Locked in the Vault by Barry Thompson

A major fear of many financial institution staff is being locked in the vault during a robbery. The question for many financial institutions is, are you prepared for such an incident? When conducting vulnerability studies for many financial institutions, we have found that most of them are not prepared for such an incident. Using risk management that has been imposed on so many institutions, a senior manager might respond, “What is the likelihood of this happening?” We have no good statistics on this event, however, all it takes is one incident that could lead to a three-year lawsuit and loss of trust by staff.

The first step in preparing your staff is training them on what to expect! A robber who wants to lock your staff in the vault doesn’t want to hurt staff. Once they are in the vault, they are actually safe from being shot or abused in some way by the robber(s). The question is: does your staff know how to activate the air ventilator into your vault? When posing this question to many staff members, we normally find that they don’t have a clue!

If you have been locked in the vault, the first thing you should do is activate the air input. Some older vaults have a cylinder that must be removed from the airway to allow oxygen to flow. During our reviews, we find that filing cabinets, safe deposit boxes, or stacked boxes don’t allow enough room to remove the cylinder. In other vaults, you need to remove a screw from the air ventilator to activate the fan to push oxygen into the room. You might also have to turn a handle on the ventilator to activate it. When visiting locations with these vaults, we will take a staff member into the vault and ask them to activate the air for the unit. In many cases, this person is afraid to even touch the equipment and once they do, they aren’t sure if they are doing it right. Eventually, they figured it out. Remember, during our test the vault door is open, and they haven’t experienced a traumatic incident before being placed into the vault. So, then our next question is, has your staff ever been taught and activated the air ventilator to your vault?

The second thing we like to observe is a telephone or alarm device in the vault that can be used to signal there is a problem. Recently we had a client who had done almost everything right except they hadn’t checked the vault telephone. The telephone was hooked up, it just didn’t work! We recommend that a second phone be placed in the vault in case a robber destroys the one in plain view. The third item we review is where are the keys kept that open the interior glass door to the vault? Many times, we find the key to the interior door is kept with the keys that unlock the door from the outside. Some vaults, for example, have a device that covers the combination dial with a lock. That key will have attached to it the lock to open the interior glass door that shields the time clocks. These keys are kept someplace outside of the vault to open in the morning. We find that with most of the vaults, access to the time locks can be invaluable. Did the robber activate the time locks when closing the door or was a staff member inside the vault when they were accidentally locked in? How could that happen?

We have been inside many vaults that have two rooms or areas that are shielded from the vault door. Some vaults will even have a side area for safe deposit boxes. Consider if someone is locking the vault door and they are in a hurry to get to an after-work event, they call into the vault and the person inside doesn’t speak soon enough or pays no attention to the person closing the door until the lights go out. At this point, the vault door is locked for what may be a three-day weekend. That’s when panic will instantly set in as the staff member tries to figure out what are they going to do.

If your staff members can open the glass door inside the vault, they can gain access to the time clocks. When your vendor arrives onsite, the technician can explain to the staff member locked in the vault how to open the glass door and run down the time locks. Everyone reading this article needs to check with their security vendor to be sure this is true with your vault. We cannot cover every type of vault ever built so the security officer needs to know how your vault and alarms operate.

The final step is, does the financial institution have a written procedure for the above steps? It is important that someone writes the procedure and another person who has no knowledge of how the vault operates follows the steps listed in the procedure. All too often the person writing a procedure overlooks a simple step like turning the handle to the right to open the ventilator. While this may sound picky, it isn’t when a person with claustrophobia is panicking while trying to follow a poorly written procedure. You want to be sure the directions are clear and can be followed even by a child who is just learning to read.

Internal auditors conducting an audit of security in this area should be sure that staff members have touched and activated the air ventilator. During one review, we were told that all the information needed to perform these steps was in a safe deposit box located in a very large vault with two rooms. When quizzing staff, we found they all knew that the information was in a safe deposit box – but they didn’t know which one was the right box! We even tried to find some markings that would tell us the secret location of that box, but we couldn’t. During our exit interview with senior management, they became angry with us stating, “everyone in the institution knew about the safe deposit box location.” We responded with, “show it to us before we leave, as your staff has stated they don’t know where it is!” No one ever showed us the location of the magic safe deposit box, so the comment went into our review. I have hoped every day that no one gets locked into that vault that everyone allegedly knows how to escape from, but they don’t know where the right safe deposit box is located. Don’t be that financial institution!

None of the checklist steps below requires anyone to be locked in the vault!

Sign up for Thompson Consulting Group's newsletter for more on risk management and security at your financial institution. Also check out Barry's library of CUWN webinars that include: