Risk, Safety, Security and Crisis Management

Introduction

Events are temporary organisations operating under conditions of uncertainty. They bring together audiences, performers, employees, contractors, suppliers, sponsors, public authorities, media and digital systems in a limited space and time. This concentration of people, resources and attention creates value, but it also creates exposure to harm. A transport failure may delay a programme; a power outage may stop an event; overcrowding may cause injury; fraud may create financial loss; and a poorly managed incident may damage public trust for years.

Risk management in event management is therefore not limited to emergency response. It is a systematic process of identifying uncertainty, assessing its consequences, selecting controls, preparing for disruption, communicating responsibly and learning from experience. Safety protects people from accidental harm. Security addresses intentional threats and unlawful interference. Crisis management coordinates decisions and communication when an event threatens life, continuity, legality or reputation.

For mass media managers, these responsibilities are particularly important because events are highly visible. A minor operational failure can become a major reputational crisis when recorded and distributed through social media. Effective managers must therefore combine operational planning, financial control, crowd science, stakeholder coordination, legal compliance and ethical judgement.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish operational, financial, reputational, safety and security risks.
2. Identify hazards and assess risk using likelihood, consequence and exposure.
3. Design proportionate controls based on the hierarchy of controls.
4. Explain crowd management, emergency planning and business continuity.
5. Develop crisis-communication plans for internal and external stakeholders.
6. Coordinate event risk arrangements with emergency services, regulators and venue authorities.
7. Evaluate an event-risk plan ethically and professionally.

1. The Nature of Event Risk

A hazard is a source or situation with the potential to cause harm. Examples include an unstable temporary structure, an obstructed exit, extreme heat, aggressive behaviour, defective electrical equipment or misleading public information. Risk is the possibility that a hazard will produce a specified harm, considered together with the severity of that harm and the circumstances of exposure.

Uncertainty is broader than risk. Risk can often be described using evidence or reasonable estimates; uncertainty includes what is not known, such as the behaviour of an unprecedented crowd or the consequences of a novel cyberattack. Event managers should not assume that an absence of previous incidents means an absence of risk.

Important categories include:

These categories overlap. For example, a failed contractor is an operational risk, but it may also create safety, financial and reputational consequences. A risk register should record both the immediate event and its potential secondary effects.

2. Risk Governance and Responsibility

Risk management is a governance function, not merely a task assigned to a security guard. The event owner or senior management retains accountability, even when duties are delegated. A practical governance structure normally includes:

• Event director: overall accountability and authority to stop or modify the event.
• Risk or safety manager: risk assessment, controls, inspections and incident reporting.
• Security manager: threat assessment, access control, protective security and liaison with police.
• Operations manager: site, suppliers, transport, utilities and schedule integration.
• Medical lead: first aid, ambulance coordination and clinical escalation.
• Communications lead: approved messages, media relations and monitoring.
• Venue representative: building systems, occupancy limits, evacuation arrangements and maintenance.
• Public authorities: licensing, fire safety, policing, emergency medical services, transport and local government, according to jurisdiction.

Responsibilities should be documented through a responsibility matrix. The person who performs a task is not always the person who approves it. For example, a contractor may install barriers, while the safety manager verifies that they are suitable and the event director authorises opening.

A strong governance system includes reporting without fear of retaliation. Near misses—events that could have caused harm but did not—are valuable evidence. Suppressing near misses produces an artificially positive record and prevents learning.

3. Risk Assessment: From Hazard Identification to Control

3.1 The assessment process

A practical risk assessment follows these steps:

1. Define the event, site, audience, activities and operating period.
2. Identify hazards through site inspections, historical data, consultation and scenario analysis.
3. Identify people and assets that may be affected.
4. Assess likelihood and consequence.
5. Select controls and assign owners.
6. Record residual risk after controls are applied.
7. Monitor conditions and review the assessment when circumstances change.

Hazard identification should include normal operations, set-up, live operation, breakdown and post-event dispersal. It should consider children, older people, disabled attendees, pregnant people, workers, performers and people who may not speak the primary language.

3.2 A qualitative risk matrix

A common screening method is a qualitative matrix. Let risk priority be represented by:

where R is the risk score, L is the likelihood score and C is the consequence score. The scores are ordinal ratings, not precise probabilities. For example, an organisation may use scales from 1 to 5 for likelihood and consequence. A score of 15 does not mean that the risk is exactly three times as serious as a score of 5; it is a prioritisation aid.

A score should never replace professional judgement. A low-frequency, high-consequence event may require strong controls even if its numerical score is not the highest. Legal requirements, venue rules and emergency-service advice may also require action regardless of score.

Worked example. Suppose an outdoor festival assesses lightning exposure as likelihood 3 and consequence 5 before controls. The initial score is 3 × 5 = 15. The manager introduces weather monitoring, shelter arrangements, a public-address procedure and a suspension threshold. The residual likelihood may be judged 2, while consequence remains 5 because lightning could still be severe if it occurred. The residual score is 2 × 5 = 10. The reduction does not make the risk acceptable automatically; management must compare it with the organisation’s acceptance criteria and the advice of competent authorities.

3.3 The hierarchy of controls

Controls should be selected in the following order, from generally more reliable to less reliable:

1. Elimination: remove the hazardous activity, such as cancelling a pyrotechnic effect.
2. Substitution: replace it with a safer alternative, such as a non-flammable effect.
3. Engineering controls: use physical design, barriers, guards, lighting or ventilation.
4. Administrative controls: procedures, training, scheduling, supervision and warnings.
5. Personal protective equipment: helmets, gloves, hearing protection or high-visibility clothing.

PPE is important but is usually the least reliable control when used alone because it depends on correct selection, fit and compliance. A good event plan combines controls. For example, crowd protection may involve reducing a hazard, designing suitable circulation routes, deploying trained stewards and using protective equipment for certain workers.

4. Safety Management Across the Event Life Cycle

Planning and procurement

Safety begins before a contract is signed. Tender documents should specify competence, insurance, inspection records, staffing, emergency duties and reporting requirements. Contractors should be assessed for capability rather than selected solely on lowest price. Critical suppliers should have contingency arrangements and substitute resources.

Site and infrastructure

A site plan should show entrances, exits, emergency access lanes, medical posts, fire equipment, utilities, generators, stages, barriers, accessible routes, assembly areas and control rooms. Temporary structures require competent design, installation and inspection. Wind loading, anchoring, ground conditions, weather exposure and public access must be considered. Electrical systems should be installed and tested by qualified personnel, with cables protected from vehicles and pedestrians.

Exit routes must be visible, available and not reduced by temporary merchandising, queues or equipment. Emergency access routes should remain usable throughout the event, not merely during inspection.

Weather and environmental conditions

Outdoor events require monitoring of heat, lightning, wind, rain, flooding, poor air quality and extreme cold. A weather plan should define:

• who receives authoritative forecasts;
• what thresholds trigger increased monitoring, programme modification or suspension;
• where people can shelter;
• how cancellation and resumption decisions are made;
• how attendees are informed; and
• how contractors protect or remove equipment.

Weather decisions should be made early enough to be useful. Waiting for visible danger may leave insufficient time to move a crowd safely.

Health and welfare

Medical planning should reflect audience size, age profile, event type, alcohol or drug exposure, climate, travel time to hospitals and likely injuries. A plan normally identifies first-aid locations, ambulance routes, clinical escalation, lost-person procedures, water provision, sanitation, food hygiene and accessibility support. Medical arrangements must protect confidentiality while allowing essential operational information to reach decision-makers.

5. Crowd Management

Crowd management is the planned facilitation of safe movement, access, viewing and dispersal. Crowd control, by contrast, often refers to intervention when behaviour or movement becomes unsafe. Effective management aims to prevent dangerous conditions rather than relying on force after they arise.

Managers should examine crowd density, movement speed, pressure points, queue formation, sightlines, audience motivation and the interaction between fixed infrastructure and human behaviour. Danger may occur at entrances, narrow corridors, stairs, barriers, transport hubs, merchandise points and locations where a popular performer is visible.

A crowd plan should include:

• capacity and occupancy monitoring;
• separate arrival, circulation and exit routes where feasible;
• accessible routes and viewing areas;
• queue design, shade and welfare facilities;
• steward deployment and communication systems;
• barrier selection and inspection;
• procedures for lost children and vulnerable persons;
• anti-crush principles, including avoidance of unnecessary compression;
• dynamic observation and escalation; and
• coordinated dispersal after the programme.

Stewards need more than a uniform. They require role-specific training in observation, communication, accessibility, de-escalation, emergency reporting and evacuation. Their authority must be clear, and they must know when to refer a matter to security, medical staff or police.

Capacity is not simply the number printed on a ticket. It depends on usable space, exit capacity, fire regulations, venue licensing, crowd configuration and the safe movement of people. Only competent professionals and relevant authorities should determine permitted occupancy.

6. Security Management

Security planning begins with a threat assessment. A threat is the potential for intentional harm, while vulnerability is a weakness that may be exploited. Risk arises from the relationship among threat, vulnerability and consequence. Security measures should be proportionate: excessive controls can create queues, inconvenience and new crowd hazards, while weak controls expose people and assets.

Security measures may include ticket validation, accreditation, perimeter protection, bag policies, screening where lawful and justified, restricted backstage access, lighting, CCTV, cyber controls, trained personnel and liaison with police. Any search or surveillance must comply with law, privacy requirements and the event’s published conditions.

The event should use a clear access-control model:

• public zones for ordinary attendees;
• controlled zones for staff and suppliers;
• restricted zones for performers, production and sensitive equipment; and
• critical zones such as control rooms, power systems and medical facilities.

Cybersecurity is increasingly important. Ticketing platforms, payment systems, access-control devices, staff communication tools and livestream systems may be attacked or disrupted. Basic controls include strong authentication, least-privilege access, software updates, backups, vendor due diligence, incident logging and a manual fallback for essential functions. Personal data should be collected only for a justified purpose, retained appropriately and protected from unauthorised access.

Security personnel should use de-escalation wherever possible. Professional conduct, non-discrimination and clear documentation protect both attendees and the organisation. Security must not become a pretext for unlawful profiling or disproportionate treatment.

7. Emergency Management

An emergency plan describes how the organisation detects, responds to and recovers from an incident. It should be integrated with the incident command arrangements of the venue and public authorities, not developed as an isolated document.

A useful structure distinguishes three levels:

• Routine incident: managed by the relevant operational team.
• Serious incident: requires coordination across departments and possible authority notification.
• Major emergency: threatens life, public order, continuity or the organisation’s viability and requires formal command and external coordination.

The plan should identify an incident controller, deputies, a control room, communications channels, decision logs and authority to stop the event. It should contain action cards for likely scenarios such as fire, serious medical incident, severe weather, suspicious package, active violence, missing child, structural concern, cyberattack and utility failure.

Emergency communication should be short, accurate and actionable. Messages should state what happened if known, what people should do, where they should go, what routes to avoid and where further information will appear. Instructions must account for people with hearing, visual, mobility, language or cognitive access needs.

Evacuation is not always the correct response. Depending on the hazard, people may need to evacuate, shelter in place, move to a safer area or remain temporarily where they are. The decision must be based on the hazard and advice from competent authorities. Emergency plans should be exercised through tabletop discussions, communications tests, partial drills and, when appropriate, full exercises. Exercises should have objectives, observers and corrective actions.

8. Business Continuity and Recovery

Business continuity concerns the continuation of critical functions during disruption. It is broader than emergency response. An event organisation should identify critical activities such as ticketing, payroll, supplier communication, audience welfare, public information, access control and financial settlement.

A simple continuity analysis asks:

1. What functions are essential?
2. How long can each function be unavailable?
3. What resources does it require?
4. What alternatives exist?
5. Who can authorise suspension, relocation, postponement or cancellation?
6. How will stakeholders be informed?

Continuity options include backup power, duplicate communication channels, alternative suppliers, spare equipment, cloud and offline records, flexible staffing, alternate venues and event insurance. Recovery should include site restoration, claims, refunds, employee support, investigation, stakeholder engagement and lessons learned.

Cancellation decisions have financial and ethical dimensions. Continuing an event may protect revenue but expose people to unacceptable danger. Conversely, cancelling without clear evidence may create unnecessary loss. The decision should be documented, evidence-based and consistent with legal duties and public safety.

9. Crisis Management and Communication

A crisis is a serious event that threatens people, operations, legitimacy or reputation and requires leadership attention. Crisis management involves preparation, response, communication and recovery.

Before the crisis

The organisation should prepare a crisis-management team, contact directory, approval process, holding statements, stakeholder map, media protocol and monitoring system. Spokespersons require training. Plans should identify who can communicate on behalf of the event and who can authorise sensitive disclosures.

During the crisis

The first priorities are life safety, accurate information and coordinated action. The organisation should establish what is known, what is unknown, what has been verified and what must not yet be released for legal or personal-safety reasons. A useful information log records time, source, verification status, decision, owner and next review time.

Communication should be timely but not speculative. Silence can create a vacuum, but an inaccurate statement may cause additional harm. A responsible message may acknowledge the incident, express concern, explain immediate actions, provide instructions and promise updates at a stated time.

Different stakeholders need different information. Staff need operational instructions; attendees need safety directions; families may need welfare information; regulators need formal facts; sponsors need assurance about governance; media need verified public information. Personal details, images of injured people and unconfirmed allegations must not be released casually.

After the crisis

Recovery communication should address support, accountability and improvement. The organisation should avoid defensive language and should not promise conclusions before investigation. A post-incident review should distinguish immediate causes, contributing conditions, control failures and organisational learning.

Social media monitoring can identify rumours and emerging concerns, but it should not encourage intrusive surveillance. Artificial intelligence can assist with message drafting, translation, sentiment classification, anomaly detection or scenario simulation. However, AI outputs require human verification because systems may hallucinate facts, reproduce bias, expose personal data or misinterpret sarcasm and local context. AI must not replace competent emergency command or clinical judgement.

10. Applied Case: Riverside Sound Festival

The following is an illustrative fictional case.

Background

Riverside Sound is a two-day music festival held beside a river for 18,000 attendees per day. The site contains a main stage, a smaller stage, food vendors, a temporary bridge, car parks and a railway station nearby. Weather forecasts predict high temperatures and a possibility of thunderstorms.

Problem

On the first afternoon, the headline performer is delayed. A large crowd forms near the main-stage entrance, while some attendees queue for water. A message circulates online claiming that the event is being cancelled. At the same time, lightning is detected within the region and a vendor reports that a generator has overheated.

Analysis

The event has interacting risks: crowd compression, heat illness, misinformation, electrical failure and severe weather. The risk is dynamic because the delayed programme changes audience movement and motivation. A static morning risk assessment is insufficient.

The event control room convenes the event director, safety manager, security lead, medical lead, production manager, venue representative and communications lead. The team verifies the weather information, checks crowd observations, confirms the generator condition and contacts the relevant authorities.

Approach and solution

The event director pauses admission to the most crowded viewing area. Stewards open a designated overflow route, provide water and communicate calmly with attendees. The production manager isolates the overheated generator and activates a tested backup. The safety manager recommends suspension of the main-stage programme because the lightning threshold in the emergency plan has been reached. Authorities agree with the suspension and advise movement to designated safer areas rather than uncontrolled dispersal.

The communications lead issues a verified announcement through the public-address system, event application, website and social channels: the programme is temporarily suspended because of weather, attendees should follow steward instructions, water points remain open, and the next update will be issued in 20 minutes. The message avoids claiming that the event is cancelled.

The medical team treats several cases of heat exhaustion. Security and stewards keep emergency routes clear, while the transport liaison coordinates with the railway station to manage the later dispersal. After conditions improve, the control group reassesses the site before authorising a phased restart.

Outcome

No serious injury occurs, although the festival experiences programme disruption, additional staffing costs and some refund requests. The post-event review finds that the weather plan was sound but that water queues and delayed-performance scenarios were underdeveloped. The organiser later adds heat sensors, increases water capacity, introduces a headline-delay procedure and improves rumour monitoring.

Learning points

1. Risk is dynamic and must be reassessed when conditions change.
2. Crowd safety, weather, utilities and communication can form one connected problem.
3. Clear authority to suspend an activity prevents delay and confusion.
4. Accurate, repeated and actionable communication reduces unsafe movement.
5. Near misses and operational disruption provide evidence for improvement.

11. Challenges, Ethics and Professional Practice

Risk management involves difficult trade-offs. Commercial pressure may encourage an organiser to continue despite unsafe conditions. Security measures may conflict with privacy and inclusion. Evacuation instructions may disadvantage people with disabilities if accessible arrangements are not designed in advance. Sponsors may seek to minimise negative publicity, while the public has a legitimate interest in truthful information.

Ethical practice requires the protection of life and dignity, non-discrimination, informed communication, accountability and respect for lawful authority. Accessibility is not an optional public-relations feature; it is part of competent event design. Children and vulnerable adults require particular safeguarding arrangements. Data protection principles require purpose limitation, data minimisation, secure handling and appropriate retention.

Regulatory requirements vary by country and event type. Managers must consult applicable occupational safety, fire, building, licensing, public health, employment, privacy, accessibility, transport, alcohol, copyright and environmental rules. Professional competence matters: specialist issues such as structural design, electrical safety, crowd capacity and medical provision must be handled by qualified persons.

Best practice is characterised by proportionate controls, documented decisions, competent suppliers, realistic exercises, accessible communication, continuous monitoring, honest reporting and learning after incidents. A plan that exists only in a folder is not a functioning risk system.

Chapter Summary

Event risk management is a continuous governance process covering identification, assessment, control, monitoring, response and learning. Risks may be operational, financial, safety-related, security-related, reputational, legal or environmental, and one incident can affect several categories at once. A qualitative risk matrix can prioritise attention, but it does not replace professional judgement or legal requirements. The hierarchy of controls favours elimination and engineering solutions over warnings and PPE alone.

Safe events require integrated site planning, competent contractors, crowd-management systems, weather and medical arrangements, access control and cybersecurity. Emergency plans must define command, communication, evacuation or shelter decisions, authority liaison and exercises. Business continuity protects critical functions during disruption, while crisis communication provides verified, timely and accessible information to stakeholders. Ethical practice places life, dignity, inclusion, privacy and accountability above short-term commercial pressure. The event manager’s central responsibility is to create conditions in which risks are anticipated, decisions are authorised, people are protected and organisational learning is converted into better practice.

Key Terms

Hazard: A source or situation with the potential to cause harm.

Risk: The possibility of harm arising from exposure to a hazard, considered with likelihood and consequence.

Risk assessment: A systematic process of identifying hazards, evaluating risks and selecting controls.

Risk register: A documented list of risks, owners, controls, ratings and review information.

Residual risk: The risk remaining after controls have been applied.

Near miss: An event that could have caused harm but did not.

Hierarchy of controls: The preferred order for reducing risk, from elimination to PPE.

Safety: Protection from accidental injury, illness or damage.

Security: Protection from intentional harm, unlawful interference or unauthorised access.

Crowd management: Planned facilitation of safe crowd movement, access and dispersal.

Threat: The potential for intentional harm.

Vulnerability: A weakness that may be exploited by a threat.

Emergency: An incident requiring immediate coordinated action to protect people or assets.

Incident command: A defined structure for directing and coordinating emergency actions.

Business continuity: The capability to maintain critical functions during disruption.

Crisis: A serious event threatening safety, operations, legitimacy or reputation.

Crisis communication: Planned communication before, during and after a crisis.

Stakeholder: A person or organisation affected by, or able to affect, the event.

Residual risk: Risk remaining after preventive and protective measures.

Near-miss reporting: Recording events that reveal weaknesses without resulting in actual harm.

Review Questions

Short Answer Questions

1. Distinguish between a hazard and a risk.
2. What is the purpose of a risk register?
3. State the five levels in the hierarchy of controls.
4. Why should event managers report near misses?
5. What is the difference between crowd management and crowd control?

Long Answer Questions

1. Explain how an event manager can integrate safety, security and operational risk planning across the event life cycle.
2. Describe the purpose and limitations of a qualitative likelihood–consequence matrix.
3. Discuss the principal components of an emergency management plan.
4. Explain how business continuity planning supports event resilience.
5. Evaluate the ethical responsibilities of an event organisation during a public crisis.

Analytical / Application Questions

1. A festival faces extreme heat, a delayed headline act and growing queues at one entrance. Analyse the interacting risks and propose immediate and preventive controls.
2. Design a crisis-communication response to an online rumour that an event venue has suffered a structural failure, when the information has not yet been verified.
3. Compare two possible responses to a developing thunderstorm—continuing the event with monitoring or suspending the programme—and justify a decision using risk, stakeholder and ethical considerations.

Multiple Choice Questions with Answers

Question 1

Which statement best defines a hazard?

A. A source or situation with potential to cause harm

B. The financial cost of an incident

C. A completed emergency response

D. A communication sent to the media

Correct Answer: A. A source or situation with potential to cause harm

Question 2

In the qualitative model R = L × C, what do L and C represent?

A. Loss and capacity

B. Likelihood and consequence

C. Location and control

D. Labour and cost

Correct Answer: B. Likelihood and consequence

Question 3

Which control is highest in the hierarchy of controls?

A. Personal protective equipment

B. Warning signs

C. Elimination

D. Staff training

Correct Answer: C. Elimination

Question 4

Why is a dynamic risk assessment necessary during an event?

A. Risk conditions can change as people, weather and operations change

B. It eliminates the need for an initial assessment

C. It guarantees that no incident will occur

D. It transfers legal responsibility to contractors

Correct Answer: A. Risk conditions can change as people, weather and operations change

Question 5

Which is primarily a security measure?

A. Providing drinking water

B. Inspecting food temperatures

C. Controlling access to a restricted backstage area

D. Scheduling additional performers

Correct Answer: C. Controlling access to a restricted backstage area

Question 6

What is the most appropriate first priority in a major crisis?

A. Protecting life and preventing further harm

B. Publishing an unverified explanation

C. Protecting the sponsor's advertising schedule

D. Deleting negative social-media comments

Correct Answer: A. Protecting life and preventing further harm

Question 7

Which statement about crisis communication is most appropriate?

A. Messages should be timely, verified and actionable

B. The organisation should speculate to appear confident

C. Only sponsors should receive information

D. Personal details should be released immediately

Correct Answer: A. Messages should be timely, verified and actionable

Question 8

What is business continuity primarily concerned with?

A. Maintaining critical functions during disruption

B. Increasing ticket prices after an incident

C. Replacing all emergency services

D. Removing the need for insurance

Correct Answer: A. Maintaining critical functions during disruption

Question 9

A risk has likelihood 4 and consequence 3 using an ordinal matrix. What is its score?

A. 7

B. 10

C. 12

D. 43

Correct Answer: C. 12

Question 10

Which practice best supports ethical event security?

A. Using proportionate, lawful and non-discriminatory measures

B. Searching everyone without notice or justification

C. Publishing attendee data to deter misconduct

D. Using force before attempting communication

Correct Answer: A. Using proportionate, lawful and non-discriminatory measures