidance material available to enhance your
knowledge and understanding of the Code. Hyperlinks are provided below.
Chemicals of security concern website
The Australian Government’s Chemicals of security concern website provides a range of
information, including training resources and awareness-raising materials.
http://www.chemicalsecurity.gov.au/Pages/default.aspx
Australian National Security website
The Australian Government’s National Security website provides information on counterterrorism, the role of Australia’s national security and policing agencies, national security
coordination arrangements and the national counter-terrorism plan. The website also contains
information about the current public alert level.
http://www.nationalsecurity.gov.au/
Attorney-General’s Department website
This Australian Government website provides information relevant to national security,
including a range of useful resources and support materials.
http://www.ag.gov.au/Pages/default.aspx
Chemicals of security concern awareness course
Module one
11
Australian Security Intelligence Organisation – Business Liaison Unit website
This Australian Government website provides information to business owners and operators
about the security of their assets and staff for which they are responsible.
www.blu.asio.gov.au
Chemicals of security concern awareness course
Module one
12
National Industrial Chemicals Notification and Assessment Scheme website
The Commonwealth Department of Health website provides valuable information, including
industrial chemical risks and safety information.
http://www.nicnas.gov.au/
Transport of Dangerous Goods
The Commonwealth Department of Infrastructure and Transport website provides valuable
information relevant to the transportation of dangerous goods.
http://www.infrastructure.gov.au/transport/australia/dangerous/
Useful sites for retailers
The sites below provide valuable assistance to managers and staff working in the retail sector.
http://www.anra.com.au/
http://www.retailinstitute.org.au
Key concepts summary
This section provides a quick review of the key concepts covered within module one. The
module one ‘brain teasers’ follow.
The Code fulfils three core objectives, including: to protect against chemicals being diverted for
terrorist or criminal purposes; to encourage cooperation between businesses and organisations
that handle chemicals and law enforcement agencies; and to educate and train staff to be alert
to suspicious behaviour and to report all incidents.
The Code is voluntary and is endorsed by all Australian governments.
There are 96 chemicals of security concern, of which 11 have been identified as high risk
because they can be used to make homemade explosives. Keeping these 11 high-risk precursors
out of the wrong hands is critical.
The 11 high-risk chemicals have a well-documented relationship to homemade explosives
(HME), which continue to pose a real and enduring threat.
The Code is considered a ‘best practice’ guide to practical measures that businesses can take
regarding chemical security risk management. It is the responsibility of businesses to apply the
principles and practices contained within the Code to their own business.
The principle of chemical security risk management has broad application to a business, and
covers a number of areas where action can be taken. It is important to develop a security
culture as an integrated part of your business to ensure everyone takes responsibility for
chemical safety. A culture of chemical security should be reflected in everyday processes.
The National Security Hotline should be used to report all suspicious behaviour.
Many of the themes and concepts that have been introduced in module one will be explored in
greater detail in other modules.
Chemicals of security concern awareness course
Module one
13
Brain teasers
The following multiple choice questions are designed to check your understanding of the
information contained in module one. Take your time to read the questions, and select the most
appropriate response.
Q1. True / False
The National Code of Practice for Chemicals of Security Concern is voluntary.
Answers:
True: Yes. The Code is voluntary, and may be described as a best practice guide to security
risk management. It was developed collaboratively between Australian governments and
industry to ensure it is good for business. It has been endorsed by government.
False: No. Try again.
Q2. Select the most appropriate response.
One of the key objectives of the Code is to:
a. Protect against the diversion of chemicals for terrorist purposes.
b. Provide a compulsory security check list for businesses.
c. Ensure everyone is trained in identifying chemicals that could be used for homemade
explosives.
Answers:
a. Correct. This is one of the three objectives of the Code. It complements the objectives
of encouraging cooperation, and educating and training staff.
b. Not quite. The Code is not a one size fits all security list for businesses, and is in fact
voluntary. Try again.
c. No. Whilst knowledge about which chemicals could be used to make HMEs is
important, it is not a key objective of the Code. Try again.
Q3. True / False
In order to make homemade explosives (HME) you need very large amounts of very
specific chemicals
Answers:
True: No. Try again.
False: Yes – this statement is false. Unfortunately, HME may be manufactured using
relatively small amounts of readily available and common chemicals – this is why it is
critical to prevent chemicals from falling into the wrong hands.
Congratulations! You have completed module one.
Select your next module from the list below.
Chemicals of security concern awareness course
Module one
14
 Business owners, retail managers and front line retail supervisors should now complete
modules two and three.
 Frontline retail staff should now complete module three.
 Transport business owners and supervisors should now complete modules two and
four.
 Frontline transport staff should now complete module four.
 Staff working in laboratories should now complete module five.
 Laboratory managers and front line supervisors should complete modules two and five.
Chemicals of security concern awareness course
Module one
15
Module Two – applying the Code to business owners, managers and professionals
Contents
Overview
Building a security culture
Security risk management
Assessing risks
Treating risks
Security measures
Reporting
Supporting your staff
Key concepts summary
Case study
Brain teasers
Overview
This module builds on key concepts introduced within module one. In particular, it explores the
importance of security risk management to your business. By the end of this module, you will:

understand the key principle of security risk management

be able to apply practical security measures to your business environment

recognise the impacts of ineffective security risk management

understand the key requirements in building a security culture, and

be able to define your responsibilities in engaging, training and supporting staff.
Regardless of the industry you work in, as an owner, manager or associated business professional,
you play a key role in ensuring that the risk of terrorism is addressed as part of your security
planning process.
As a leader within your organisation, you have a unique ‘big picture’ perspective about the business
environment. This puts you in a strong position to identify and report suspicious behaviour involving
chemicals. Similarly, as a leader, it is your responsibility to make decisions about your business’s
security, and to develop a security culture, including through engaging and training staff.
Chemicals of security concern awareness course
Module two
16
The Code and your business
Module one discusses the need for all people employed in the sale, storage, transport and use of
chemicals to focus on security. Incorporating the risk of terrorism within business security planning
is an essential first step.
The objectives of the Code are to promote effective chemical security practices throughout the
chemical supply chain, with a focus on the following three areas:
1. protecting against the diversion of chemicals for terrorist or criminal purposes
2. encouraging cooperation between businesses and organisations that handle chemicals, and law
enforcement agencies, and
3. educating and training staff to be alert to the warning signs of suspicious behaviour, and to
report all incidents.
The Code provides guidance on security risk management and how businesses can safeguard
chemicals of security concern from theft or diversion. Effective security risk management is
achieved by recognising the importance of chemical security; proactively assessing your business
risks; and, putting in place practical and effective security measures to protect your business.
Security risk management is examined in more detail throughout this module, starting with the
concept of a ‘security culture’.
Building a security culture
Building a security culture is about you and your staff being security aware. This means dedicating
time to identify the chemicals of security concern at your business, and the risk associated with
them; planning and taking steps to reduce the risk; and, educating your staff about security risks and
their management. Your staff need to know that security awareness is an important part of your
business’s daily work routine.
Being responsible for security risk management means actively engaging staff in the process; that is,
building a security culture. In such a culture, everyone understands the need for security and follows
good risk management practices, including dealing with security incidents as they occur.
Building a security culture is a critical proactive step that helps to reduce your overall security risk
profile. A good security culture also includes regularly reviewing your risk management to identify
emerging security loopholes and address them. Everyone has a role to play.
There are four key ‘building blocks’ for establishing a security culture in your business, including:
1. Developing and integrating security policies into every aspect of your business.
2. Undertaking periodic risk assessments, reviews and evaluations.
3. Implementing and measuring your security measures.
4. Ensuring the security awareness of all staff.
Your employees are often the best source of information about matters of security. They see what
happens in their own work areas and are usually the first to notice when something does not seem
right. Often staff will identify issues that require attention, for example, the need for new locks on
access gates because keys have gone missing. If staff are encouraged and supported to report
security concerns, issues can be dealt with in a timely and effective way.
Chemicals of security concern awareness course
Module two
17
Below are some key considerations for establishing and fostering a security culture.
 senior managers are committed to the objectives of the Code
 responsibility for security management is allocated to the right person/s
 effective risk assessments have been conducted
 appropriate risk measures are in place
 sales monitoring procedures are established (if appropriate)
 sound record keeping procedures are functioning
 procedures for reporting suspicious orders and/or enquiries have been implemented
 secure chemical storage processes are in place
 regular staff education and training occurs, and
 regular security reviews are conducted.
It is important to adopt a proactive approach to security in your organisation, including
communicating and consulting with staff, and providing training.
Security-related policies and procedures should be clearly communicated to all staff. This should not
only be at the beginning of their employment, but at subsequent, regular intervals. Periodic
communication about security is essential for helping staff build a common understanding about
security risk, and how they can address it as part of their work.
It is not enough, however, to educate staff about policies and procedures. Putting them into practice
is imperative. This includes you modelling good security management behaviour for staff. Security
measures that are not understood nor implemented by management and staff will be ineffectual
and may actually exacerbate the risks to your business.
Security risk management
Module one introduced the concept of security risk management as an ongoing process that puts
practical and effective measures in place to best address your business’s security risks.
Without security measures in place, the damage to your business could be catastrophic. A security
incident can have a serious impact on the reputation of your business, sales, profits, staff and even
overall business operations.
As a responsible corporate citizen, managing security risk is an important part of how you conduct
your business. It should be integrated into every aspect of your operations to ensure your business’s
continuing viability, while protecting staff and facilities. Furthermore, it can help to maintain your
reputation as an accountable, credible business, thus protecting your brand.
In some cases, existing arrangements for complying with workplace health and safety or transport
legislative requirements may be enough to manage the risk of terrorists accessing chemicals at your
business. In these circumstances, improving existing arrangements may be the only action required.
The Code provides you with valuable guidance on improving your security risk management,
including information about a range of security measures to help you make rational, practical and
informed choices to increase the security of your business. In this sense, the Code is an enabler.
Chemicals of security concern awareness course
Module two
18
Assessing risks
Risk management is not a 'one size fits all’ proposition. It is about identifying risks specific to your
business and ‘tailoring’ measures to those risks. Risk management must focus on the unique needs
and context of your business.
Wherever possible, businesses should conduct their own risk assessments. This ensures that your
specific business context and operating environment is taken into account when formulating the
most cost effective, realistic and effective security measures for you.
To make security risk simple and easy to apply, the Code sets out a two-step process: ‘Assess the risk
and Treat the risk’. These steps are the cornerstones of an effective security risk management
approach.
The first thing you need to do is assess your current security arrangements. This involves taking an
objective and critical look at how well your existing security measures work, and whether there are
any obvious loopholes.
It is worth involving staff at this assessment stage, as they may have already identified loopholes,
discrepancies or risks that you are not aware of. Taking a collaborative approach to security helps to
build your business’s security culture.

As part of your risk assessment process, it is also worth imagining how someone might
steal or divert chemicals from your business; that is, thinking from the ‘outside in’.
Consider how chemicals might be stolen from your business by an outsider, employee or
visitor, and how chemicals might be obtained from your business by means of deception.
This could include fraud, coercion, hacking of computer systems, hijacking or false ordering
of chemicals.
Ask yourself the following questions to assess how your workplace measures up:

What does my business’s physical security look like? What is the condition of my storage
facilities, secure areas, locks and gates?

What personnel security measures should I have in place? Is access to chemicals
restricted? Is it part of my standard employment arrangements to conduct background
checks on employees and contractors?

What about our information security? Can I be sure that unauthorised people don’t access
my computer networks or point-of-sale processes?

Do I have up to date security policies and procedures? Are these understood by all staff?

Do I have a security plan? Is training, reporting and general security awareness part of new
staff member induction and orientation.

Are my current inventory controls adequate? Do I conduct regular stock-takes?

Does my business have effective delivery and /or receipting processes for chemicals?
These questions can help you identify areas that need attention as well as arrangements that are
working well to manage current risks.
The Code provides you with guidance on how to conduct a security risk assessment. There is also a
range of other information to help you, including industry-specific guidance, which is available on
the chemicals of security concern website here.
Chemicals of security concern awareness course
Module two
19
Conducting a self-assessment of your business’s security risks is the first step. The next step is
choosing the most appropriate measures to manage the risk of terrorists acquiring chemicals from
your business.
Treating risks
Once you have identified the security risks your business faces, you need to treat them. This involves
applying control measures per risk to protect your business against the loss and diversion of
chemicals. Part of this process includes assessing whether you need to enhance any (or all) of your
existing measures.
While the Code sets out a number of security measures for you to consider, it does not require you
to implement all of them. It is up to you to select the measures that best suit your business
requirements. The risk treatments you choose must address the risks you have identified. They must
also be practical, cost-effective and workable options for your business. For example, introducing an
electronic monitoring system for your storage area may not be the best solution for keeping your
storage area secure because it is very expensive. So, instead, you could opt for placing new locks on
the access doors, ensuring the keys are kept secured and putting in place staff training on access
procedures.
Appropriate? Yes. Cost effective? Definitely. Workable? Certainly!
For security risk management to be truly effective a dedicated staff member must take responsibility
for it. This could be you or another person within your business.
Assigning specific responsibility for security is very important. It ensures that:
 effective security measures are introduced and consistently maintained throughout your
business
 security information from industry, government agencies and other appropriate areas is
received and communicated in a timely manner
 a holistic approach to security is taken that includes effective policy and procedures
 reporting systems are in place
 targeted security training, education and awareness for employees is implemented
 suspicious incidents and security breaches are promptly investigated and reported
 there is an overarching business security plan, which is maintained, and
 a strong security culture is fostered.
Assigning dedicated responsibility for security also sends a clear message to staff and customers that
you take security risk management seriously. Further, by including security management as part of
an individual’s job description, the associated duties must be carried out.
Security measures
This section introduces the security measures contained within the Code, and provide examples of
how they may be implemented in your business. The table below details recommended security
measures.
Chemicals of security concern awareness course
Module two
20
Security measure
Examples
Relevant to
Employee and
contractor checking
Basic background checks prior to employing
staff
Criminal records checks, where required
Manufacturer, importer,
transportation,
wholesaler, logistics,
wholesaler, retailer
Personnel security
awareness
Staff education
Staff induction and ongoing training
Awareness sessions
Manufacturer, importer,
transportation,
wholesaler, logistics,
wholesaler, retailer
Inventory control
measures
Inventories control systems
Periodic stock-takes and checks
Reconciliation processes
Manufacturer, importer,
processor, wholesaler,
retailer
Receipt of chemical
Systems that reconcile quantities ordered
with actual products received
Manufacturer, importer,
processor,
transportation,
wholesaler, retailer
Theft and diversion
procedures
Theft and diversion prevention plans
Investigation and reporting policies
Assigning responsibility for security
Manufacturer, importer,
processor, wholesaler,
transportation, logistics,
retailer
Physical access
Signage, security fencing, lighting
Visitor sign-in procedures
Control of keys
Photo identification badges
Security staff
Manufacturer, importer,
processor, logistics
transportation,
wholesaler, retailer
Personnel access
Restricting access to areas
Escorting visitors and contractors
Policies and procedures
Manufacturer, importer,
processor, wholesaler,
retailer
Chemicals of security concern awareness course
Module two
21
Point-of-sale
procedures
Only selling to customers with identification
and ability to demonstrate of legitimate use
Only selling by a credit or debit card, cheque
or bank transfer
Reporting suspicious transactions
Manufacturer, importer,
processor, wholesaler,
retailer
Sale and distribution
procedures
Only selling and delivering to customers with
identification and ability to demonstrate =
legitimate use
Only selling by credit or debit card, cheque or
bank transfer
Reporting suspicious transactions
Not leaving chemicals unattended at point of
delivery
Manufacturer, importer,
processor, wholesaler,
retailer
Transporting
chemicals of security
concern procedures
Ensuring chemicals are secure during
transport
Not leaving vehicles unattended
Monitoring vehicles in transit
Ensuring chemicals are only supplied to the
legitimate recipient
Manufacturer, importer,
processor, transport,
logistics, wholesaler,
retailer
When selecting treatments for risk, it may be appropriate to choose a combination of many
measures outlined above, or only a select few. The choice of treatments is dependent on the gaps,
loopholes or deficiencies that you have identified within your business.
The treatments should also be appraised for whether and how they can align, support and
complement each other.
To see this concept at work, the next section describes a business that has recently conducted a
security risk assessment.
Agro-Co Pty Ltd
Agro-Co Pty Ltd is an agricultural wholesaler and transporter that sells a range of agricultural
products to farms and smaller retailers.
The business recently learnt about the National Code of Practice for Chemicals of Security Concern
and decided to undertake a security risk assessment as part of its annual risk review.
David, the owner of Agro-Co tasks Stephanie to perform the risk assessment. Stephanie is a senior
supervisor, who has been with the business for around five years. As part of the process, Stephanie
devotes time to speak with other supervisors as well as members of staff about security. She is
careful to also consider current security measures at the business, and incorporate these within her
review.
Stephanie finds that some chemical products containing precursors to homemade explosives are
routinely stored in an open area that can be accessed by the public. She also discovers that the
majority of staff are unfamiliar with the importance of securing chemicals, and that stock-takes are
not being conducted on a regular basis.
Stephanie finds that fencing and lighting at the rear of the premises and in the loading yard are
sound, and across the business there is adequate signage to indicate staff only areas.
Chemicals of security concern awareness course
Module two
22
The final risk assessment report is provided to David, and Stephanie talks him through it. David calls
a meeting with all supervisors to discuss the recommendations.
During the meeting, Stephanie discusses the need to tighten inventory control measures to ensure
that missing stock is identified in a timely manner.
She also highlights the fact that the current physical access controls present the greatest risk to the
business. She explains that this is because some chemical precursor products are stored where
members of the public can access them.
To address this issue, Stephanie recommends that the products are relocated to a storage room
within the stock area at the rear of the premises. This room is separate from the general storage
space, and can be locked. Stephanie recommends that the only keys to the room be held by Kevin, a
senior supervisor. In this way, access will be restricted and personnel access controls also put in
place. She rules out installing surveillance equipment as a viable option because it is too expensive.
David commends Stephanie for her work, and highlights the need for staff training to raise
awareness of the importance of secure chemical storage. He tasks Ellie, his office manager with
designing a short training session for all staff, which can be included within new employee
orientation training. This strategy ensures that personnel security awareness is implemented across
the business.
You can see that Agro-Co has put effective security measures in place that address the specific
threats facing the company. These measures are aligned for maximum effect.
The next section looks at each security measure in more detail.
Employee and contractor checks
The security objective of conducting employee and contractor background checks is to prevent the
threat of an ’insider’ stealing or diverting chemicals. This type of insider threat is commonly referred
to as a ‘malicious trusted insider’. This is a current of former employee in your business who actively
seeks, or is convinced by others to do harm.
Insider activities include such things as unauthorised disclosure of information, enabling
unauthorised people to access your premises or aiding chemical theft. Whatever their motivation, a
malicious insider is harmful, embarrassing to business and a real threat.
Conducting general background checks, including identity checks, employment checks and criminal
record checks are security measures that can help address the threat of malicious insiders.
Background checks can help determine a person’s trustworthiness and suitability to the job.
For more information on this topic, you can access this fact sheet: ‘The Trusted Insider’ here on the
chemicals of security concern website.
It is advisable to repeat background checks on employees and contractors at regular intervals. You
should also conduct a repeat background check when staff are transferred into areas with access to
high risk chemicals. You will need to decide which background checking method is appropriate. All
methods should be included within your business policies and procedures.
The chemicals of security concern website also has a comprehensive guidance document
‘Understanding the Code of Practice’ here, which contains additional information on background
checking methods.
Chemicals of security concern awareness course
Module two
23
Finally, you must adhere to the requirements set out within the Privacy Act 1988, and the National
Privacy Principles when collecting, storing and using personal information. More information is
available at the Office of the Australian Information Commissioner website. You should seek legal
advice if you have any specific concerns or questions relating to privacy.
Personnel security awareness
The importance of staff education has been highlighted throughout this course. Employees and
contractors are well placed to notice when something is not right. It is your responsibility to provide
staff with effective security training, which covers identifying and reporting suspicious behaviour and
security incidents. Education and awareness plays an extremely important role in improving the
security culture of your workplace.
With an effectual security culture in place, security breaches are more likely to be reported. And, in
turn, your business can deal with security issues in a timely manner.
Below is a list of sample topics to help you design your staff training and awareness sessions:
 risks associated with chemical products held at your business, including misappropriation of
chemicals for the production of homemade explosives
 identifying products in your workplace that contain chemical precursors
 exploring legitimate uses of chemicals at your business
 knowing your customers – techniques for enquiring about customers’ chemical uses and
providing advice about appropriate chemical quantities
 insider threat indicators – for example, a colleague working odd hours in an attempt to be
left alone, or accessing restricted information outside of their usual responsibilities
 using inventory control mechanisms to detect and prevent theft and diversion
 indicators of suspicious behavior, and
 reporting suspicious behaviour to the National Security Hotline.
Chemicals of security concern awareness course
Module two
24
Inventory controls
Chemical security at your workplace includes actively monitoring your inventory. An inventory
control system should be a simple and robust process that helps you keep track of your stock.
A good inventory system should:
 identify products containing high risk chemicals
 pinpoint the physical location of each product container at any given time
 identify the number of containers at the beginning of specified time periods, and
 identify the number of containers of products at the end of specified time periods, for
example, quarterly or annual stock-takes.
It is your responsibility to determine how regularly you reconcile your stock, taking into account your
business’s circumstances. Periodic audits and stock-takes are simple measures that help keep you
maintain oversight of your stock profile. Unexplained significant stock losses must be immediately
reported to the police and the National Security Hotline.
Aligning your inventory controls with point-of-sale processes for ‘real-time’ tracking is also a very
effective way to maintain control of your stock.
Receipt of chemicals
Your business procedures should include routine checks when you receive chemicals. This is to
ensure that the amount of chemicals you order matches the amount you receive. If there is a
mismatch, it could mean that items have been diverted or stolen while in transit.
If you suspect a delivery of chemicals has been stolen, diverted or tampered with, you should report
it immediately to the National Security Hotline.
Remember, even small amounts of chemical precursors can be used by terrorists to make explosives.
James Rural Pty Ltd
The following case study examines a business that recently put in place the four security measures
we have just covered.
James Rural Pty Ltd is a small rural supply business that sells a number of chemicals. It has recently
adjusted its regular risk assessment process to incorporate potential national security risks. The risk
assessment found that the business already has sound physical controls in place to secure and
safeguard chemical stock, but identified four areas where it could reduce its vulnerability.
James Rural’s sales employees are mostly employed on a casual basis. There is a high turnover of
staff. While management decided that undertaking police checks was not a cost effective option, it
was concerned that the lack scrutiny exposed the business to insider threat.
To reduce the potential of insider threat, James Rural implemented a new employee checking
process. This requires prospective employees to provide details of two referees and 100 points of
identification with their applications. Such background information helps the business decide who is
suitable to work there, including who can be trusted to access potentially dangerous chemicals.
The company also tightened its procedures for receiving deliveries. When supplies are delivered, the
responsible supervisor must check the consignment note against the number of items delivered
before signing the delivery receipt. The items are immediately placed in a secure storage room,
which can only be accessed by authorised staff, and is closed to the public until items are unpacked.
Chemicals of security concern awareness course
Module two
25
Discrepancies in the delivery are immediately reported to the supplier, who must explain what has
happened.
The receipt of chemicals approach complements the new inventory control measures, which
includes monthly stock-takes and completing stock-take reports to identify discrepancies.
James Rural also wanted to ensure that its casual employees were aware of the potential for
common chemical products to be used for terrorist purposes, and that all staff could identify such
products held by the business. As a result it designed and delivered a new security awareness
training session for all staff. It had a particular focus on identifying suspicious behaviour, insider
threats and reporting to the National Security Hotline.
James Rural put in place some very practical and cost effective measures. This example highlights
the importance of staff education and awareness, and the effectiveness of aligning security
measures.
Theft and diversion
It is important to consider how the chemicals you hold could be stolen or diverted. This is the first
step toward developing and implementing a plan to reduce the risk of this occurring. A good theft
and diversion prevention plan employs practical and effective steps to reduce your chemical security
risk. This plan is a set of rules and procedures that include a range of security measures such as
personnel and physical access measures, staff awareness training, security policies and reporting. It
should be integrated into your broader security plans and general business operations.
It is important to assign responsibility for the development of a theft and diversion prevention plan
to a specific staff member. This could be the same person who has responsibility for overall business
risk management.
Your theft and diversion prevention plan should have strong links with your business’s daily practices
and procedures. For example, it should be connected to your unlocking and opening up procedures,
restricted area access procedures and processes for reporting suspicious behaviours. You might also
consider including potential theft indicators in your theft and diversion prevention plan. Such
indicators may include people who:
 wander aimlessly into your business
 appear very nervous or try to avoid interaction with your staff
 attempt to enter or linger in a location that is difficult for staff to observe, or
 constantly go in and out of the premises without purchasing.
If chemicals of security concern are lost or stolen from your business, your plan should clearly
dictate the process for investigating and reporting the incident. Reporting protocol must include the
National Security Hotline and, where appropriate, state or territory police.
Physical access controls
Restricting physical access to chemicals of security concern is a fundamental step in reducing the
potential theft or diversion of chemicals from your business for terrorist purposes.
Even if you have physical access controls in place, regular review of these controls helps to identify
emerging vulnerabilities. The aim of physical access controls is to inhibit unauthorised people gaining
access to your chemical stock.
Chemicals of security concern awareness course
Module two
26
Physical access controls may include:
 signage - for example, ‘staff only’ or ’restricted area’
 surveillance measures
 limiting the number of access points into your warehouse or stockholding area
 visitor sign-in protocols
 security lighting, locks and access controls at loading and unloading areas
 penetration resistant doors, security hinges, secure windows with locks, and alarm systems,
and
 employee and contractor photo identification and swipe cards.
Personnel access controls
Controlling access to high-risk chemicals may be as simple as restricting entry to only those people
who legitimately need to access them. Most commonly, this is achieved by designating specific areas
within your business as ‘out of bounds’ or ‘restricted’ to specific staff.
Restricting access to specific areas, namely storage areas where chemicals of security concern are
held, is an effective personnel access control measure.
It is important to also restrict access to areas by limiting the number of keys and swipe cards that
grant access to secure or restricted areas. Keys and swipe cards should be held by designated people
only, and never left unsecured.
You can enhance your personnel access controls by:
 designating the storage areas where chemicals are held as ‘restricted’ areas
 designating specific employees as authorised to access restricted areas containing chemicals
 informing all staff about restricted areas, and embedding access requirements in policies
and procedures
 ensuring that all visitors and contractors are checked and escorted, and
 ensuring that personnel access controls fully integrate with physical access controls.
Chemicals of security concern awareness course
Module two
27
Point-of-sale procedures
Point-of-sale procedures are practical security steps that you undertake when selling your chemicals.
Effective point-of-sale procedures can help staff verify whether a customer has a legitimate reason
for purchasing chemicals from your business.
Point-of-sale procedures do not need to be complex, nor formulated in lengthy policy documents.
The point-of-sale procedures that you adopt should be everyday business practices that best suit
your business. The examples below list some simple, yet effective procedures you can implement.
Point-of-sale procedures may include:
 keeping chemicals behind a barrier or within your counter staff’s line-of-sight
 having checklists for counter staff
 having appropriate signs informing customers about the process for purchasing chemicals
 training your staff to ask customers what they intend to use a chemical for, and if
appropriate, suggesting alternative products
 only accepting payments in the form of a credit or debit card, cheque, bank transfer or by
account
 having your staff keep appropriate records of sales so that the customer and transaction can
be tracked, and
 ensuring that staff only sells to customers with proven identities. For example, asking
customers to show identification, and for small businesses, asking for an Australian Business
Number or Australian Corporation Number.
Your frontline staff should be skilled at identifying and dealing with suspicious behaviour. This
includes understanding the imperative to report suspicious behavior to supervisors.
The Code contains suspicious indicator guides that help frontline staff identify and report suspicious
transactions. You are responsible for ensuring frontline staff has a copy of the guides, and including
them as part of your business’s induction and ongoing training.
Distribution procedures
If your business delivers chemicals, it is good practice to only deliver to people who can prove their
identity. This can include sighting and recording their identification documents, such as driver’s
licenses. When you’re dealing with businesses, proof of identify may include sighting Australian
Business or Australian Corporation numbers (ABN or ACN).
Distribution procedures should also ensure that chemicals of security concern are never left
unattended and that staff maintain appropriate documentation of the sale and the load. If you use a
third party for transporting your chemicals, you need to ensure that the transport provider is
trustworthy and reputable.
If you distribute chemical products via a website or email system, your controls need to be specific
to the online environment. Selling chemicals online has its own particular security concerns and
issues, including the ability for potential terrorists to more easily conceal their identity and
intentions.
Your online checking systems need to be robust enough to detect any suspicious transactions. For
example, you could program your system to produce alerts or flags when particular transaction
Chemicals of security concern awareness course
Module two
28
records are created, or ask customers to sign-up with their details before they enter into
transactions. The nature of your business should inform the most appropriate mechanisms.
Transportation procedures
There are specific risks related to transporting chemicals between businesses, warehouses and other
places. These risks include chemicals being accidentally delivered to people who intend to misuse
them, and chemicals being stolen by terrorists or associates. Transport businesses may also be
vulnerable to chemical hijacking.
There are things you can do to help reduce the risks including:
 following safe loading and unloading security procedures
 monitoring the location of vehicles during transportation, such as via GPS tracking systems
 enforcing procedures that ensure vehicles carrying chemicals are not left unattended
 ensuring loads are secured and delivered with seals, locks and packaging intact
 using weight measurement processes when unloading to identify tampering
 only delivering chemicals to a nominated recipient and verifying that recipient’s identity by
sighting and recording a form of identification, and
 ensuring that all chemicals are locked away upon receipt, and prior to transporting to next
location.
Module four discusses chemical transportation in more detail.
Reporting
Being able to verify your customers’ identity and the legitimate use of chemicals they wish to
purchase is a vital tool for preventing chemical theft and diversion.
You are responsible for providing staff training about how to identify suspicious behaviours and
report incidents to the National Security Hotline. Recognising suspicious behaviours is particularly
important for employees who work in point-of-sale areas.
Suspicious behaviour is defined as any behaviour that does not feel or seem right. This means
anything that raises suspicions. Identifying suspicious behaviour is explored in more detail within
industry-specific modules throughout this course.
Your staff training and awareness sessions should include a focus on the importance of reporting. It
should highlight the National Security Hotline as a service that can provide advice and guidance
about chemical security-related matters.
Any incident that involves chemicals of security concern being lost or stolen from your business
should be reported to the National Security Hotline on 1800 123 400 or
[email protected] as soon as possible. Suspicious incidents should also be promptly
reported.
In the event that an employee comes to you for advice about an incident that they believe is
suspicious, it is your responsibility to openly discuss the incident and their concerns. All reports of
suspicious behaviour should be treated as important.
You should encourage staff to record suspicious incidents, and if necessary, help them prepare their
notes. Make sure you meet the requirements set out within the Privacy Act 1988 and the National
Chemicals of security concern awareness course
Module two
29
Privacy Principles when recording suspicious incidents that involve collecting, storing and using
personal information. You can find more information at the Office of the Australian Information
Commissioner website.
Staff, however, may be reluctant to report suspicious incidents. It is vital that you support and guide
them to make the right decision for their own safety, as well as the safety of others and your
business. Supporting staff to report suspicious incidents includes ensuring they feel comfortable to
raise issues with you and/or other managers and supervisors. Staff should not be made to feel that
their concerns are ‘silly’, that they are overreacting or are wasting time.
Supporting your staff
As a leader in your business, you are responsible for providing a safe workplace, and any specific
information and training that staff need to perform their work duties.
In addition to formal staff education, it is your responsibility to provide practical tips about how staff
might manage difficult or aggressive customers. For example, checking a customer’s identity and the
legitimacy of their chemical purchase can make some customers upset or aggressive.
One way to manage these situations is for staff to confirm the use of checks as part of company
security protocol. This de-personalises the request for information, which can help reduce
discomfort, and defuse a situation.
Your staff needs to be aware that it is part of their job to be clear about security protocol with
customers. This should include informing customers about your business’s verification process, and
assuring them that it is standard business practice to ask the same questions of everyone who is
purchasing chemicals.
You can also support your staff by reassuring them when they are doing the right thing. Support
includes congratulating staff for doing a good job, for example, when they follow chemical security
processes to validate the purchase of a chemical of security concern.
It is your job to support and guide your staff, ensuring they are polite, but firm. Staff needs to
understand the importance of consistently following company processes. Staff must not be
distracted from following this process by an aggressive customer, or allowing them to dictate what is
going to happen.
Staff will often ask for a supervisor’s or manager’s help with unpleasant customers. In these
circumstances, it is important that you reiterate the security procedures to the customer. Your
support affirms staff knowledge and behaviour and the company’s position.
Dealing with aggressive and difficult customers is never pleasant, and can be very stressful for staff.
Where appropriate, consider enlisting help from others, such as your human resources staff.
Chemicals of security concern awareness course
Module two
30
Key concepts summary
Module two examines the important role that you – business owners, managers and associated
professionals – play in establishing and fostering a security culture within your business.
The four building blocks to building a security culture are:
1. developing and integrating security policies into every aspect of your business
2. undertaking periodic risk assessments, reviews and evaluations
3. implementing and measuring your security measures, and
4. ensuring the security awareness of all staff.
It is important for your business to develop and implement a security risk management strategy as
an integrated part of its business policy. The Code outlines a two-step process to help you assess and
treat chemical security risks. The most effective security measures are tailored to the particular
environment that your business operates in.
The Code also outlines a range of security measures. It is up to you to select the measures that suit
your business best. The Code highlights the importance of adopting cost effective and practical
measures to respond to your business’s specific risks and vulnerabilities.
Staff training is an essential part of security risk management. Induction and ongoing security
training ensures that staff can recognise suspicious behaviour, and report it in a timely fashion. As
leaders in your business, you play a pivotal support role for staff when such incidents occur.
You can access additional resources and information via the chemicals of security concern website.
Below is a short exercise using a case study to check your understanding of the information covered
in module two. The case study describes how a typical business implemented the results of its recent
risk assessment.
Chemicals of security concern awareness course
Module two
31
Case study
Once you have reviewed Paul’s story, proceed to the brain teasers.
“Welcome to Pool Aqua!
My name is Paul, and I’m one of the co-owners of the business. We’re a small business selling
swimming pool and spa chemicals.
We recently received some guidance material from our peak body relating to the Code of Practice
for Chemicals of Security Concern. It was really practical stuff on conducting risk assessments. I guess
we’ve been a little slack in this area over the last year. Scott, the other co-owner and I decided it was
high time that we got moving on this, so last weekend we sat down and did a risk assessment for the
business.
Well, here’s what we found. The upside is that we already have sufficient training in place to make
staff aware of suspicious behaviour. This is good news. Our staff receives training when we take
them on, including teaching them how to escalate things if something’s not right. We also have a
copy of the suspicious indicator guide contained within the Code taped near the cash register for
staff to refer to.
All good! Then we started to find some problems...
Most of our staff are employed on a casual basis, working one or two shifts a week. Because of this,
we do have a fairly regular turnover. I think we should check the background of the guys more
thoroughly before we employ them, but Scott reckons police checks are way too expensive.
He also thinks that because the checks can take a long time, we’ll just end up short-handed while we
wait for the results to come back. He’s right – casuals won’t wait, they’ll just go somewhere else to
work.
Problem number two is our stock. We have fairly limited floor space to display our products, and our
storage room is pretty packed. This means that a lot of our stock is out on display, including some
chemical precursor products. These come in pretty small containers, so there is the potential for
them to be stolen.
I’m all for putting in a new alarm system for the shop, which will make everything more secure. I also
reckon installing a security camera system to focus on the area with chemical precursors is the only
logical thing we can do. The problem is that we’re only a small business so we don’t have a lot of
money on hand for anything expensive.
I think the new alarm system and security cameras would be great, but there’s no way we can afford
them. And anyway, how’s that going to help with background checks of our employees?
We’re both committed to improving our security, but it all sounds pretty expensive.
So, what should we do?”
Chemicals of security concern awareness course
Module two
32
Brain teasers
The following questions are based on the above case study. They are designed to check your
understanding of the information contained in this module. Take your time to read the questions,
and select the most appropriate response.
Q1. What areas of security risk did Pool Aqua’s risk assessment identify?
a. Insider theft, inventory controls and employee checking.
b. Inventory controls, point-of-sales processes.
c. Employee checking and physical access controls.
Answers:
a. Not quite. While employee checking was an issue highlighted by the risk assessment, insider
theft and inventory controls were not. Try again.
b. No. These areas were not highlighted. Try again.
c. Correct. These were the issues clearly identified by the risk assessment.
Q2. What practical steps can Pool Aqua take to address the issue of employee checking?
a. Change current recruitment processes to undertake referee checks, and prospective
employees must provide 100 points of identification.
b. Pay for the police checks – they just have to be done.
c. Forget about employee checks altogether – it’s too expensive.
Answers:
a. Correct! Pool Aqua can put changes in place for recruiting employees. By asking prospective
employees to provide 100 points of identification as part of the recruitment process, and
undertaking referee checks, Scott and Paul will be able to make informed decisions about
who is suitable to work for the business.
b. No. The police checks are too costly and time-consuming for the business. Paul and Scott
need another solution. Try again.
c. No. Ignoring this vulnerability would be extremely risky, and may expose the business to
exploitation by those wishing to access chemicals for illegal purposes. Try again.
Q3. What practical steps can Pool Aqua take to address the issue of physical access controls?
a. Purchase a new security system, including video cameras.
b. Make all staff responsible for any theft.
c. Relocate the chemical precursor stock on display closer to the counter, highlight the need to
monitor the stock to staff, and put a buzzer on the front door.
Answers:
a. Unfortunately, Paul and Scott cannot afford this option. They need another more practical
and effective solution. Try again.
Chemicals of security concern awareness course
Module two
33
b. Not quite. Although staff should keep an eye on the chemical precursor stock, and guard
against theft, making them solely responsible for chemical security is not likely to be a
practical or long-term solution. Try again.
c. Correct! Paul and Scott can reduce the risk of stock theft on display by moving the products
closer to the front counter so they are within view. Paul and Scott can also educate staff to
ensure they understand the need to monitor stock, and can attach a buzzer to the door so
that staff are alerted when customers enter or exit.
Chemicals of security concern awareness course
Module two
34
Module Three – applying the Code to frontline staff
Contents
Overview
Revising the threat
Being security aware
Security measures
The retail environment
Case study: Hardware & Paint Pty Ltd
Point-of-sale procedures
Case study: Ellie and the customer
Suspicious behaviours
Reporting
Difficult customers
Key concepts summary
Case study
Brain teasers
Overview
People who deal directly with clients and customers – you – play a very important role in keeping
chemicals secure. To do this effectively, you need to understand the threat that stolen or
misappropriated chemicals present, especially if they fall into terrorist hands.
By the end of this module, you will:
 understand how the Code applies to people who working in customer- and client-facing
roles
 be able to identify indicators of suspicious behaviour, for example, when a customer
requests a chemical of security concern or product containing a chemical precursor, and
 know how and when to report suspicious behaviour or a security incident.
Revising the threat
Module one provides background information about the National Code of Practice for Chemicals of
Security Concern (the Code). The Code defines 96 chemicals of security concern, of which 11 are
classified as high-risk because they can be used to make homemade explosives. The Code applies to
all businesses that manufacture, store, transport or sell any of the 11 designated high-risk chemicals.
You can access the Code via this link to the chemicals of security concern website.
Chemicals of security concern awareness course
Module three
35
You can review the table listing the 11 high-risk chemicals and their concentration levels here.
If these chemicals are misappropriated by criminal or terrorist groups, the results can be
catastrophic. This section explores where individuals can access information on the use of chemicals
to manufacture homemade explosives.
Firstly, did you know that there are websites that relate to the manufacture of homemade or
improvised explosive devices? Experts believe that there are hundreds, if not, thousands of these
sites providing information about how to make explosives. Although this information is potentially
dangerous, it is not classified. Law enforcement agencies and governments actively monitor these
sites.
Recipes for making homemade explosives have existed for many years and pre-date the internet. In
the 1960s and 1970s there were many improvised explosive recipes in circulation, but these came
from limited and isolated sources often described as ‘anarchist literature’. People had to actively
search for this type of information; it wasn’t readily accessible. However, with the advent of the
internet, explosives recipes have become accessible to everyone with a computer and a modem.
It’s extremely difficult to control these sites and the information they publish. According to some, it
is actually impossible. As a result, efforts to keep chemicals secure need to focus on aspects that can
be controlled. This includes restricting and controlling the chemical precursors that are required to
make homemade explosives.
The examples below highlight the importance of restricting access to chemical precursors.
The 2005 terrorist attacks on London’s underground trains and a double-decker bus were carried out
using homemade bombs from small quantities of chemicals such as hydrogen peroxide. Hydrogen
peroxide can be bought from retail stores. Fifty-two people were killed and many were severely
injured.
The 2013 Boston marathon bombing and 2002 Bali bombing also highlight the explosive power of
small quantities of chemicals, and the need to keep chemicals secure. In the Bali incident, forensic
examination revealed that the vehicle bomb used by Jemiah Islamiah was manufactured from a
mixture of extremely volatile chemicals. Investigators concluded that the group was able to
manufacture such a device because these chemicals were readily available to them.
More information on this topic is available here on the chemicals of security concern website.
Being security aware
Being security aware is about dedicating time to consider the risk surrounding chemicals of security
concern at your business, and applying that knowledge to your daily work. Being security aware in
this way reduces chemical security risks for your business.
All staff members are responsible for noticing what occurs in your workplace, including when
something does not seem right. In your specific work area, you are the person ‘on the spot’ who can
best identify areas where security measures could be improved. For example, you may notice the
need for new locks on access gates because keys have gone missing. Part of your role is to also bring
these issues to your manager’s attention.
Businesses where everyone takes responsibility for security have a ‘security culture’. In this
environment, everyone understands the need for security, implements good risk management
practices, deals with security incidents as they occur and reports all suspicious incidents. A good
security culture also means that risk management is regularly reviewed to identify emerging security
loopholes, and they are addressed in a timely manner. Everyone plays a part.
Chemicals of security concern awareness course
Module three
36
You can increase your security awareness by:

identifying which chemicals your business transports that have the potential to be used for
homemade explosives

understanding the legitimate uses for chemical products that you transport and deliver,
including their recommended quantities

being alert to the indicators of inside threat activities, for example, co-workers who work
extra hours and find ways to be left alone at work, access restricted areas, or seek out
information that is outside their usual responsibilities

ensuring your business has adequate inventory control mechanisms, processes and
procedures in place that prevent or detect chemical theft or diversion

recognising the importance of reporting suspicious behaviour to the National Security
Hotline on 1800 1234 00, and

understanding the indicators of suspicious behaviour.
Undertaking this course will also help you build your security awareness!
Chemicals of security concern awareness course
Module three
37
Security measures
The Code sets out a number of practical measures that your business can take to stop unauthorised
people from gaining access to chemicals of security concern. The table below details these
measures.
Security measure
Examples
Employee and
contractor checking
Basic background checks prior to employing staff
Criminal records checks, where required
Personnel security
awareness
Staff education
Staff induction and ongoing training
Awareness sessions
Inventory control
measures
Inventories control systems
Periodic stock-takes and checks
Reconciliation processes
Receipt of chemical
Systems that reconcile quantities ordered with actual products received
Theft and diversion
procedures
Theft and diversion plans
Investigation and reporting policies
Assigning responsibility for security
Physical access
Signage, security fencing, lighting
Visitor sign-in procedures
Control of keys
Photo identification badges
Security staff
Personnel access
Restricting access to areas
Escorting visitors and contractors
Policies and procedures
Point-of-sale
procedures
Only selling to customers with identification and proof of legitimate use
Only selling by a credit or debit card, cheque or bank transfer
Reporting suspicious transactions
Sale and distribution
procedures
Only selling and delivering to customers with identification and proof of
legitimate use
Only selling by credit or debit card, cheque or bank transfer
Reporting suspicious transactions
Not leaving chemicals unattended at point of delivery
Transporting
chemicals of security
concern procedures
Ensuring chemicals are secure during transport
Not leaving vehicles unattended
Monitoring vehicles in transit
Ensuring chemicals are only supplied to the legitimate recipient
Chemicals of security concern awareness course
Module three
38
This section explores one of the security measures to see how it might be applied.
One of the most effective, yet simple security measures is to lock away chemicals and restrict access
to them. This immediately reduces the potential for chemicals to be stolen from your workplace.
These measures are called physical access controls.
As frontline (or, client–facing) staff, you can do your bit to make sure that physical access controls
work by ensuring that:
 signage such as ‘no entry’ or ‘staff only’ is clearly visible, particularly at storage and
warehouse areas
 unescorted visitors do not have access to stock rooms, storage and warehouse areas
 visitor access is restricted, and that you enforce sign-in procedures
 locks on exterior and interior doors, gates, windows and other entry points are secured
 you and your colleagues wear photo identification badges, and
 electronic access control systems and video surveillance cameras are used, particularly after
hours.
You should be familiar with the policies of your business regarding chemical storage, and the
physical access controls that are in place at your workplace.
In the retail industry, one of the most important things you can do to prevent chemical theft and
diversion is to ‘know your customer’. This concept is explored later in this module.
For more information about the security measures, go to the chemicals of security concern website
here.
The retail environment
The Code aims to reduce security risk within individual businesses, offering a range of security
measures that could be applied to help keep chemicals out of the wrong hands. A number of these
apply to the retail sector. Good security risk management is about combining security measures.
Business security is everyone’s responsibility – not just management. You have a key role to play in
ensuring your workplace chemicals are secure. This not only involves storing chemicals safely, but
also selling them safely.
The security measures outlined in the Code, which can be applied to the retail environment, include:
 Physical access measures
Examples: signage, security fencing, lighting, visitor sign in procedures.
 Employee and contractor checking measures
Examples: pre-employment background checks.
 Personnel security awareness
Examples: induction and orientation training, awareness sessions.
 Inventory control measures
Examples: inventory control plans, stock-takes, reporting.
Chemicals of security concern awareness course
Module three
39
 Receipt of chemical measures
Examples: checking systems, reconciling stock received matches stock ordered.
 Theft and diversion procedures
Examples: rules and procedures on access to chemicals, assigning responsibility for plans.
 Personnel access measures
Examples: restricting access to stock rooms, escorting visitors and contractors.
 Point-of-sale procedures
Examples: only selling to customers producing identification, no cash sales.
 Sales and distribution procedures
Examples: only delivering to persons with known identity and verified legitimate use.
The following section examines how these security measures are applied.
Case study: Hardware & Paint Pty Ltd
This store is a large retail business that stocks several products containing precursor chemicals.
Security risks for this business include chemical theft and possible illegitimate purchase of chemicals
by people who intend to misuse them.
As part of its regular risk assessment process, managers identified point-of-sales procedures, theft
and diversion and inventory controls as vulnerable security areas.
These areas were easily identified given that the business currently sells products containing
chemicals in packages that could be easily stolen, it does not train staff to identify suspicious
behaviours, and it has no processes in place to keep track of stock.
Implementing effective point-of-sale procedures included organising staff training to teach staff
how to identify suspicious behaviour, and report any curious transactions to senior staff. The
business drew its information from the Code’s suspicious indicator guide for retailers, and online
training materials from the chemical security website. Managers also placed the suspicious indicator
guide for retailers in the breakout area.
As part of its periodic stock-take process, managers asked staff to note all products containing
chemicals of security concern at the concentration levels set out in the Code. This information was
included in the inventory control plan, allowing adjustments to the electronic sale procedures. This
meant that sales of products containing chemicals of security concern were flagged electronically,
serving as a reminder for front counter staff to pay attention to any suspicious behaviour during the
transaction.
Managers also implemented a quarterly physical stock-take. Part of the stock-take included
comparing the stock numbers to sales records to see if there were any unexplained stock losses. In
this event, staff was required to record and then report the loss to the National Security Hotline.
In order to address the risk of chemical theft or diversion, products containing chemicals and that
could be easily stolen were placed directly opposite the checkout counter. This meant that staff
could easily see the products. Staff was informed about the new policy to keep these products in
view from the checkout counter, and were asked to keep a close eye on the products.
So, what do you think?
Chemicals of security concern awareness course
Module three
40
Hardware & Paint Pty Ltd have put a number of practical and effective measures in place. You can
see that these are not complicated, and they address the specific risks that managers identified.
More information and guidance material about how your business can apply these measures is
available here.
Point-of-sale procedures
There are a number of things that you can do to ensure that chemicals of security concern do not fall
into the wrong hands.
Effective point-of-sale procedures are a practical security step you can take to prevent the sale of
chemicals to customers who intend to misuse them.
Effective point-of-sale processes and procedures can include:
 keeping chemicals behind a suitable barrier, or within view from the counter
 always asking customers what they intend to use the chemical for
 refusing cash sales – only accepting payments in the form of a credit or debit card and
keeping appropriate records of these sales
 only selling chemicals to customers who can prove their identity, including asking individuals
to show identification and in the case of businesses – producing their Australian Business
Number or Australian Corporation Number, and
 being aware of the indicators of suspicious behaviour during transactions.
Specific point-of-sales procedures will be developed by your employer. You will need to implement
these procedures and practices, and support your employer in ensuring that they are adhered to.
Training is critical to developing your knowledge and skills, including how to check that a customer is
legitimate, and has a legitimate reason to purchase the chemicals. In addition to being familiar with
the point-of-sale procedures, training can also help you refine your ability to detect suspicious
transactions.
The insider threat
In addition to being aware of suspicious customer behaviour, you also need to be aware or
suspicious behaviour within the business. This type of ‘insider threat’ is commonly referred to as a
‘malicious trusted insider’. This is a current or former employee in your business who actively seeks,
or is convinced by others to do harm.
Insider activities can include such things as unauthorised disclosure of information, enabling
unauthorised people to access chemical storage areas or aiding chemical theft. Whatever their
motivation, a malicious insider is a real threat.
The chemicals of security concern website has an excellent fact sheet, ‘The Trusted Insider’ that
contains additional information on this subject. You can access it here.
The case study below describes how Ellie, a front-counter employee at a pool company, deals with a
security incident.
Chemicals of security concern awareness course
Module three
41
Case study: Ellie and the customer
“Hi Paul – can I come in? I hope I’m not disturbing you,” says Ellie.
”Hey, Ellie, no problems, come on in. What’s on your mind?” says Paul.
“Look, I really hope I’m doing the right thing here. I’ve just had a customer come in and he was, well,
acting really strange. He came up to the counter and just asked me how easy it would be to buy
hydrogen peroxide, and whether we could sell it to him in bulk. He wanted to know about our point
of sale procedures. He was talking about buying 15 litres, and wanted to know what the strongest
concentration was that we stocked. He seemed really nervous. When I asked him why he wanted so
much he got really defensive, you know. He got really snappy. I asked him a couple more questions,
and then he turned around and walked out,” says Ellie.
”What did this guy look like, Ellie? Did you get his name?” asks Paul.
“No, he didn’t give me his name. He just asked about the chemicals, and then got really snappy. I
told him that we wouldn’t be able to sell them to him in bulk, and asked him why he wanted so
much. He looked really upset and he just stormed off. I wrote down what he looked like – here it is,”
says Ellie.
“Hey, well done Ellie. What’s this? Is this a car registration?” asks Paul.
”Yes,” says Ellie. ”He was parked just outside so I could see his car really clearly. Man, he took off
really quickly! Paul, I hope what I’ve done is okay. I mean I don’t want to create any trouble or
anything, only this is the sort of thing we covered in the security training. It just didn’t feel right, if
you know what I mean. In the training they did say to report anything that didn’t feel right.”
”Relax Ellie. You’re absolutely correct, and you’ve done the right thing,” says Paul. “From what
you’ve told me this is not normal behavior; it’s suspicious behavior.”
”Thanks Paul – so what do we do now?” asks Ellie. ”Let’s go over this one more time,” says Paul.
”Once we’ve done that, we’ll make a phone call to the National Security Hotline.”
”Yes, I think that’s the best thing too. Thanks Paul,” says Ellie. “No worries – now let’s go over your
notes here.”
Ellie has done an excellent job. She has been involved in an incident and has used her training in
personnel security awareness – and her good judgment – to report the incident to her boss.
So, how was Ellie able to spot the suspicious behaviour? How did she know what to report? The next
section will focus on the important areas of identifying suspicious behaviours and reporting.
Chemicals of security concern awareness course
Module three
42
Suspicious behaviours
One of the most important things that you can do to ensure your business’s chemicals are secure is
to be alert. If you suspect it, report it.
Knowing your customer is an important tool for preventing chemical theft and diversion. This means
verifying your customers’ legitimacy.
Suspicious behaviour is defined as any behavior that does not feel or seem right. This means
anything that raises your suspicions. Like Ellie, you should trust your intuition!
There are guides at appendices D and E of the Code that are designed to help you identify and report
suspicious transactions. These guides should be included within your company’s induction and
ongoing security training. And, it is worth placing copies of them at your front counter or cash
register area.
Broadly speaking, suspicious behaviours may include:
 insistence on paying in cash
 unusual mannerisms, including hesitating when asked for identification to complete a sale
 little knowledge about the product requested, or displaying little knowledge about the
product’s usual uses and application
 insistence on certain products and not accepting other reasonable suggestions, and
 a lack of familiarity with chemical products, in general.
When a customer enquires about a product that contains a chemical precursor to a home-made
explosive, that is, one of the 11 high-risk chemicals discussed earlier, you should consider the
following.
Firstly: observe the customer.
 Are they nervous?
 Are they asking to purchase a large amount of chemical product?
 Do they want to pay cash?
 Do they seem unwilling to pay by credit or debit card, cheque, bank transfer or account?
Remember, that customers may display one or more suspicious indicators.
Ellie’s customer appeared very nervous, and was after a very large amount of chemicals. In this
situation, two indicators were observed.
If the customer displays one or more of these indicators you should ask the following questions:
 Why do you want this product?
 Do you know how to use this product?
At this point, your conversational tone should be casual. It is important not to scare or alert your
customer. By staying calm and casual, you will be able to discern whether the request, including the
chemical concentration and quantity, is appropriate for the proposed use.
Chemicals of security concern awareness course
Module three
43
Like Ellie, you need to be alert to customer nervousness, including overall body language and
reaction to your questions. Most importantly, you need to discern whether their story makes sense.
If something doesn’t feel right, speak with your immediate supervisor or manager. They can help,
including providing reassurance and advice about practical next steps.
If your suspicions are allayed, and you decide it is safe to proceed with the sale, make sure that the
products are paid for by credit or debit card, cheque, bank transfer or account – not cash.
Regardless of whether the sale proceeds or not, note the exchange with your customer as soon as
possible, covering the following areas:
 the product being sought
 the quantity of the product being sought
 the proposed method of payment
 the actual method of payment (if applicable)
 the behaviour and/or circumstances that made you suspicious
 products that the customer touched in the store
 the vehicle driven by the customer
 the form of identification produced by the customer
 a detailed physical description of the individual or individuals concerned, and
 anything else that struck you as out of the ordinary or suspicious.
Every little detail helps. Always take the time to note your observations and the situation.
Reporting to the National Security Hotline on 1800 123 400 or [email protected]
is appropriate in all incidents of suspicious behaviour.
Reporting
Module one highlighted the importance of reporting all incidents of suspicious behaviour to the
National Security Hotline via phone on 1800 123 400 or email at [email protected]
Reporting also relates to discussing your suspicions with your immediate supervisor or manager. It’s
important to have an open conversation about your experience, including your observations of what
happened. Be clear about why your suspicions were raised.
Outline the facts, refer to your records and notes describing the situation, and explain why you think
that the behaviour was suspicious.
Raising these issues with your manager is not ‘silly’ or an overreaction, nor is it a waste of time.
Reporting suspicious behaviour is an appropriate response, which helps to keep your business’s
chemicals secure. Remember – if you suspect it, report it.
Chemicals of security concern awareness course
Module three
44
Difficult customers
As a frontline member of staff, there are times when you will encounter customers who are upset or
aggressive, including towards you. This could happen during a point-of-sale identity check or while
you’re validating the proposed use of the chemical being purchased.
It is important to remember that conducting these checks is a vital part of your job. Pointing this out
to an irritated customer can help reduce tension and discomfort, and can defuse the situation. Be
clear about your role with the customer. Let them know that it is your business’s policy to ask
questions about customers’ identity and intended chemical use. Assure them that every customer is
treated the same way.
Remember to always be polite, but firm. If a customer becomes aggressive towards you, stay calm
and stay in control of the process. Do not let your customer’s aggression distract you from the
process. Do not let them dictate what is going to happen.
Where appropriate, ask for your supervisor or manager’s assistance. It may be helpful to ask them to
reinforce the procedure for the customer.
Aggressive behaviour may come from a legitimate customer or a customer who is attempting to
purchase chemicals for less legitimate purposes. Following the established procedures, and taking
notes for reporting purposes, will help you deal with the situation appropriately.
Dealing with aggressive and difficult customers is never pleasant. If an incident is unduly stressful,
you should discuss it with your supervisor and /or work colleagues.
Key concepts summary
Module three reiterates the importance of the Code, and highlights the real and present threat of
homemade explosives. The Code defines 96 chemicals of security concern, of which 11 are classified
as high-risk because they can be used to make homemade explosives. The Code applies to all
businesses that manufacture, store, transport or sell any of the 11 designated high-risk chemicals.
In the retail industry, chemical security awareness is vitally important. There are practical steps you
can take to ensure that chemicals of security concern are kept out of the wrong hands, including
physical access measures, inventory control measures and point-of-sale procedures.
You can also develop better security awareness by making time to consider the risks associated with
chemicals on your premises. When everyone takes responsibility for chemical security, your business
has an effective ‘security culture’. Everyone has a role to play in keeping chemicals secure.
While there are a number of security measures that you can take in the retail industry to keep
chemicals safe, point-of-sale procedures are particularly relevant for frontline staff. There are a
number of effective, but simple and practical measures that you can put in place to address the
specific risks and vulnerabilities. These include being aware of the indicators of suspicious behaviour
during transactions, refusing cash sales and relocating chemicals of security concern where you can
see them.
There is a range of suspicious behaviour that you need to look out for, including insistence on paying
cash and reluctance to provide proof of identification. Suspicious behaviour and security incidents
need to be reported to the National Security Hotline. You should also seek advice and guidance from
your supervisor or manager, where appropriate.
Sometimes, as frontline staff, you will need to deal with difficult or aggressive customers. Always be
polite, but firm, and follow your company’s established procedures. Make sure you take notes about
the situation, and if necessary, involve your manager.
Chemicals of security concern awareness course
Module three
45
Additional resources and information is available via websites provided in module one, notably, the
chemicals of security concern website available here. This is an excellent website with a number of
practical and easy-to-use guides, as well as links to more information sources.
The case study below highlights the importance of being alert to suspicious indicators, making use of
your supervisor, and reporting a suspicious incident.
Case study
Once you have reviewed the case study, proceed to the brain teasers.
Sophie is the owner of Salon Sophie, a large hairdressing salon in the outer city suburbs. She is the
owner and manager of the business and by all reports is a very smart boss.
Sophie recently trained all her staff in respect of the Code of Practice for Chemicals of Security
Concern, with a particular focus on how to recognise suspicious behaviour during sales, to ensure
appropriate personnel security awareness.
She has also put some practical measures in place to ensure chemicals within the shop are stored
safely. This includes purchasing a new lockable cabinet to house the hydrogen peroxide, and limiting
control of the keys to the cabinet to herself.
It’s lunchtime on Saturday and the salon will soon close. Sophie asks Chrissie, one of the senior
hairdressers to start closing up. While Chrissie is at the front counter attending to the register, a
young couple walks in. The man looks around the front of the salon, while the young woman makes
conversation with Chrissie.
“Can I get some hydrogen peroxide please?” she says.
Chrissie asks the young lady how much she wants to buy.
“I want two litres please – and make it the 30 per cent and not the 3 per cent concentration please.
Is that okay?”
Chrissie knows that the 30 per cent solution is kept in the lockable cabinet in the store room, and
she recalls her recent training. She says:
“I have to get my manager for that. Firstly can I ask why you need that much?”
The couple looks at each other and the young man spits out, very angrily: “Look, we need to clean
our pool. The 30 per cent works much better than 3 per cent, okay?”
Chrissie is taken aback by his anger, and thinks that the request, together with his body language
adds up to some very suspicious behaviour. She tells the couple that a pool cleaning supplies shop is
around the corner, and asks if they had been there.
The young man says: “The pool shop does not have a 30 per cent solution available - in any case, it’s
not really any of your business. Just make the sale.”
Chrissie notes that the couple won’t make eye contact with her, and that the woman seems to be
extremely nervous.
Drawing on her recent training, Chrissie asks how the couple wishes to pay for the chemical. She
politely informs them that Salon Sophie’s payment policy for all transactions of this type must be
Chemicals of security concern awareness course
Module three
46
done using a credit or debit card. She also asks the couple for proof of identity politely pointing out
that this is also store policy to have sale and distribution procedures in place
“This is rubbish,” says the young man. “What right do you think you have? That’s a breach of our
privacy. We’re paying cash. Now give us the two litres and stop mucking us around!”
Sophie comes to the counter just as Chrissie is explaining that she has to follow store policy, and
what she recently learned at her training. Sophie joins the conversation, agreeing with Chrissie.
“Hi. I’m the owner here. It is a requirement when purchasing this chemical that a credit or debit card
is provided for payment, along with your identification. My colleague has given you the correct
advice.”
The young man promptly grabs the woman by the arm, and they turn and leave the salon without
another word. Chrissie and Sophie watch them hurriedly walk out of sight.
Sophie and Chrissie take a few minutes to write a detailed account of what occurred, including
physical descriptions of the couple, and talk about what they each heard and saw. Sophie also
spends a few minutes with Chrissie reassuring her she had done the right thing. Sophie and Chrissie
both agree that they should call the National Security Hotline and Sophie helps Chrissie make the
call.
Over a glass of wine later that evening, Chrissie reflects on the incident. She concludes that she is
comfortable with the decisions that she made, and firmly believes the couple’s behaviour was
suspicious. She reflects on how well Sophie supported her.
Chrissie is absolutely certain that she did the right thing - by her boss, her business and herself.
Brain teasers
The following questions are based on the above case study. Take your time to read the questions,
and choose the most appropriate response.
Q1. The couple’s suspicious behaviours included:
a. Refusing to listen.
b. Refusing to pay with a credit or debit card and refusing to provide identification.
c. Refusing to pay with a credit or debit card, refusing to provide identification, and verbal and
non-verbal indicators.
Answers:
a. Not quite. Refusing to listen is not, in itself, an indicator of suspicious behaviour. Try again.
b. Almost. The couple did refuse to pay with a credit or debit card, and refused to provide
identification, however there were other indicators at play. Try again.
c. Correct! The couple certainly did refuse to pay with a credit or debit card and refused to
provide identification. In addition, they displayed a range of suspicious non-verbal and
verbal behaviours, including the nervousness of the young woman, refusing to make eye
contact with Chrissie, and the aggressive attitude of the young man.
Chemicals of security concern awareness course
Module three
47
Q2. As part of improving security for her business, Sophie trained her staff and ensured all
chemicals were secured in a lockable cabinet. What type of security measures has Sophie
put in place? Choose the most appropriate response.
a. Personnel security awareness, physical access measures and personnel access measures.
b. Receipt of chemicals and inventory control measures.
c. Employee and contractor checking and physical access measures.
Answers:
a. Correct! By training her staff, Sophie has heightened awareness of the need for security, and
simultaneously implemented a personnel security awareness measure. By ensuring
chemicals are locked away, and restricting her staff access to the cabinet, Sophie has
implemented both physical access and personnel access measures. Well done!
b. No - these measures are not present. Try again
c. Almost. Sophie has put in place physical access measures through the new lockable cabinet,
but she has not put in place any employee or contractor checking measures. Try again.
Q3. Sophie and Chrissie made notes of the incident, and reported it to the National Security
Hotline. What information did they ensure was included in their notes?
Choose the most appropriate response.
a. A physical description of the couple, what they wanted to buy and when they left.
b. A physical sketch of the couple.
c. A physical description of the couple, what they wanted to buy, the amount requested, how
they wanted to pay and what made the incident suspicious.
Answers:
a. Almost. These details are important, but there is additional information that should be
recorded in any notes that you take for reporting purposes. Try again.
b. A sketch might be handy but there is a range of other additional and important information
that should be recorded in any notes that you take for reporting purpose. Try again
c. Correct. These details are all important. Physical descriptions, what chemical was requested
for purchase, the chemical quantity and the preferred method of payment should all be
included in your notes. You should also include the indicators that made the situation
suspicious, such as whether the individuals touched anything in the store. If applicable, you
should also record what type of vehicle the individual/s were driving and whether you
sighted any identification. Remember, every piece of information helps.
Chemicals of security concern awareness course
Module three
48
Module Four – applying the Code to the transport industry
Contents
Overview
Revising the threat
Being security aware
Security at the depot, yard and loading dock
Delivering and transporting chemicals
Security en route
Suspicious behaviours
Reporting
Key concepts summary
Case study
Brain teasers
Overview
People who work within the transport industry – you – play a very important role in keeping
chemicals secure. To do this effectively, it is important that you understand the threat that stolen or
misappropriated chemicals present, especially if they fall into terrorist hands.
By the end of this module, you will:
 understand how the Code applies to the transport industry
 be able to identify indicators of suspicious behaviour when transporting and delivering
chemicals
 know the steps you should take to ensure chemical security – and your personal security –
when transporting and delivering chemicals, and
 know when and how to report suspicious behaviour or an incident.
Revising the threat
Module one provides background information about the National Code of Practice for Chemicals of
Security Concern (the Code). The Code defines 96 chemicals of security concern, of which 11 are
classified as high risk because they can be used to make homemade explosives. The Code applies to
all businesses that manufacture, store, transport or sell any of the 11 designated high-risk chemicals.
You can access the Code via this link.
You can review the table listing the 11 high-risk chemicals and their concentration levels via this
hyperlink.
If these chemicals are misappropriated by criminal or terrorist groups, the results can be
catastrophic. This section explores where individuals can access information about the using
chemicals to manufacture homemade explosives.
Chemical of security concern awareness course
Module four
49
Firstly, did you know that there are websites that relate to the manufacture of homemade or
improvised explosive devices? Experts believe that there are hundreds, if not, thousands of these
sites providing information about how to make explosives. Although this information is potentially
dangerous, it is not classified. Law enforcement agencies and governments actively monitor these
sites.
Recipes for making homemade explosives have existed for many years and pre-date the internet. In
the 1960s and 1970s there were many improvised explosive recipes in circulation, but these came
from limited and isolated sources often described as ‘anarchist literature’. People had to actively
search for this type of information; it wasn’t readily accessible. However, with the advent of the
internet, explosives recipes have become accessible to everyone with a computer and a modem.
It’s extremely difficult to control these sites and the information they publish. According to some, it
is actually impossible. As a result, efforts to keep chemicals secure need to focus on aspects that can
be controlled. This includes restricting and controlling vital chemical precursors that are required to
make homemade explosives.
The examples below highlight the importance of restricting access to chemical precursors.
The 2005 terrorist attacks on London’s underground trains and a double-decker bus were carried out
using homemade bombs made from small quantities of chemicals such as hydrogen peroxide.
Hydrogen peroxide can be bought from retail stores. Fifty-two people were killed and many were
severely injured.
The 2013 Boston marathon bombing and 2002 Bali bombing also highlight the explosive power of
small quantities of chemicals, and the need to keep chemicals secure. In the Bali incident, forensic
examination revealed that the vehicle bomb used by Jemiah Islamiah was manufactured from a
mixture of extremely volatile chemicals. Investigators concluded that the group was able to
manufacture such a device because these chemicals were readily available to them.
More information on this topic is available here on the chemicals of security concern website.
Being security aware
Being security aware is about dedicating time to consider the risks surrounding chemicals of security
concern at your business, and applying that knowledge to your daily work. Being security aware in
this way reduces chemical security risks for your business.
All staff members are responsible for noticing what occurs in your workplace, including when
something does not seem right. In your specific work area, you are the person ‘on the spot’ who can
best identify areas where security measures could be improved. For example, you may notice the
need for new locks on access gates because keys have gone missing. Part of your role is to also bring
these issues to your manager’s attention.
Businesses where everyone takes responsibility for security have a ‘security culture’. In this
environment, everyone understands the need for security, implements good risk management
practices, deals with security incidents as they occur and reports all suspicious incidents. A good
security culture also means that risk management is regularly reviewed to identify emerging security
loopholes, and they are addressed in a timely manner. Everyone plays a part.
You can increase your security awareness by:
 identifying which chemicals your business transports that have the potential to be used for
homemade explosives
Chemical of security concern awareness course
Module four
50
 understanding the legitimate uses for chemical products that you transport and deliver,
including their recommended quantities
 being alert to the indicators of inside threat activities, for example, co-workers who work
extra hours and find ways to be left alone at work, access restricted areas, or seek out
information that is outside their usual responsibilities
 ensuring your business has adequate inventory control mechanisms, processes and
procedures in place that prevent or detect chemical theft or diversion
 recognising the importance of reporting suspicious behaviour to the National Security
Hotline on 1800 1234 00, and
 understanding the indicators of suspicious behaviour.
Undertaking this course will also help you build your security awareness.
Security at the depot, yard and loading dock
In addition to vehicles being hijacked during transit, there is a risk that terrorists could try to access
chemicals before they are transported – that is, at the depot, loading dock or warehouse. Good
security management for chemicals in storage is just as important as securing chemicals while they
are in transit.
There are a number of steps that your business can take to stop unauthorised people gaining access
to areas where chemicals are stored. Locking chemicals away and restricting access to them are two
measures that will help prevent chemicals being stolen from your workplace.
You can do your bit to make sure these ‘physical access controls’ work by ensuring that:
 signage such as ‘no entry’ and ‘staff only’ is clearly visible, particularly at storage and
warehouse areas
 all unescorted visitors do not have access to stock rooms, storage and warehouse areas
 visitor access is restricted, and that you enforce sign-in procedures
 you use the locks on exterior and interior doors, and that gates, windows and other entry
points are secured
 you and your colleagues wear photo identification badges, and
 electronic access control systems and video surveillance cameras are used, particularly after
hours.
Chemical of security concern awareness course
Module four
51
You should be familiar with the processes and policies of your business regarding chemical storage,
and the physical access controls that are in place at your depot, warehouse or yard.
The physical access measures adopted at your workplace must be proportionate to the risks that it
faces. In other words, they need to be tailored to the specific risks associated with your business.
This ensures that measures are appropriate to the context and environment the business operates
in. If measures are restrictive or interfere with business operations, they may be counter-productive.
For example, having a series of locked gates that need to be accessed in order to get into the yard
might be great security, but if this makes accessing the yard difficult and time-consuming for staff,
they are unlikely to adopt the measure, and security suffers.
Delivering and transporting chemicals
The Code aims to reduce security risk within individual businesses, offering a range of security
measures that could be applied to help keep chemicals out of the wrong hands. A number of these
apply to the transport sector.
It’s important to note that security is everyone’s responsibility – not just management. You have a
key role to play in ensuring chemicals are secure both at your workplace, and while they are being
transported.
There are a number of things that you can do to ensure that chemicals of security concern do not fall
into the wrong hands and become misused. One way to reduce this risk is to ensure good physical
security practices at the depot, warehouse and loading dock. Just as important, is implementing
security measures when transporting chemicals of security concern.
Below is an example of how a small transport company has put effective security practices in place.
Carlson’s Couriers is a small transport company that, from time-to-time, transports some of the 11
precursor chemicals. While delivering these chemicals is only a small part of its business, Carlson’s
Couriers can’t afford to spend a great deal of money on implementing new security processes and
equipment.
As such, Carlson’s choose to examine its current chemical security approach, including identifying
weak points, and steps it can take to mitigate and treat any of the identified risks.
Following its risk assessment, Carlson’s decide that better employee checks need to be conducted,
including recording a minimum of two forms of driver identification to ensure proper employee
screening. By doing this, Carlson’s Couriers hopes to reduce the potential for insider theft or illegal
activity.
Further, staff must now complete a brief training course when they begin working for Carlson’s so
they are familiar with personnel security awareness. This induction course aims to raise awareness
of the importance of the Code and the national security risks that chemicals pose, as well as the
practical steps businesses can take to secure chemicals. This is an effective, but fairly low-cost
measure.
Chemical of security concern awareness course
Module four
52
Carlson’s Couriers’ management also put in place new security procedures at the depot, and hold
brief training sessions for drivers and depot staff which outline the procedures for transporting
chemicals of security concern . The new security procedures include:
 limiting access to the secure area where chemicals are held, and to the loading dock
 requiring visitors to be ‘signed in’ at the office and escorted by someone from Carlson’s
staff at all times is an example of implementing physical access controls
 encouraging staff to challenge people on the premises who are without an escort
 ensuring that drivers do not deliver packages unless they receive a signature and sight a
form of identification from the recipient, shows robust delivery verification processes and
 requiring all staff to report incidents involving suspicious behaviour immediately to senior
management, who will investigate the matter and make a report to the National Security
Hotline.
Carlson’s Couriers have put in place a range of simple, but effective measures, including security
awareness training, employee screening, physical access controls and robust delivery verification
processes.
There are specific vulnerabilities for businesses and people who transport chemicals. These include
chemicals being accidentally delivered to people who intend to misuse them, as well as chemicals
being stolen by terrorists or associates during transportation. Transport businesses may be
vulnerable to chemicals being hijacked en route.
There are a number of ways to reduce the risks associated with transporting chemicals, including:
 having loading and unloading security procedures, including never leaving chemicals
unattended
 having systems in place to monitor the location of vehicles during transportation such as
GPS tracking systems
 enforcing procedures that ensure vehicles carrying chemicals are not left unattended while
in transit
 securing loads and ensuring these are delivered with seals, locks and packaging intact
 using weight measurement processes when unloading to ensure there has been no
tampering
 only delivering chemicals to a nominated recipient and verifying that recipient’s identity by
sighting and recording a valid form of identification, and
 ensuring that all chemicals are locked away upon receipt, and prior to transporting to next
location.
Your employer should have effective and practical risk treatments in place that incorporate the
above points. It should also have policies and procedures in place to prevent the theft of chemicals
when in transit. You should familiarise yourself with these processes and policies.
Chemical of security concern awareness course
Module four
53
Security en route
We have established that one of the unique risks of transporting chemicals is the potential for
hijacking or stealing chemicals while they are being transported from one location to another.
While the chance of this happening is probably unlikely, it makes good sense to take proactive steps
to reduce the risk of an incident.
Your employer should have in place similar proactive measures to those adopted by Carlson’s
Couriers. These will help prevent chemicals being misappropriated while in transit. Security en route
measures may include:
 employee and contractor screening and background checks
 sound physical access measures, including the use of high quality locks on vehicle cargo
doors
 tracking devices, such as a Global Positioning system (GPS) to monitor the progress and
location of vehicles, and
 training sessions about security measures for all staff, including the requirements of the
Code and identifying suspicious behaviours.
There are also some simple steps you can take to ensure the security of yourself, your vehicle and
your cargo when transporting chemicals of security concern. These include:
 knowing your cargo
 knowing your destination routes, including alternative routes
 unlocking the truck for the shortest time possible when stopped to rest, eat or make the
delivery
 keeping cabin doors locked while travelling in slow-moving traffic or while parked
 on long trips, only stop in designated rest areas where there are other trucks parked
 never picking up hitchhikers or other unauthorised people
 when making a delivery, never leaving cargo unattended on the street – even for a minute or
two
 knowing your contact procedures and having the contact numbers on hand
 being aware of your surroundings, and alert to suspicious behaviours, including other
vehicles following you for a prolonged period of time, and
 always reporting anything that you believe is suspicious.
There may be cases where transporting chemicals of security concern falls under the Australian
Dangerous Goods Code. Please note that if there is any inconsistency between the Australian
Dangerous Goods Code and the National Code of Practice for Chemicals of Security Concern, the
Australian Dangerous Goods Code takes precedence.
Both Codes should be examined and processes put in place to ensure the safety of personnel
transporting chemicals, and the security of the chemical being transported.
Suspicious behaviour and the indicators of suspicious behaviour are detailed below.
Chemical of security concern awareness course
Module four
54
Suspicious behaviours
One of the most important things that you can do to ensure that your business’s chemicals are
secure is to keep alert. If you suspect it, report it.
Knowing your customer is an important tool for preventing chemical theft and diversion. This means
verifying the legitimacy of your delivery recipient.
Suspicious behaviour is defined as any behaviour that does not feel or seem right. This means
anything that raises your suspicions – you should trust your intuition here!
When you’re on the road, you need to stay alert to anything suspicious, and you need to be familiar
with the steps you can take to keep your chemicals safe. You also need to be equally alert to
suspicious behaviour when you are delivering your cargo. In particular, you need to focus on your
delivery address and the legitimacy of the business or person to whom you are signing over your
chemicals.
Ask yourself the following questions to ascertain whether there are any suspicious indicators:
 Is the load I’m carrying being delivered from business to consumer, rather than business to
business?
 Is the load being delivered to a consumer that I or my business does not know?
 Is the amount ordered different from usual orders? (For example, is it a very large order?)
 Is the delivery address suspicious? (For example, is a commercial quantity of chemicals being
delivered to a residential address?)
 Has anyone shown an unusual degree of interest in the route schedule or security
arrangements? (For example, is an insider or another person more interested than they
need to be?)
 Has anyone shown an unusual degree of interest in the truck while it’s being loaded or
unloaded? (This may be an insider or another person).
These questions are intended to help you identify any suspicious indicators. Verifying the identity of
the person you’re delivering (i.e. the customer or recipient) to is very important.
When delivering the chemicals to the recipient, consider the following:
 What chemicals are they receiving?
 What chemical quantities are they receiving?
 What identification are they using?
 Do they appear nervous?
 Is there anything that strikes you as unusual or suspicious?
Chemical of security concern awareness course
Module four
55
Be alert to any indicators of nervousness, including the recipient’s overall body language. Listen to
what they say, and how they say it. Ask yourself if their story make sense. If something doesn’t feel
right, it probably isn’t!
Remember, every little detail helps, so take the time to record of your observations, including:
 what the recipient looked like
 what the recipient was receiving
 the chemical quantity received by the recipient
 what made the delivery suspicious, including details of your conversation with the recipient
 the delivery address
 any notable vehicle details (if applicable), and
 the type of identification used by the recipient.
Reporting
Module one highlighted the importance of reporting all incidents of suspicious behaviour to the
National Security Hotline via phone on 1800 123 400 or email at [email protected]
If you have any doubts about an incident that you believe is suspicious, discuss your suspicions with
your immediate supervisor or manager. It’s important to have an open conversation about your
experience, including your observations of what occurred. Be clear about why your suspicions were
raised.
Outline the facts, refer to your records and notes describing the situation, and explain why you think
the behaviour was suspicious.
Raising these issues with your manager is not being ‘silly’ or an overreaction, nor is it a waste of
time. Reporting suspicious behaviour is an appropriate response, which helps to keep your
business’s chemicals secure. Remember – if you suspect it, report it.
Key concepts summary
Module four reiterates the real and present threat of homemade explosives and the role that
precursor chemicals play.
It examines the importance of security awareness to the transport industry and identifies practical
steps for ensuring that chemicals of security concern are kept out of the wrong hands. In particular,
this includes securing chemicals within the depot, yard or warehouse environments.
There are practical steps that you can take to develop better security awareness, including
identifying which chemicals you transport that have the potential to be used for homemade
explosives and being alert to the indicators of insider threat activities.
Taking responsibility for security builds a ‘security culture’. This is when everyone understands the
need for security, implements good risk management practices, and deals with security incidents as
they occur, including reporting them. Security measures must be appropriate to the context and
environment your business operates in. They should be reasonable and practical, including cost
effective.
There are a number of simple steps you can take to ensure the security of chemicals in transit. These
include having systems in place to monitor the location of travelling vehicles, having loading and
Chemical of security concern awareness course
Module four
56
unloading security procedures in place and never leaving chemicals unattended. These help to keep
both yourself and the cargo safe and secure.
Suspicious behaviour is defined as anything that does not feel or seem right. Some indicators of
suspicious behavior include people showing an unusual or high level of interest in your delivery and
orders that are higher in chemical quantity than usual. It is important to report these incidents to the
National Security Hotline, and to seek advice and guidance from a supervisor or manager, when
appropriate.
More information and resources are provided in module one. You can also refer to the chemicals of
security concern website here for factsheets and further information.
The case study below highlights the importance of being alert to suspicious indicators.
Case study
Once you have reviewed the case study, proceed to the brain teasers.
Phil is a driver for Major’s Transport Australia, a company that moves hazardous materials around
the country and has depots in every state. Phil has just arrived at work and is approached by Tom, a
mate and another driver.
“Hey mate – have you heard what is happening? The boss is going to track us with some new GPS
system. He obviously doesn’t trust us. Probably wants to keep a track on how many breaks we have
or something - it’s bloody ridiculous.
“Really? What’s it all about?” says Phil. “Seems a bit over the top. I wonder what the reason is.”
“They just don’t trust us,” says Tom. “Everyone’s upset. Someone should do something about it,”
“Yeah, well maybe I’ll have a word with Steve,” says Phil. “He is a good bloke, and I’m sure he’ll be
able to give us the low down on what’s going on.” Phil grabs his coffee and goes into the shift
supervisor’ office.
“G’day Steve,” says Phil. “Have you got a minute?”
“Sure mate, what can I do for you?” says Steve.
”I decided I’d come ask about this GPS system that apparently is going on all the vehicles. What’s the
story there? Why is this happening?”
Steve smiles. “It’s nothing to worry about mate. We recently did a risk review of all the depots
because of the chemicals that we are now carrying; there’s a real risk that the chemicals we are
transporting might be taken or stolen, so we need to beef up our security. The first part of this is
increasing the depot security measures –the new signs and lights at the front gate”
“Yes – they were a good idea and probably long overdue,” says Phil.
“Well, the second part of the new security arrangements is a training program for all drivers about
the new Code of Practice, and the practical steps they can take to stay safe when they are
transporting these chemicals. It’s about increasing security for the drivers as well as for the loads
we’re transporting,” says Steve.
“So, part of that will be to put GPS trackers in all the trucks?” asks Phil.
Chemical of security concern awareness course
Module four
57
“Yes - in some of them,” says Steve. “They’re pretty expensive so we are only putting trackers in the
vehicles that are going to be used to transport the chemicals. It’s about driver safety too - it goes
hand-in-hand with the training, and some other measures that we are putting in place to secure the
depots. Some of the chemicals that we store and transport need to be kept out of the wrong hands –
it’s really as simple as that. You’ll learn some more about the chemicals and what we are going to do
to keep them secure at the training sessions.”
“Okay Steve - thanks for filling me in. I’ll let the others know.”
“Thanks – grateful if you would, and please let them know about the training,” says Steve.
Steve picks up his coffee cup and heads back to the kitchen to chat with Tom…
Brain teasers
The following questions are based on the above case study. Take your time to read the questions,
and choose the most appropriate response.
Q1. In the case study, the security measures that Steve has put in place are:
a. Physical access controls.
b. Physical access controls, security awareness training and monitoring the location of vehicles.
c. Physical access controls and checking identification of drivers.
Answers:
a. Not quite. Steve has put in place new signage and lights at the gate, but this is not all. Try
again.
b. Correct. Steve has put in place new signage and lights at the gate, which are examples of
physical access controls. He has also implemented training for drivers, which is an example
of security awareness training procedures. And, the new GPS devices in vehicles will be used
to safeguard the delivery of chemicals.
c. Not quite. Steve has put in place new signage and lights, which are examples of physical
access controls, but employee screening isn’t an issue. Try again.
Q2. In the case study, Steve tells Phil that only some trucks will be fitted with GPS devices.
What can Steve do to ensure that the trucks with GPS devices are always used when
drivers are required to transport chemicals?
a. Put in place new processes and procedures, and ensure that all drivers are trained in these.
b. Put in place new processes and procedures.
c. Put a notice on the staff notice board.
Answers:
a. Correct. To ensure that the GPS device vehicles are used as part of company security
measures, new processes and procedures should be written and this should feature in the
security awareness training for all drivers.
Chemical of security concern awareness course
Module four
58
b. Not quite. New processes and procedures are required, but these are ineffective without
security awareness training. Try again.
c. This is not an effective measure on its own – try again.
Q3. In this module, we looked at some of the simple steps you can take when transporting
chemicals or products that contain chemicals of security concern. Examine the choices
below, and identify the statement that is incorrect.
a. When en route and carrying a cargo of chemicals or chemical products you should be alert
and report anything suspicious.
b. When delivering chemicals or chemical products you should never leave your vehicle
unlocked and unattended.
c. When delivering chemicals or chemical products to a recipient, it is inappropriate to ask for
identification or their details.
d. When loading and unloading chemicals or chemical products you should be alert for
suspicious activity, including people taking an unusual interest in your activity.
Answers:
a. Correct. When you are en route, you should be alert and report anything suspicious. This
may include being followed by other vehicles, or unusual interest being shown by any
person regarding your cargo at any stops you may make along the way.
b. Absolutely. When delivering chemicals or chemical products, you should never leave your
vehicle unlocked and unattended – not even for a minute.
c. Incorrect. Knowing your customer is an important principle, and it is sound business practice
to ensure you know who you are delivering to. Asking for identification and noting their
details is sound security risk practice.
d. Correct. When loading and unloading chemicals or chemical products, you should always be
alert to suspicious activity, including people taking an unusual interest in your cargo, route
or delivery address.
Chemical of security concern awareness course
Module four
59
Module Five – applying the Code to laboratories in universities, health and industry
Contents
Overview
Revising the threat
Being security aware
Physical access and personnel access and inventory controls
Security measures
The University of XYZ
Your role
Suspicious behaviours
Reporting
Key concepts summary
Case study
Brain teasers
Overview
This module is for people who work within a laboratory setting - within a university or other tertiary
institution, a pathology laboratory – and regularly access and use chemicals as part of your role.
This module reinforces the serious threat that stolen or misappropriated chemicals of security
concern present. You have a very important role to play in preventing chemicals falling into terrorist
hands, and there are some simple steps that you can take to ensure this does not happen.
By the end of this module, you will:

understand how the Code applies to the laboratories and storage facilities

be able to identify indicators of suspicious behaviour when a colleague or student requests a
chemical of security concern or product containing a chemical precursor, and

know how and when to report suspicious behaviour or an incident.
Revising the threat
Module one provides background information about the National Code of Practice for Chemicals of
Security Concern (the Code). The Code defines 96 chemicals of security concern, of which 11 are
classified as high risk because they can be used to make homemade explosives. The Code applies to
all businesses that manufacture, store, transport or sell any of the 11 designated high-risk chemicals.
You can access the Code on the chemicals of security concern website here.
You can review the table listing the 11 high-risk chemicals and their concentration levels via this
hyperlink.
Chemicals of security concern awareness course
Module five
60
If these chemicals are misappropriated by criminal or terrorist groups, the results can be
catastrophic. This section explores where individuals can access information about chemicals to
manufacture homemade explosives.
Firstly, did you know that there are websites that relate to manufacturing homemade or improvised
explosive devices? Experts believe that there are hundreds, if not, thousands of these sites
providing information about how to make explosives. Although this information is potentially
dangerous, it is not classified. Law enforcement agencies and governments actively monitor these
sites.
Recipes for making homemade explosives have existed for many years and pre-date the internet. In
the 1960s and 1970s there were many improvised explosive recipes in circulation, but these came
from limited and isolated sources often described as ‘anarchist literature’. People had to actively
search for this type of information; it wasn’t readily accessible. However, with the advent of the
internet, explosives recipes have become accessible to everyone with a computer and a modem.
It’s extremely difficult to control these sites and the information they publish. According to some, it
is actually impossible.
As a result, efforts to keep chemicals secure need to focus on aspects that we can control. This
includes restricting and controlling vital chemical precursors that are required to make homemade
explosives.
The examples below highlight the importance of restricting access to chemical precursors.
The 2005 terrorist attacks on London’s underground trains and a double-decker bus were carried out
using homemade bombs made from small quantities of chemicals such as hydrogen peroxide.
Hydrogen peroxide can be bought from retail stores. Fifty-two people were killed and many were
severely injured.
The 2013 Boston marathon bombing and 2002 Bali bombing also highlight the explosive power of
small quantities of chemicals, and the need to keep chemicals secure. In the Bali incident forensic
examination revealed that the vehicle bomb used by Jemiah Islamiah was manufactured from a
mixture of extremely volatile chemicals. Investigators concluded that the group was able to
manufacture such a device because these chemicals were readily available to them.
More information on this topic is available on the chemicals of security concern website at
www.chemicalsecurity.gov.au
Being security aware
Being security aware is about dedicating time to consider the risks surrounding chemicals of security
concern at your institution or business, and applying this knowledge in your daily work. Being
security aware in this way reduces the chemical security risks to your business.
Being security aware is sound business practice and helps prevent security incidents within your
organisation. Security incidents have the potential to impact your organisation’s reputation and
credibility. It is important that everyone takes security awareness seriously.
Organisations where everyone takes responsibility for security have a ‘security culture’. In this
environment, everyone in your organisation fully understands the need for security, implements
good risk management practices, deals with security incidents as they occur and reports all
suspicious incidents.
Chemicals of security concern awareness course
Module five
61
A good security culture also means that risk management is regularly reviewed to identify emerging
security loopholes, and they are addressed in a timely manner. Everyone plays a part.
You can increase your own security awareness by:
 identifying which chemicals your area holds that have the potential to be used for
homemade explosives
 understanding the legitimate uses for chemical products that you store and use, including
the standard quantities required for specific tests and experiments
 being alert to the indicators of inside threat activities, for example, colleagues or students
who work odd hours and find ways to be left alone at work, access restricted areas, or seek
out information about chemicals that is outside their usual responsibilities
 ensuring your organisations complies with the inventory control mechanisms, processes and
procedures for chemicals held within your laboratory and storage areas
 recognising the importance of reporting suspicious behaviour to the National Security
Hotline on 1800 1234 00, and
 understanding the indicators of suspicious behaviour.
Training is also an important element in building a security culture and ensuring everyone is security
aware. By undertaking this course, you are developing your security awareness.
Physical access, personnel access and inventory controls
There are a number of practical measures you can take to stop unauthorised people from gaining
access to the chemicals stored in your laboratory. You should also know which chemicals and
volumes that students and technicians are using.
Securely locking chemicals away and restricting access to them are two pivotal measures that will
help prevent chemicals being stolen from your laboratory or storeroom.
These measures are called physical access, personnel access and inventory controls, and they
typically include:
 having effective signage, such as ‘no entry’ and ‘authorised staff only’ on storage rooms and
laboratory areas
 having secure laboratory and storage area access doors
 restricting unescorted visitors in the laboratory, and enforcing sign-in procedures for visitors,
where appropriate
 ensuring keys to lockable cabinets and secure areas are held by a designated person, and
there are not multiple copies of the keys
 using staff photo identification badges
 securing laboratory and storage area windows with appropriate grilles, mesh and locks and
 having electronic access control systems and video surveillance cameras in high traffic areas.
You should be familiar with the processes and policies of your institution, especially the access
controls and inventory controls relating to your chemical storage areas.
Chemicals of security concern awareness course
Module five
62
Supervisors must be alert to requests for chemicals at all times, and you should be able to identify
unusual usage. Being alert to unexplained purchasing requests or suspicious losses will ensure timely
and accurate reporting. Personnel access should also be part of your security measures. This can
include limiting the number of people who can purchase chemicals on behalf of your laboratory.
The measures that you adopt for your laboratory or storeroom area must be proportionate to the
security risks. Your security measures should address the specific vulnerabilities you identify. Do not
apply a ‘one size fits all’ approach.
A tailored approach ensures that the security measures you implement are appropriate to your
organisation’s context and environment. For example, having a supervisor in the laboratory at all
times might be an excellent security measure, but it is impractical. All staff needs to take breaks
during business hours.
Improving inventory control procedures is a very effective way to reduce security risks. This includes
actively monitoring your inventory to help you keep track of your stock.
Physical access, personnel access and inventory controls should not be restrictive or interfere with
business operations. If this happens, your security measures could be counter-productive. For
example, staff are unlikely to adopt measures that are difficult, impractical or time-consuming, and
security will suffer as a result.
The next section examines security measures in more detail. In the meantime, familiarise yourself
with the Code guidance note for laboratories here on the Universities Australia website at
www.universitiesaustralia.edu.au. This is an excellent source of information that will help you apply
the Code to your organisation.
Security measures for your environment
The Code aims to reduce security risk within individual institutions or businesses. It offers a range of
physical and personnel access controls that can help keep chemicals out of the wrong hands.
Good security risk management is about using multiple security measures to suit your specific needs.
The Code includes a range of recommended security measures that apply specifically to laboratories
and their storage facilities.
It’s important to note that security is everyone’s responsibility – not just management. You have a
key part to play in ensuring chemicals are securely stored, and that they are only accessed as part of
legitimate laboratory work.
The Code’s series of recommended security measures include:
 Physical access measures
Examples: signage, storage, lighting, visitor sign-in procedures.
 Personnel access measures
Examples: restricting access to storage areas, laboratory supervisor responsibilities.
 Employee and contractor checking measures
Examples: pre-employment background checks for staff, contractor references.
 Personnel security awareness
Examples: induction and orientation training, awareness sessions, refresher training.
Chemicals of security concern awareness course
Module five
63
 Inventory control measures
Examples: inventory control plans, stock-takes, reporting.
 Receipt of chemical measures
Examples: checking systems, reconciling that the chemical stock received matches the stock
ordered.
 Theft and diversion procedures
Examples: rules and procedures on access, assigning responsibility for security plans.
The case study below shows how a combination of security measures has been successfully applied
at the University of XYZ.
The University of XYZ
Welcome to the University of XYZ! This institution has an excellent science faculty. Undergraduate
and postgraduate students regularly access laboratories to conduct experiments. The chemistry and
biology departments within the faculty handle six of the 11 precursor chemicals, which are used in a
range of experiment by science students for undergraduate and postgraduate course work, including
PhD research. The faculty employs casual laboratory assistants, who are usually current or former
students. Their main role is to assist students with laboratory activities.
The Dean recently appointed two senior staff as ‘responsible persons’ to implement chemical
security measures, which relate to the Code. As part of their role, the newly appointed staff met
with lab supervisors to develop a joint strategy for implementing chemical security measures. The
group conducted a risk assessment for the faculty to fully understand its needs.
The risk assessment found that the existing procedures for chemical theft and diversion were
inadequate, and that lab supervisors have low awareness of the national security risks that some
chemicals pose.
Given the large number of people who use the labs on a regular basis, the group agrees it is not
practical or cost effective to conduct background checks on everyone. Instead, it focuses on other,
more practical and cost effective measures to minimise the risk of chemical theft or diversion for
terrorist purposes.
The first measure is to relocate the chemicals to a more secure storage area, which will reduce the
risks associated with unauthorised access. Laboratories are to be locked and can only be accessed by
approved staff as part of good physical and personnel access controls. And, all chemicals are
secured after hours to ensure best practice theft and diversion procedures.
The group also decided to update the existing inventory control mechanisms. It tasked lab
supervisors with maintaining base-level inventories, and made it their responsibility to be alert to
unusual requests for chemicals, including volume levels that are inappropriate for the approved
experiment or project as inventory control measures.
Further, lab supervisors responsible for signing-off experiments and chemical inventories are also
given security awareness training. In particular, the training aims to raise awareness of the security
risks posed by insiders, and provide information about how to identify and respond to suspicious
behaviour to ensure personnel security awareness.
The faculty has put in place practical and effective measures that are not overly complicated. They
address the specific risks that have been identified.
Chemicals of security concern awareness course
Module five
64
It’s important for all staff to understand and comply with security risk measures, and that they are
supported by well-communicated policies and procedures.
More information and guidance material about how your institution can apply these measures, as
well as detailed examples and suggested action, is available here.
Your role
There are a number of security measures that you can apply to your laboratory and storage areas.
These measures are designed to help prevent chemicals of security concern falling into the wrong
hands. The most practical and effective approach is implementing a combination of security
measures.
Below is a summary of some simple, but effective security measures covered in this module. These
measures can help reduce chemical theft and diversion in your laboratory or storeroom. They
include:
 always keeping chemicals stored in secure areas, rooms or lockable cabinets
 never leaving chemical unattended when they are being used in the laboratory
 always returning chemicals to the secure area immediately following use
 for student requests, always ask what chemicals are being used for, and check that there is a
legitimate and valid reason
 for student requests, sighting written approval from the supervising tutor or project sponsor
 always sighting identification of people requesting access to chemicals
 adhering to your institution’s policies and procedures for laboratories’ use, including sign-in
and access documentation, and
 adhering to your institution’s policies and procedures for supervising students using
chemicals within the laboratory environment.
Your institution should have specific policies, processes and guidelines on the storage and use of
chemicals of security concern. You should make yourself familiar with these and ensure that all staff
adhere to them.
Suspicious behaviour and indicators of suspicious behaviour are detailed below.
Suspicious behaviours
One of the most important things that you can do to ensure the security of your chemicals is to keep
alert. If you suspect it, report it.
Knowing who legitimately needs to use chemicals for laboratory work is an important tool for
preventing chemical theft and diversion. This means verifying the legitimacy of a person’s request to
access and use chemicals.
Suspicious behaviour is defined as any behaviour that does not feel or seem right. This means
anything that raises your suspicions - you should trust your intuition here!
Chemicals of security concern awareness course
Module five
65
The Code includes guides that are designed to help you identify and report suspicious behaviour. It is
important that you, as a laboratory manager, supervisor or staff member, have access to these
guides.
Legitimate requests to access chemicals may come from a colleague, student or other person within
your institution. Suspicious behaviour may include one or more of the following:

insistence on accessing or purchasing a specific chemical

a general lack of knowledge about the chemical’s uses

inability to explain the chemical’s application to the proposed laboratory work

inability to provide written authorisation from the tutor, lecturer or supervisor

a request to access and use chemicals outside of standard work hours, and/or

insistence on conducting laboratory work or experiments unsupervised.
When a person enquires about a chemical product that contains a chemical precursor to a
homemade explosive – that is, one the 11 high-risk chemicals discussed earlier - you should consider
the following.
Firstly: observe the person.

Are they nervous?

Are they requesting a large amount of chemical product?

Do they seem unwilling to provide details about the proposed use?

Does their story make sense?
As a general rule, you should ask the following questions:
 Why do you want the chemical?
 How do you intend to use it?
 Do you have approval to use it?
By having this conversation, you will ascertain whether the chemical being requested, at the
particular concentration levels and quantity, appears appropriate for the intended use.
While you are doing this, you need to be alert to any indicators of nervousness, including overall
body language. Most importantly, you need to discern whether the story makes sense.
If something doesn’t feel right, you should speak with your immediate supervisor, who can give you
some guidance and assist with the situation, if necessary.
Even if your suspicions are allayed, and you decide the request for access to the chemical is
reasonable, you should still record the details of all people accessing and using chemicals. For this
purpose, you should use a laboratory access log, laboratory-use register or similar recording
document.
If you observe suspicious behaviour, and you decide not to grant access to the chemical, you should
note the exchange as soon as possible, covering the following areas:
Chemicals of security concern awareness course
Module five
66
 the chemical requested
 the quantity of the chemical requested
 the reason provided by the person or persons seeking access to the chemical
 the behaviour and/or circumstances that made the request suspicious
 the form of identification presented
 a detailed physical description of the individual or individuals concerned, and
 anything else that struck you as out of the ordinary or suspicious.
Every little detail helps. Always take the time to note your observations and the situation.
Reporting to the National Security Hotline on 1800 123 400 or [email protected] is
appropriate in all incidents of suspicious behaviour.
Reporting
Module one highlighted the importance of reporting all incidents of suspicious behaviour to the
National Security Hotline via phone on 1800 123 400 or email at [email protected]
Reporting also relates to discussing your suspicions and feelings with your immediate supervisor. It’s
important to have an open conversation about what occurred, including your observations. Be clear
about why your suspicions were raised. Outline the facts, refer to your notes describing the
situation, and explain why you think that the behaviour was suspicious.
Raising these issues with your supervisor is not ‘silly’ or an overreaction, nor is it a waste of their
time. Reporting suspicious behaviour is an appropriate response, which helps to keep your
organisation’s chemicals secure. Remember – if you suspect it, report it.
Difficult conversations
There may be times when you need to deny access to chemicals. Even though this is part of your job
– that is, upholding your institution’s security procedures –you may encounter people who are upset
or aggressive towards you. This could happen, for example, while you are asking for valid
identification or why access to a chemical is being requested.
It is important to remember that conducting security checks is a vital part of your job. Often,
pointing this out to the person requesting the chemical can help reduce tension and discomfort, and
can defuse the situation. Be clear about your chemical security role. Assure them that you are
obliged to ask questions to validate chemical use in accordance with your organisation’s security
policy. Everyone is asked the same questions, and treated the same way.
Remember to always be polite, but firm. If a staff member or student becomes aggressive towards
you, stay calm and in control of the process. Do not let aggressive behaviour distract you from your
process. Do not let aggressive behaviour dictate what is going to happen.
Where appropriate, ask your supervisor for assistance. It may be helpful to ask them to reinforce the
workplace procedures and explain why they are necessary.
There are some people for whom aggressive behaviour is ‘standard’ behaviour. In these cases, the
aggressive behaviour may not, in itself, indicate that a request for chemicals is illegitimate.
Conversely, aggression may be the reaction of someone who is attempting to purchase a chemical
Chemicals of security concern awareness course
Module five
67
for less legitimate purposes. It is your job to ask questions, keep control of the situation, and decide
whether the request is legitimate or suspicious.
Dealing with aggressive and difficult people is never pleasant. If an incident is unduly stressful, you
should discuss it with your work colleagues or supervisor.
Your Human Resources Department will also have additional resources to help you, and is an avenue
for advice and guidance in coping with stressful or upsetting interactions.
Key concepts summary
Module five highlights the real and present threat of homemade explosives, and the role that
precursor chemicals play.
In the laboratory environment, chemical security awareness is vitally important. There are practical
steps you can take to ensure that chemicals of security concern are kept out of the wrong hands,
including physical access measures.
Taking security seriously helps build a ‘security culture’. This is when everyone understands the need
for security, implements good risk management practices, and deals with security incidents as they
occur, including reporting them. Security measures must be appropriate to the context and
environment your organization operates in. As such, security measures do not have to be over the
top, but should be reasonable and practical to your environment. Everyone has a role to play here.
There are a number of security measures that are specific to laboratories and their storage facilities,
including physical and personnel access controls and inventory controls. These, and other, simple
and practical measures can be put in place to address specific risks and vulnerabilities.
Suspicious behavior is defined as any behaviour that does not feel or seem right. Some indicators of
suspicious behaviour include insistence on access to a specific chemical, inability to provide written
authorization to use the chemical and insistence on conducting laboratory work using the chemical
unsupervised. It is important to report incidents to the National Security Hotline, and to seek advice
and guidance from your supervisor or manager, where appropriate. Support from your supervisor or
manager may include dealing with difficult or aggressive people.
Additional resources and information are available in module one. You can also find information
here at the chemicals of security concern website.
This is an excellent website with a number of practical and easy-to-use guides, as well as links to
further information sources.
The case study below highlights the importance of looking for suspicious indicators, using your
supervisor to help, and reporting suspicious incidents.
Case study
Once you have reviewed the case study, proceed to the brain teasers.
Welcome to ABC Laboratories. ABC conducts research using a number of the 11 chemical precursors.
John is the general manager of the business and has called a meeting of his supervisory staff to
discuss the results of a recent risk assessment.
“Thank you everyone for coming,” says John. “As you know, our risk assessment was done as a result
of the introduction of the new Code of Practice. We’ve been given a lot of assistance here from our
industry peak body, which was extremely helpful. What I’d like to do this morning is to give you a
Chemicals of security concern awareness course
Module five
68
rundown on the results of the risk assessment. In particular, I want to talk through the new security
measures that we will need to introduce.”
Sharon asks: “John, a quick question. Given we are already compliant with Workplace Health and
Safety legislation, will the new security measures impact on what is currently in place?”
“Good question, Sharon,” says John. “The results of the risk assessment show that we need to put in
new controls, but these won’t replace anything already in our WHS policies and processes. It’s more
a case of security measures building on what we already have in place, particularly in respect of staff
safety.”
“So John, what areas do we need to address?” asks David.
John refers to his notes. “The risk assessment identified that we have in place excellent background
checks for our laboratory supervisors, including conducting annual police checks for ongoing staff.
Secondly, the review identified that we have excellent inventory control measures for stock-taking
and accounting purposes. Our standard practice of reconciling quantities ordered with those in the
lab storeroom, and those used within the laboratory were considered very robust, so we don’t need
to change anything in respect of our inventory practices.”
“Sounds like we have done pretty well overall,” says Sharon. “But, surely there are some areas for
improvement?”
John nods: “We do need to put procedures in place that will cover what needs to be done in case
we actually find a discrepancy in our inventory reports. Our current policy is a bit light-on, and
although it mentions reporting it doesn’t specify what actions need to be taken if we discover that
we have chemicals missing or stolen.”
“I agree,” says Stefan. “It is a bit vague and we should tighten this up.”
John nods. “I’d like to see a flow chart that accompanies the policy so it’s clearer on what needs to
be done where we have an issue of theft or a discrepancy appears in our inventory processes. I also
think this should include immediately notifying me in my role as general manager, as well as
appointing a supervisor to investigate what has happened. It should also include reporting to the
National Security Hotline in cases where we can’t ascertain that the chemicals have been
legitimately used.”
“Sounds logical to me,” says Ellie. “If you like, I’ll take responsibility for getting these done.”
Stefan asks: “Is it possible for us to consider developing a short training session on the Code and
security of chemicals? I think it would be valuable, particularly for new employees.”
“I agree,” says Ellie. “Currently, we don’t really have a formal training session; it’s more a case of
asking staff to read some information. If we are going to take the results of this risk assessment
seriously, I think we should look at training.”
“I concur,” says Clive. “Perhaps we can look at including this in the new staff orientation package?”
“These are all great ideas,” says John, making some notes. “Let’s make it happen.”
Brain teasers
The following questions are based on the above case study. Take your time to read the questions,
and choose the most appropriate response.
Q1. The risk assessment found that ABC Laboratories needed to revise its policy in order to
better respond to discrepancies in their regular inventory and stock-takes. What security
measures are being utilised here? Choose the most appropriate response.
Chemicals of security concern awareness course
Module five
69
a. Remote monitoring procedures.
b. Inventory control measures and theft and diversion procedures.
c. Employee and contractor checking and physical access measures.
Answers:
a. No – this specific security measure is not being used here. Try again.
b. Correct! Revising the policy to make it more effective will mean that there is a better link
between current inventory control measures (inventory checks and stock-takes), and
ensures that sound theft and diversion procedures are in place.
c. Not in this instance. ABC already has excellent employee checking procedures, and the risk
assessment process did not identify any issues with physical access to the chemicals. Try
again.
Q2. During the discussions, Stefan spoke about the need to put in place training sessions for
staff. What additional security measure did he propose? Choose the most appropriate
response.
a. Receipt of chemicals awareness.
b. Personnel security awareness.
c. New orientation sessions.
Answers:
a. Not quite. This topic may well be covered during the training, but the security measure being
utilised to train the staff has a specific term. Try again.
b. Correct! The security measure being utilised here is personnel security awareness, in this
case relating to the proposed training session for ABC staff.
c. Not quite. Whilst the topic of chemical security awareness may be covered during new staff
member orientation sessions, the security measure to do with training and education has a
specific term. Try again.
Q3. What were the benefits of John involving the supervisors in the discussion of the risk
assessment?
a. It ensured the supervisors were held responsible when something went wrong.
b. It was probably the cheapest option.
c. It helped build better understanding of the risks as well as ownership of the solutions.
Answers:
a. No quite. Whilst it may well have assisted in making supervisors aware of their
responsibilities, there were other benefits. Try again.
b. Not quite – try again.
Chemicals of security concern awareness course
Module five
70
c. Yes. By involving his supervisory team, John has highlighted the risks and the measures that
will be taken in addressing the vulnerabilities at ABC. Having open and collaborative
discussions on security risk management issues helps build a security culture. It also
highlights the important principle that chemical security is everyone’s responsibility, not just
management. Well done!
Chemicals of security concern awareness course
Module five
71