13. Safety, Security, Law, Ethics and Governance

Introduction and Context

Front office operations occupy a sensitive position in hotel management. The department controls access to rooms, handles personal and financial information, communicates with guests during stressful events, manages complaints, authorises transactions, and coordinates with security, engineering, housekeeping, food and beverage, and external authorities. Consequently, front office decisions have consequences extending well beyond service quality. A failure to verify identity may facilitate theft; careless disclosure of a guest’s location may create personal danger; an inaccessible emergency procedure may endanger a person with a disability; and an unethical sales practice may damage both the guest relationship and the hotel’s reputation.

Safety concerns the prevention of harm to people and property. Security focuses on protection against intentional or unauthorised acts, including theft, violence, fraud, intrusion, and cyberattack. Law establishes enforceable duties and rights, while ethics addresses the standards of fairness, dignity, honesty, confidentiality, and professional responsibility that may exceed minimum legal requirements. Governance connects these dimensions through authority, policies, controls, accountability, documentation, and oversight.

For a front office manager, these are not separate subjects. They form an integrated risk-management responsibility. A legally compliant procedure may still be ethically questionable; a technically secure system may be unusable in an emergency; and a well-written policy may fail if employees are not trained or managers do not review exceptions. Effective governance therefore requires the hotel to design controls that are lawful, proportionate, inclusive, operationally practical, and capable of continuous improvement.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Distinguish safety, security, law, ethics, compliance, and governance in front office operations.

2. Identify major risks affecting guests, employees, hotel assets, and information.

3. Design controls for emergencies, access, payments, personal data, and incident reporting.

4. Apply ethical reasoning to selling, discrimination, confidentiality, surveillance, and service recovery.

5. Explain the managerial significance of contracts, regulatory compliance, accessibility, and accountability.

6. Evaluate a front office risk scenario and recommend proportionate corrective action.

7. Assess the role of technology, analytics, and artificial intelligence in secure and responsible operations.

The Front Office Risk Environment

Risk may be understood as the effect of uncertainty on objectives. In a hotel, objectives include safe occupancy, lawful operation, reliable revenue collection, guest privacy, employee welfare, business continuity, and trust. Risk is commonly assessed through the likelihood of an event and the severity of its consequences. A low-frequency event, such as a major fire, may still deserve extensive preparation because its consequences are extreme. Conversely, frequent minor errors, such as duplicate posting or incomplete identification checks, may accumulate into significant financial and reputational exposure.

Front office risk usually falls into five overlapping categories:

• Physical risk: fire, medical emergencies, slips, violence, unsafe access, overcrowding, and failures of building systems.
• Operational risk: incorrect room assignment, lost keys, poor handover, weak cash controls, inadequate documentation, and failure to escalate incidents.
• Information risk: unauthorised disclosure, identity theft, phishing, insecure storage, excessive access, and accidental exposure of records.
• Legal and regulatory risk: breach of contract, consumer-protection violations, discrimination, privacy violations, licensing failures, and non-compliance with employment or safety requirements.
• Reputational and ethical risk: misleading rates, unfair treatment, exploitative selling, hidden charges, inappropriate surveillance, or concealment of incidents.

A useful control cycle is identify, assess, prevent, detect, respond, recover, and learn. Identification asks what can go wrong. Assessment prioritises risks. Prevention reduces probability. Detection reveals an event quickly. Response limits harm. Recovery restores operations and relationships. Learning converts incidents and near misses into improved controls.

Safety as a Managed Service Responsibility

Safety is not achieved merely by posting emergency telephone numbers. It depends on physical design, employee competence, communication, maintenance, and rehearsed action. Front office employees should know evacuation routes, assembly points, emergency exits, alarm procedures, first-response limits, accessible evacuation arrangements, and the location of emergency equipment. They should also understand what they must not do, such as attempting a technical rescue beyond their training or making unverified public statements during a crisis.

Emergency preparedness and response

An emergency plan should specify who has authority, how information moves, which records are needed, and how guests are accounted for. Typical scenarios include fire, severe weather, power failure, medical incidents, bomb threats, missing persons, active violence, civil disturbance, infectious disease events, and prolonged technology outages. Each scenario requires a practical decision sequence:

1. Protect life and raise the alarm.

2. Contact the appropriate internal and external responders.

3. Give clear, accurate instructions to guests and employees.

4. Preserve access information and occupancy data for authorised responders.

5. Record material facts, actions, times, and notifications.

6. Support affected persons and protect their privacy.

7. Conduct a debrief and correct identified weaknesses.

The front desk often becomes the communication centre during an emergency. Information must therefore be brief, verified, and consistent. Staff should avoid speculation and should not disclose sensitive information, such as the location of a vulnerable guest, to unauthorised callers. Emergency planning must include guests who have mobility, hearing, visual, cognitive, or other access needs. A procedure that assumes every guest can use stairs, hear an alarm, read printed instructions, or understand a single language is incomplete.

Preventive safety controls

Preventive controls include regular inspection of doors, lighting, lifts, stairways, alarms, signage, and public areas; safe key-handling; adequate staffing; incident reporting; employee identification; and coordination with engineering and security. The front office should have a clear process for reporting hazards rather than relying on informal conversation. Near misses deserve attention because they reveal control weaknesses before injury occurs.

Security, Access and Incident Management

Hotel security balances hospitality and controlled access. Excessive suspicion can damage the guest experience and discriminate against legitimate guests, while excessive openness can expose people and assets to harm. The principle of least privilege is useful: employees should receive only the access required for their role, and access should be reviewed when duties change.

Room keys and electronic credentials require particular discipline. Staff should not announce room numbers aloud where others can hear, should verify identity before issuing replacement keys, and should follow a documented escalation process when a person cannot satisfy verification requirements. A caller asking to be connected to a guest should not automatically receive the guest’s room number or location. Visitors, contractors, and delivery personnel should be managed through identification and authorisation procedures appropriate to the property.

Incident management should distinguish facts from assumptions. A good report states what was observed, when it occurred, who was notified, what action was taken, and what evidence exists. It should avoid insulting descriptions, unsupported accusations, and unnecessary personal information. Evidence must be preserved according to policy and applicable law. Serious events may require notification to senior management, insurers, regulators, law enforcement, or affected individuals.

Security also includes fraud prevention. Warning signs may include unusual payment behaviour, repeated card declines, mismatched identification, pressure to bypass procedures, suspicious refund requests, or attempts to obtain internal information. These indicators justify discreet verification, not automatic accusation. Employees should be trained to escalate concerns without humiliating guests or making decisions based on appearance, nationality, religion, age, disability, or other protected characteristics.

Law, Contracts and Regulatory Compliance

The precise legal rules governing hotels vary by jurisdiction. Managers must therefore use current local legislation, official guidance, professional advice, and the hotel’s legal counsel rather than assume that a general industry practice is lawful. Nevertheless, several legal relationships recur in front office management.

The reservation creates expectations concerning price, dates, room type, cancellation, inclusions, and special conditions. Contractual clarity requires that material terms be communicated before acceptance and that changes be documented. Overbooking, relocation, cancellation, deposits, no-show charges, refunds, and incidental authorisations should be governed by transparent policies consistent with applicable consumer law. A guest should not discover a mandatory charge only after arrival if it could reasonably have been disclosed earlier.

The hotel also has duties relating to premises safety, employment, accessibility, privacy, payment processing, taxation, licensing, and record retention. Managers must understand the difference between a policy and a legal obligation. A policy can impose a higher internal standard, but it cannot authorise conduct prohibited by law. Similarly, a signed waiver does not necessarily eliminate duties that legislation treats as non-excludable.

Contracts with online travel agencies, payment processors, technology vendors, security providers, and transport operators should allocate responsibility for data, service failure, refunds, incident notification, subcontracting, and business continuity. Front office managers may not negotiate all contractual terms, but they should understand operational obligations and escalation routes.

Compliance is stronger when it is embedded in ordinary work. A compliance register can identify each obligation, responsible owner, evidence required, review date, and consequence of failure. Internal audits, spot checks, training records, access reviews, and corrective-action logs provide evidence that controls are functioning rather than merely existing on paper.

Privacy, Data Protection and Confidentiality

Front office records may contain names, contact details, identity documents, travel information, payment details, preferences, complaints, health-related requests, and information about companions. Privacy protection requires a legitimate purpose, limited collection, accurate handling, restricted access, appropriate retention, and secure disposal. The exact legal basis and rights of individuals depend on the applicable jurisdiction, but the managerial principles are broadly consistent.

The principles of data minimisation and purpose limitation are especially important. The hotel should collect information needed for identified operational or legal purposes, not because future use might be convenient. Employees should access records only when their role requires it. Printed registration forms should not be left visible, screens should be positioned carefully, and reports should use aggregated or masked data where individual identification is unnecessary.

Confidentiality applies in conversation as well as in databases. Staff should not discuss celebrity stays, relationship disputes, medical circumstances, payment problems, or complaints in public areas. Requests from relatives, journalists, unauthorised staff, or callers must be handled through verification and escalation. Disclosure to emergency responders may be justified when necessary to protect life, but it should remain limited and documented.

A data incident includes both deliberate theft and accidental disclosure. Examples include sending a folio to the wrong email address, leaving a screen unlocked, attaching the wrong guest list, losing a device, or giving a room number to an unauthorised caller. The response should contain the incident, preserve evidence, notify the designated privacy or security officer, assess affected data, and make any legally required notifications. Employees need a culture in which prompt reporting is encouraged rather than concealed.

Payment Security and Financial Controls

Payment security combines guest trust, revenue protection, technology, and compliance. Card details should be handled only through approved systems and procedures. Employees should never record sensitive authentication information in personal notebooks, messaging applications, or uncontrolled spreadsheets. Terminals, user credentials, refund permissions, and reconciliation responsibilities should be controlled through role-based access and segregation of duties.

A sound payment process includes verification of the transaction, clear communication of the amount and currency, secure authorisation, accurate posting, receipt or confirmation, end-of-shift reconciliation, and investigation of discrepancies. Refunds and chargebacks require documented authority. A person who receives cash should not always be the sole person who reconciles and approves adjustments. Exceptions should be visible to management rather than hidden in manual corrections.

Digital payment systems reduce some risks but introduce others, including phishing, malware, terminal tampering, credential theft, and system outages. Staff should know how to recognise fraudulent messages and whom to contact when a device behaves unusually. Business-continuity procedures should define how deposits, arrivals, departures, and emergency transactions are managed when the property-management system or payment network is unavailable.

Accessibility, Equality and Dignity

Accessibility is both a legal responsibility and a service-quality principle. It requires more than an accessible room inventory. Guests may need accessible routes, visual or auditory information, suitable communication, service-animal accommodation, assistance during evacuation, and respectful flexibility in procedures. The hotel should identify barriers in the entire guest journey, from reservation and arrival to payment, complaint handling, and departure.

Equality does not always mean identical treatment. A reasonable adjustment may be necessary to provide genuinely equal access. Staff should ask what assistance is required rather than make assumptions, and should avoid treating disability as a curiosity. Language, culture, gender identity, age, religion, family status, and economic position must not become grounds for arbitrary refusal, humiliation, differential pricing without legitimate basis, or inferior service.

Discrimination risk often arises through informal practices: refusing a booking because of an accent, subjecting certain guests to unnecessary scrutiny, assigning undesirable rooms selectively, or using stereotypes in fraud detection. Policies should define objective criteria, provide appeal or escalation routes, and require documentation of significant refusals or security interventions.

Ethics in Selling, Service and Surveillance

Ethical selling seeks informed consent and a fair exchange. Employees may recommend room upgrades, packages, late check-out, insurance, transport, or other services, but they should describe material conditions accurately. Pressure created by fear, deliberate ambiguity, concealment of fees, false scarcity, or exploitation of a guest’s distress is unethical and may also violate consumer law. Sales targets should therefore be balanced with measures of complaints, cancellations, guest understanding, and compliance.

Surveillance presents a difficult governance problem. Cameras and monitoring systems may protect people and investigate incidents, but excessive or hidden surveillance undermines dignity and privacy. A responsible surveillance programme defines purpose, location, access rights, retention, signage, review, and deletion. Cameras should not be placed in areas where people reasonably expect intimate privacy. Facial recognition and other biometric tools require heightened scrutiny because they can create disproportionate effects, false matches, and irreversible privacy consequences.

Ethical decision-making can be structured through five questions: Is the action lawful? Is it necessary for a legitimate purpose? Is it proportionate? Would it treat comparable people fairly? Could the decision be explained openly to the affected person and defended before an independent reviewer? If the answer to any question is negative, escalation is appropriate.

Governance and Accountability

Governance is the system by which the hotel directs and controls its activities. It clarifies who may decide, who must be consulted, who executes the decision, who checks it, and who is accountable for outcomes. A practical governance model combines board or ownership oversight, general management responsibility, functional ownership, operational procedures, and independent review.

The three-lines perspective is useful. Operational employees and managers constitute the first line because they own daily risks. Specialist functions such as security, information technology, human resources, finance, privacy, and compliance provide the second line through advice, standards, and monitoring. Internal audit or another sufficiently independent reviewer forms the third line by evaluating whether governance and controls are effective.

A governance dashboard should focus on meaningful indicators rather than volume alone. Possible measures include unresolved safety incidents, response time, repeat key failures, unauthorised access attempts, payment discrepancies, privacy incidents, training completion, accessibility complaints, emergency-drill performance, and overdue corrective actions. Managers must resist the temptation to manipulate indicators by redefining incidents or discouraging reporting. A low reported incident rate may reflect silence rather than safety.

Whistleblowing and speak-up systems are essential when employees fear retaliation or believe a supervisor is involved in misconduct. Reports should be received confidentially where possible, assessed impartially, investigated proportionately, and closed with documented reasoning. Accountability means not only assigning blame after failure but also examining whether targets, staffing, technology, or leadership created predictable conditions for failure.

Technology, Automation and Artificial Intelligence

Technology can strengthen control through electronic access logs, automated reconciliation, identity verification, incident-management platforms, privacy settings, and analytics that reveal unusual patterns. For example, repeated manual overrides, after-hours access, unusually frequent refunds, or multiple accounts linked to similar payment behaviour may justify review.

Automation is not a substitute for judgement. A system may produce false positives, inherit biased data, or make an inaccessible process more difficult. Automated denial of a booking or payment should have a human review route, especially where the consequence is significant. Access logs should be protected because they can themselves reveal movements and personal patterns. Vendor systems require due diligence concerning security, data location, breach notification, retention, and subcontractors.

Generative AI may assist with drafting incident summaries, translating routine information, or identifying patterns in anonymised service data. It should not be given unrestricted access to guest records, nor should its output be treated as verified fact. Human review, approved tools, prompt and data controls, and clear accountability are necessary. Sensitive decisions involving safety, discrimination, legal rights, or a guest’s identity should remain subject to competent human oversight.

Illustrative Case: The Unauthorised Room Access Incident

Background

Harbour View Hotel uses electronic room keys and a central property-management system. A front desk agent is approached late at night by a person who claims to be the partner of a registered guest. The person provides the guest’s name and says that the guest is asleep and cannot answer the telephone. The visitor displays a photograph of an identity document on a mobile phone and asks for a replacement key, stating that the original was lost.

Situation and problem

The agent, concerned about upsetting a valuable guest, issues a key without contacting the registered guest or a supervisor. The visitor enters the room, takes a laptop and jewellery, and leaves. The guest reports the theft the next morning. The electronic log shows the replacement key was issued by the agent, but the identity document was not copied or verified through the approved process.

Analysis

The immediate failure was weak identity verification and unauthorised key issuance. Deeper failures included inadequate training, pressure created by an informal service culture, absence of a mandatory second approval for exceptional key requests, and insufficient review of access logs. The incident also raises privacy concerns: the employee may have disclosed that the person was staying at the hotel and may have confirmed the room location.

Approach and solution

Management first supports the guest, preserves the key and system records, and reports the event through the required internal and external channels. It avoids admitting unverified legal liability while communicating honestly about known facts. The hotel then introduces a controlled replacement-key procedure: the guest must present approved identification or complete an alternative verification process; exceptional cases require supervisor approval; room numbers are never spoken publicly; and staff may not confirm a guest’s presence to an unauthorised caller or visitor. Training uses role-play rather than only written instructions. Daily exception reports are reviewed by the front office manager and security officer.

Outcome

The new controls reduce convenience in a small number of exceptional situations, but they improve protection for all guests. Employees become more confident in refusing unsafe requests because the procedure gives them managerial support. The hotel also learns that access technology is effective only when human processes around it are reliable.

Learning points

The case demonstrates that hospitality does not mean unrestricted accommodation of every request. Verification is a service responsibility. It must be respectful, consistent, documented, and designed to protect both the guest and the employee.

Common Weaknesses and Managerial Challenges

A frequent mistake is treating compliance as a document-production exercise. Policies copied from another property may not reflect the building, workforce, legal environment, or technology actually in use. Another weakness is training employees once and assuming competence. High-risk procedures require induction, refreshers, drills, supervision, and testing.

Other recurring problems include excessive data collection, shared passwords, uncontrolled spreadsheets, unclear vendor responsibility, poor night-shift support, under-reporting of near misses, inaccessible emergency instructions, inconsistent exception handling, and targets that reward revenue while ignoring guest harm. Managers should also beware of security theatre: visible controls that create an appearance of safety but do not reduce meaningful risk.

Controls can create trade-offs. Strong identity checks may increase arrival time; extensive surveillance may reduce some crime while weakening privacy; strict refund controls may protect revenue while harming legitimate guests; and automated fraud screening may improve detection while producing discriminatory outcomes. The appropriate response is not to eliminate control, but to design proportionality, human review, transparency, and appeal into the system.

Current Developments and Best Practices

Hotels increasingly operate through interconnected platforms, cloud services, mobile keys, digital identity, contactless payment, and online distribution channels. This increases convenience but expands the attack surface and the number of organisations handling guest data. Supply-chain security, vendor assurance, encryption, multifactor authentication, system resilience, and timely patching are therefore front office concerns as well as IT concerns.

Best practice is characterised by the following principles:

• Establish one integrated risk register covering safety, security, privacy, finance, law, and ethics.
• Assign a clear owner and escalation route for every significant control.
• Use scenario-based training and drills, including accessibility considerations.
• Apply least privilege, segregation of duties, secure authentication, and documented exceptions.
• Collect only necessary data and define retention and disposal rules.
• Explain prices, terms, limitations, and optional products honestly.
• Review surveillance and automated decisions for necessity, bias, proportionality, and human oversight.
• Encourage incident and near-miss reporting without retaliation.
• Test controls through audits, simulations, access reviews, reconciliations, and guest feedback.
• Treat every incident as an opportunity for organisational learning rather than only individual punishment.

Chapter Summary

Front office safety, security, law, ethics, and governance constitute a unified managerial responsibility. Safety protects people from hazards and emergencies; security controls intentional threats and unauthorised access; law establishes enforceable duties; ethics guides fair and dignified conduct; and governance allocates authority, monitoring, and accountability. Effective management follows a cycle of identifying, assessing, preventing, detecting, responding to, and learning from risk.

The chapter examined emergency planning, access control, incident reporting, contracts, compliance, privacy, payment security, accessibility, ethical selling, surveillance, technology, and artificial intelligence. It emphasised that controls must be proportionate, inclusive, documented, and workable in real operations. Technology can strengthen control but cannot replace human judgement, training, oversight, and responsible leadership. The central professional obligation is to protect people and information while preserving trust and treating every guest and employee with dignity.

Key Terms

Access control: Procedures that regulate who may enter a room, area, system, or record.

Business continuity: The capacity to maintain or restore essential operations during disruption.

Data minimisation: Collecting and retaining only the information necessary for a defined purpose.

Duty of care: The responsibility to take reasonable measures to prevent foreseeable harm.

Ethical selling: Offering products or upgrades honestly, transparently, and without undue pressure.

Governance: The structures and processes through which an organisation is directed and held accountable.

Incident: An event or near miss that causes, or could cause, harm, loss, disruption, or non-compliance.

Least privilege: Granting only the access necessary for a person’s authorised duties.

Payment security: Controls protecting payment transactions, credentials, systems, and financial records.

Privacy: The appropriate control of personal information and individual exposure.

Proportionality: Matching the intensity of a control to the seriousness and likelihood of the risk.

Regulatory compliance: Conforming to applicable laws, regulations, licences, standards, and official requirements.

Risk register: A documented record of risks, controls, owners, ratings, and review actions.

Segregation of duties: Dividing responsibilities so that one person cannot complete and conceal a sensitive transaction alone.

Surveillance governance: Rules concerning the purpose, use, access, retention, and oversight of monitoring systems.

Whistleblowing: Reporting suspected wrongdoing through protected internal or external channels.

Reasonable adjustment: A modification that enables equitable participation by a person with an access need.

Purpose limitation: Using personal information only for specified and legitimate purposes.

Review Questions

Short Answer Questions

1. Distinguish between safety and security in front office operations.

2. What is meant by the principle of least privilege?

3. State two requirements of an effective emergency plan.

4. Why is data minimisation important at the front desk?

5. What is segregation of duties in payment control?

Long Answer Questions

1. Explain how a hotel can integrate safety, security, legal compliance, ethics, and governance into one risk-management system.

2. Discuss the front office manager’s responsibilities in protecting guest privacy and confidential information.

3. Examine the ethical and managerial issues involved in surveillance and automated decision-making.

4. Describe the controls required for secure room-key issuance, incident reporting, and access review.

5. Explain how accessibility and equality should influence emergency planning and daily front office service.

Analytical / Application Questions

1. A guest asks the desk agent to disclose the room number of a friend who is not answering the telephone. Analyse the risks and propose an appropriate response.

2. A hotel’s automated fraud system rejects bookings disproportionately from one customer group. What governance, ethical, and operational steps should management take?

3. During a payment-system outage, arriving guests need to check in while the hotel must protect revenue and personal data. Design a temporary control procedure and identify its limitations.

22. Multiple Choice Questions with Answers

Question 1

Which control best reflects the principle of least privilege in a hotel front office?

A. Giving every employee access to all guest records

B. Giving employees only the system access needed for their assigned duties

C. Allowing supervisors to share one common password

D. Removing access controls during busy periods

Correct Answer: B. Giving employees only the system access needed for their assigned duties

Question 2

A caller asks whether a particular guest is staying at the hotel. What is the most appropriate response?

A. Confirm the stay if the caller knows the guest’s name

B. Give the room number but not the guest’s schedule

C. Avoid confirming the guest’s presence and follow the approved verification procedure

D. Transfer the caller directly to the guest room

Correct Answer: C. Avoid confirming the guest’s presence and follow the approved verification procedure

Question 3

Which practice most effectively supports payment security?

A. Recording card details in a personal notebook

B. Allowing one employee to receive, reconcile, and approve all refunds

C. Using approved systems with role-based access and documented reconciliation

D. Storing payment credentials in an unsecured spreadsheet

Correct Answer: C. Using approved systems with role-based access and documented reconciliation

Question 4

Why should near misses be reported even when nobody is injured?

A. They provide evidence of employee misconduct in every case

B. They reveal weaknesses before more serious harm occurs

C. They eliminate the need for emergency drills

D. They are required only for insurance claims

Correct Answer: B. They reveal weaknesses before more serious harm occurs

Question 5

Which example best illustrates ethical selling?

A. Hiding mandatory charges until checkout

B. Creating false scarcity for an upgrade

C. Explaining the price and material conditions of an optional package clearly

D. Pressuring a distressed guest to purchase additional services

Correct Answer: C. Explaining the price and material conditions of an optional package clearly

Question 6

What is the principal purpose of data minimisation?

A. To collect as much information as possible for future use

B. To restrict collection to information necessary for a defined purpose

C. To prevent all employees from using operational information

D. To replace data retention policies

Correct Answer: B. To restrict collection to information necessary for a defined purpose

Question 7

A replacement room key is requested by a visitor who cannot satisfy the hotel’s identity-verification procedure. What should the agent do?

A. Issue the key to preserve hospitality

B. Announce the room number and ask nearby guests for confirmation

C. Refuse politely and escalate according to the approved exception process

D. Ask the visitor to sign a waiver and issue the key

Correct Answer: C. Refuse politely and escalate according to the approved exception process

Question 8

Which governance arrangement provides the strongest independent assurance?

A. The employee performing a task alone checks and approves it

B. An independent audit or review evaluates whether controls work effectively

C. Guests are expected to monitor the hotel’s internal controls

D. Managers rely only on informal verbal reports

Correct Answer: B. An independent audit or review evaluates whether controls work effectively

Question 9

Why is human review important when automated systems identify suspected fraud?

A. Automated systems never detect genuine risk

B. Human review can identify false positives and disproportionate outcomes

C. Human review makes privacy controls unnecessary

D. It permits staff to ignore documented procedures

Correct Answer: B. Human review can identify false positives and disproportionate outcomes

Question 10

Which statement best describes proportionality in front office security?

A. The strongest possible control should always be used

B. Controls should match the seriousness and likelihood of the risk

C. Security controls should apply only to unfamiliar guests

D. Convenience must always override security

Correct Answer: B. Controls should match the seriousness and likelihood of the risk