RWE is one of the five leading electricity and gas suppliers in Europe. The concern is active in power generation, energy trade as well as the transport and sale of electricity and gas. Over 70,000 ­employees supply more than ­16 million customers with electricity and around 8 million customers with Gas. In the 2010 business year, RWE achieved a turnover of around € 53 billion. Our ­scientific ­editor Heiner Jerofsky spoke with the Head of Company Security, Michael Schmidt about the importance of his area of responsibility as well as about security objectives and strategies, and his personal opinion of the situation.

Could you explain the Company Security division to our readers, its prime tasks and role within the worldwide concern?

Michael Schmidt: The spectrum of company security is broad. Starting with a risk analysis, we take on responsibility for strategic aspects like object protection, event protection, personal and information protection, but also travel security, forensics and cyberforensics, crisis management, Business Continuity management and Security Regulatory Affairs belong to the essential tasks of company security. The strategy provides the framework and the guidelines and builds the corresponding processes. Security compliance audits then close the control loop. The company security is established within RWE, and its importance has been confirmed many times in previous years. The responsibilities mentioned before were discussed together with the various companies within the concern, and interfaces and reporting channels with the Security Division agreed upon. Company Security is always there operatively, for example, for forensics, emergency exercises and individual subjects (such as evacuation of the DEA employees in North Africa) when multiple concern companies are affected or if there is an unusual situation. Through the speed of modern-day communications (internet, Twitter etc.) we have found that the big problems or questions always land at group headquarters. The Company Security division is located in the Group Center of RWE AG, and I report from there to the Personnel Director.

The Corporate Governance of RWE dictates that I am also technically responsible within a specified framework for the subject within the group companies. Company Security - as a higher-ranking, controlling organizational unit - consists of experts for the various areas of expertise. There is one ‘single point of contact‘ Security Manager in each group company who looks after the operative implementation. Besides that there is a ‘Security Services‘ division within RWE Service GmbH in which the operative services are bundled. I am also joint divisional Head in order to guarantee uniform management. That means: "What I strategically plan, I must also operatively implement". With this degree of realization in this way we get close to the so-called Business Enabler.

How complex are the security requirements of an energy provider in fact?

Michael Schmidt: If you just consider electricity as something natural that comes out of the socket then power supply looks very simple. If you look behind the scenes, however, you see very complex, partially inter-networked structures. From the security point of view, there are central administration buildings with many employees and decision-makers. There are technical control centers and also ‘trading floors‘. On the generation side there is a portfolio of large fossil power stations that are permanently manned and smaller installations, such as those for renewable energy sources, where as a rule there are no employees on site. In front of the large fossil power stations are the supply lines of the energy carriers or, in the case of RWE, our own coal mining. RWE operates the only crude oil drilling and pumping rig in Germany. By comparison, the distribution of electricity demands a completely decentralized structure. There are only very few permanently manned locations, a multiplicity of switching stations at different voltages (transformer stations, local network stations etc.) and lots of lines and masts in between them. I could continue the list indefinitely and would not even start to relate our activities abroad. The message here is: you have to understand the physical and commercial sides of the business and set priorities on the basis of an integrated total security concept, otherwise there is a real danger that you end up just spinning your wheels.

What particular objectives and strategies do you and your employees follow primarily and how high is the damage for your concern that arises from criminal activity?

Michael Schmidt: We have defined six significant strategic measures: