Die Anschläge in New York und Washington am 11

Action required/ 
measures
Has a binding risk policy been defined for the 
entire company? 
Is there a specific risk policy in place for 
individual areas within the company? 
Are all potential risks to the company identified 
and evaluated, including 
─ risks from natural events, 
─ risks from human error/technical failure, 
─ risks from terrorism and/or criminal abuse? 
Are environmental risks (e.g. power stations, 
railway lines) considered? 
Are the target security standard and the 
accepted risk defined overall and according to 
risk categories?
Are all risks within the acceptable scope of 
residual risks? 
Are risk management measures in place in all 
individual areas within the company (natural 
events, human error/technical failure, terrorism / 
criminal abuse), and are these coordinated? 
Are there appropriate instruments in place for 
regular risk monitoring (early warning systems, 
risk controlling)? 
Are decisions relating to risk financing based on 
medium-term and long-term cost/benefit 
analyses? 

---

- 73 - 
 
Emergency planning and contingency planning
 Yes
No
Plan-
ned
Action required/ 
measures
Do you have a manual for crises and 
emergencies? 
Are areas of responsibility in the event of an 
emergency defined? 
Are there crisis and emergency plans in place 
for selected incidents? 
Are emergency exercises carried out regularly?
Are reporting channels and decision-making 
powers organised for possible incidents? 
Are cooperative arrangements with the 
competent authorities in place for major 
incidents? 
Have crisis and emergency plans been agreed 
with the competent authorities? 
Is sufficient emergency power capacity 
available, also covering the security 
installations? 
Have technical and organisational fire protection 
measures been undertaken? 
Fire extinguishers 
Fire alarm systems 
Personnel training 
Escape routes 

---

- 74 -