Showing posts with label Risk management. Show all posts
Showing posts with label Risk management. Show all posts

Friday, February 3, 2017

Risk Management

Businesses banning guns
May put clients in danger

THE OTHER DAY I was in a medical clinic. As I approached the door I read a sign that read “No guns allowed, not even with a concealed carry permit.”

Fortunately I had left my canon in the gun safe so I went on inside.

As I did, I had two thoughts about the rule.

Thought 1: Would a potential terrorist abide by the clinic’s rules? (Do they abide by the rules in Chicago, LA, and New York City – the answer, based on FBI statistics, is a resounding NO.)

Thought 2: If a potential terrorist started shooting — as did the fellow in my local airport (Fort Lauderdale-Hollywood International) — would there be any way to stop the shooter. I did not see any armed guard or police presence in the clinic.

Apparently others had the same thoughts.

ADVISEN FRONT PAGE NEWS (FPN), an insurance-focused source, included as its first item on 3 FEB Florida businesses that ban guns could be held liable for leaving patrons defenseless.

A Miami Herald piece by Kristen M. Clark of the Herald’s Tallahassee bureau bore the same headline.

Ms. Clark poses a question:

    Say a movie theater in Florida banned its patrons from carrying concealed handguns, but a mass shooter came in anyway and attacked — not unlike what happened in Aurora, Colorado, almost five years ago.

Having posed the query, she continues that Under an NRA-backed measure proposed this week in the Florida Legislature, victims who had a permit to carry a concealed weapon could sue the theater for damages, because its weapons ban left them disarmed when they might have been able to use their gun to thwart or stop the attack.

The Herald article continues:

    “It’s the premise in Florida that if a private business wants to prohibit guns in their location that’s open to public, that’s fine; they can do that,” Senate Judiciary Chairman Greg Steube said. “But if you’re going to do that, in my opinion, I should have some assumption that I’m going to be protected as a conceal-carry permit-holder because you’re taking away my ability to defend myself.”

    The proposed law change would subject private businesses to potential civil penalties if an incident happens that “could reasonably have been prevented” had guns and other weapons not been banned.

    About 1.7 million people have concealed weapons permits in Florida, the most of any state in the country.

In the airport

Florida law bans guns in airports, even in “unsecured” (before TSA screening) areas.

The liberal web site Think Progress has an article by Bryce Covert headlined Days before airport shooting, Florida lawmakers worked on bill to allow guns in airports that claimed the shooting at FLL was the was the sixth mass shooting in the U.S. so far this year. Ms. Covert did not bother to note that it was the only incident at an airport.

She noted that Florida lawmakers began rallying support for SB 140, a state bill that would repeal laws which, among other things, ban guns in airport terminals like the one where the shooting occurred. If passed, the legislation would allow those with concealed carry licenses to bring guns into passenger terminals.

Specifically, SB 140 states:

    An act relating to openly carrying a handgun; amending s. 790.06, F.S.; authorizing a compliant licensee to openly carry a handgun; revising the list of specified locations into which a licensee may not openly carry a handgun or carry a concealed weapon or firearm; reenacting s. 790.053(1), F.S., relating to the open carrying of weapons, to incorporate the amendment made to s. 790.06, F.S., in a reference thereto; providing an effective date.

In particular, the modified S. 790-06 would prohibit weapons

9.(14.) Inside of the sterile area of any airport or

10.(15.) Any place where the carrying of firearms is prohibited by federal law.

The numbers in parenthesis (* *) are from S. 760.06 FS as it currently reads.

The bill is available on-line as a text file and in Portable Document Format (PDF).

IN THEORY, if the modified law was in force, a person with a carry permit, might have been able to shoot the attacker, saving lives. The reason for the “in theory” is that the person firing at the attacker needs to take into consideration innocent by-standers; the same reason cops don’t fire into crowds.

Interestingly, the revised law would permit open carry as well as concealed carry. There are many pros and cons to open carry that probably will be debated by Florida’s legislators.


Related web sites

Sun Sentinel time line

NeoGAF blog opinions

Florida Senate Bill 610 “find a balance” between gun owners’ rights and private property rights”

Sunday, November 8, 2015

ERM-BC-COOP:

Unvetted ground crews
Threaten air passengers

 

AT THE RISK OF REPEATING MYSELF . . . AGAIN, getting an explosive device on board an airplane is easily accomplished.

All it takes is a disgruntled employee and some impetus - such as money - or an employee with an agenda - such as a Daesh (a/k/a ISIL/ISIS) - to kill people for pleasure and political gain.

There are a number of likely candidates that have unfettered access to commercial passenger and cargo planes. Alphabetically:

    Catering crews Cleaning crews
    Luggage handlers
    Refueling crews
In fact, anyone who can approach an aircraft and look like they have reason to be where they are.

In some airports, soldiers and police guarding the plane might be suspect.

All it takes is one person to slaughter 224 people on Oct. 31, 2015; 224 people returning home on an 18-year-old Airbus A321-231 after a visit to Sharm el Sheikh in the Egyptian Sinai.

No need for on-board highjackers a la the four aircraft on 9-11-2001, no need to rig a bomb in an innocent looking device such as the radio a terrorist's throw-away girlfriend carried aboard Pan Am flight 103 that crashed over Lockerbie, Scotland on 21 December 1988.

No need, even, for a fuel "mishap" such as the one that resulted in a fire on the Caracas-bound Dynamic International Airways' Flight 405 a Boeing 767-269ER on a taxiway at Fort Lauderdale/Hollywood International Airport (in Dania Beach FL) on October 30, 2015.

The NTSB found that the main fuel supply line coupling assembly had disconnected in the wing-to-engine strut above and behind the left engine. The NTSB did not suspect terrorism.

THERE ARE WAYS TO PROTECT aircraft from terrorists, and there is one - just one - airline that has proven its ability to protect ifs fleet and the people - passengers and crews - that fly those plane.

When the planes are being prepared for flights, airline security personnel are present around the aircraft and inside the aircraft.

Ground personnel and vendor personnel on vetted by the airline's security personnel before they can approach the plane - and still these "vetted" vendors' personnel are watched. It's not impossible to get an explosive on board, but it would be exceedingly difficult to do so.

There remains the possibility that terrorists armed with easily purchased missiles from any number of sources, could be fired at the plane while it is on the ground or during take-off or landing. The planes of this one company have on-board systems to detect incoming missiles and to prevent the missile from hitting the aircraft. So far the system has proven successful.

Bringing down a commercial aircraft is not impossible, but with a little risk management thinking, the threat can be mitigated almost out of existence.

But the airlines don't want to hear it. In the U.S., proving Homeland Security's shortcomings gets people arrested - while nothing is done to close the gap in security procedures.

Until airlines DO "get serious" about security, more disasters such as Metrojet 9268 will continue and people will continue to die.

Wednesday, June 24, 2015

ERM-BC-COOP:

Professional & personal
Risk Management thoughts

 

THING ONE: The Mlivbe.com reports that

    Contractors began removing asbestos on May 8, and three weeks later tests revealed elevated levels of asbestos in the air that workers and students breathe every day. The most logical way asbestos could penetrate multiple levels of this building is if construction crews unknowingly disturbed or attempted to improperly remove the substance.

    Asbestos exposure is very dangerous and the chemical should be removed by highly skilled workers with the proper training to prevent it from putting students and the public at risk. Fortunately, there are strict laws when it comes to the removal of asbestos.

Bottom line: using inexperienced people can be dangerous to your health - and wallet.

THING TWO: The Washington Post's Christie Aschwanden warns Check your health records: You may be able to avoid trouble that a review of your personal medical records may turn up some less than accurate information. (Personal aside: I checked my records and found several errors.)

ADMITTEDLY, reviewing personal medical records would NOT seem to fall under any Risk Management heading, but incorrect medical records are very much a risk, both to your health - as detailed in the Washington Post article - and to your wallet.

In the case of Ms. Aschwanden of the WashPost, she "discovered" that she had multiple pregnancies which came as a surprise to the childless woman.

She also discovered that her primary care doctor, a/k/a GP (general practitioner) was reporting discussions that never occurred. Not exactly fraud. But neither was it honest.

The article notes that Under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), you have a right to view and obtain a copy of your medical record, Rachel Seeger, a spokeswoman for the U.S. Department of Health and Human Services’ Office for Civil Rights, said in an e-mailed statement. If you find inaccuracies, HIPAA gives you the right to have these errors corrected. The caveat is that patients may be charged a "reasonable" fee to copy and deliver paper records.

LIKEWISE ADMITTEDLY, a Risk management practitioner probably lacks direct input into contracting practices for the organization.

However, the Risk Management practitioner should have input on the organization's policies and procedures, and hiring qualified, licensed, and insured vendors most assuredly IS part of a Risk Management practitioner's function.

"Things" still happen, but at least the practitioner's organization can show it did due diligence when government inspectors and insurance claims people show up at the door.

As the Mlive article boldly notes: The truth is, skilled labor isn't cheap, and cheap labor isn't skilled.

Akin to the old Fram commercial, "You can pay me now (for an oil and filter change) or pay me later (for an engine overhaul or replacement), it may cost more initially to hire qualified workers to do the job right the first time than it costs to pay to repair damage done by unqualified workers. (A bit like hiring a Risk Management tyro when an experienced practitioner really is needed.)

One of the differences I perceive between "business continuity" and "enterprise risk management" is that in most cases, practitioners only have input to policies and procedures in the latter (risk management).


Monday, December 8, 2014

ERM-BC-COOP:

Profitability linked
To risk management

 

Headlined ‘Ground-breaking’ link between risk management and profitability, The Wharton School of the University of Pennsylvania, includes “ground-breaking findings about links between board’s oversight of risk, financial performance and the volatility of a company’s share price,” the insurer Aon, which sponsored the effort, said.

Aon released its latest Risk Maturity Index Insight Report and it reveals a direct link between profitability and advanced risk management practices.

According to the article in Insurance Business, Marcus Vaughan, regional lead of the Aon Risk Maturity Index for Australia said of the findings: “The evidence is clear: there is a direct positive correlation between advanced risk maturity, an organization's understanding of risk management practices, and enhanced financial performance when considering key metrics such as Return on Equity and Return on Assets. This in turn speaks directly to directors’ obligations to maximize shareholder value.”

Australia leads the way internationally when it comes to understanding and managing risk at the appropriate level, the report found. the report continued.

The Aon/Wharton School report puts a value on risk management by comparing organizations with high risk ratings to those with low rating, both on price volatility and return on equity performance.

The article states that The report found that companies with the highest rating on the risk maturity index, a 5.0, experienced share price volatility 34% lower than those with the lowest score available, a 1.0.

The highest rating also resulted in a 42% return on equity performance compared with a negative return of -23% for companies at the lowest end of the spectrum.

The entire article may be read at http://tinyurl.com/q4aspy8.


Wednesday, August 13, 2014

ERM-BC-COOP:

Is your vendor reliable?
Was "due vigilance" done?

 

The recent or perhaps ongoing Hamas attacks on Israeli civilians and Israel's counter-attacks bring focus on vendors' reliability to produce and deliver.

I lived in Israel and worked for Tadiran which once billed itself as Israel's General Electric. My job in Israel was with the Electronics Division. This division was mostly defense oriented. I later worked for Tadiran's Telecom Division in Florida.

Between the two Tadiran jobs I became well acquainted with the problems a vendor can encounter and, by extension, the problems a vendor's client can encounter.

As with most things "Risk Management," most of the risks can be avoided or at least mitigated.

Some of the more obvious - to this scrivener, anyway - risks and remedies are addressed in this blog entry.

CAVEAT: The following is NOT intended to be all-inclusive - there always is the "ubiquitous other" that you'll only discover by working with other practitioners and process Subject Matter Experts (SMEs).

Evaluating vendor reliability

Vendors should be at least as risk conscious as your organization.

I once contracted with a major T&E company's Vendor Management (VM) Group. My job was not only to assure that my client - the VM group - could weather any storm, but to look at the group's critical vendors' abilities to survive when "things went bump in the night."

All of the vendors had the standard SLAs for their deliverables, but an SLA by itself is a bit like a politician's promise.

With my client's permission, I asked each of the critical vendors for their business continuity plans. Each vendor supplied its plan; I reviewed and critiqued the plans, then provided both my client and the vendors with my critique. (Vendors only saw the critique of their own plan.)

It was a win-win-win situation.

It was a WIN for my client since it now had a level of confidence in the vendor's ability to meet its SLAs "no matter what."

It was a WIN for the vendor since its plan was critiqued, gratis, by an outside professional. A plan created in a vacuum rarely is a viable plan; even mine.

Finally, it was a WIN for me since I learned about risks and remedies I had not previously considered.

A requirement to provide my client with a business continuity plan before any new contracts were let became the Vendor Management Group's policy.

Financial help or alternate vendors

Assume - and I know that is a dangerous thing - for a moment that your organization has a vendor it REALLY wants as a business partner. Maybe the vendor is owned by a board member or the CEO's sister-in-law. The reason is immaterial.

Continuing the assumption, assume that the vendor's business continuity plan is found wanting; there is evidence that "in the event of," the vendor would fail to meet its SLA with your organization.

What to do?

There are two (2) basic options (there may be more, ergo the weasel word "basic").

Option One: Offer financial help to get the vendor to a state that it will be able to meet its SLAs - at least to your organization - "no matter what." Part of this assistance must include protecting your investment and that means independently researching the vendor's financial worthiness.

Option Two: Consider alternate or back-up vendors. The problem with back-up vendors is that your organization always will play second fiddle to the vendor's primary customers . . . unless your organization is willing to pay a super-premium for preferential service.

Vendor's vendors

The specifics may be hard to come buy, but you need to know about the vendor's vendors.

Are the vendors providing hard-to-get resources? Are the vendors prone to work (in)actions? Do the vendor's vendors have delivery problems such as described under the War zones and other "inconveniences" heading below?

If the vendor's vendors don't meet muster for whatever reason, your vendor must, as you did in Financial help or alternate vendors above, show you that it can avoid or mitigate its vendors potential situations.

Getting from Point A to Point B, C, and D

Transportation is a risk that goes away only when the product or service is delivered to the final client/end user.

Your vendors and your vendor's vendors need plans to assure continued delivery of resources - raw materials, products, personnel - despite interruptions such as (an alphabetical sampling)

  • Fire and police lines
  • Parades and other right-of-way blockages
  • Pirates and other highjackers (on land, sea, and in the air)
  • Port strikes
  • Railway strikes
  • Roadway closures
  • Terrorists
  • Trucker strikes
  • War and lesser conflicts

Your organization also has to consider how it gets its product or service to your client. If your client is a middleman, you also need to consider

  • How the middleman markets your product, particularly in light of the competition - both competition within the middleman's business and from the middleman's competitors hawking a competitor to your product
  • How the middleman gets your product to the final client/end user

War zones and other "inconveniences"

Blockades and embargos

Blockades take many forms.

During the War for Southern Independence, a/k/a the American Civil War, the Federal (Union) forces blockaded the coasts along the Southern states, preventing cash crops from going to European clients and preventing war materials from reaching the Confederates. Blockades and blockade runners have been a fact of life It seems forever.

There also are blockades of people - picketers, protestors. In most jurisdictions, interfering with freedom of movement is illegal and the authorities usually will assure people - and resources - can come and go. This is true in the U.S.; it may not be true elsewhere.

An embargo properly belongs under the next heading since it is defined as "an official ban on (trade or a country or commodity)."

Politics and public pressure

When I worked for Tadiran's Electronics Division, Israel's Customs went on strike. (At the time, under the Labor government, Israel probably was more strike-prone than any other country; things changed when the government changed and strikes are much fewer even today.)

Israel is a "revolving door" country: it imports raw materials, manufactures something from them, and exports the finished product.

Customs controls both import and export.

With Customs on strike, Tadiran could neither import raw materials nor export what it made. The company was prepared to lay off 10 percent of its workforce if the strike didn't end y a specific date. Fortunately, the strike was settled and we continued in our jobs. (I was a technical writer.)

Embargos can be put into place by politicians under pressure from trade unions, disgruntled customers, or other unhappy constituents.

Public pressure generally is applied directly to an organization by a group that wants to punish the business for any reason. Boycott, Divestment and Sanctions (BDS) actions are a form of public pressure that can be applied to organizations that deal with products or services from a and organization or country the the BSDers find offensive.

Tariffs are, among other things, taxes placed on imports. If a government wants to reduce imports of a specific product, it levies or increases the import duty/tax. Sometimes this is done at the behest of a trade group that wants to "even the playing field" with a foreign competitor that has substantially lower production costs.

As long as nations have armies there will be call-ups of reservists. Then call-up may be to fight or it may be to provide local governments with emergency support following a catastrophic event (think Hurricane Rita). Regardless of the reason for the call up, it will take personnel from their regular jobs; what will the impact be on your organization? ON your vendor's organization?

Dealing with interruptions

In most cases, the way to deal with "things that go bump in the night" is to have an inventory of product that can outlast the outage. Don't forget to stockpile spare parts for critical products.

Figuring how much to stockpile requires working with sales and marketing people, getting their sales projections over a given period - how long a period is a product of your and the vendors' risk management (business continuity) plans. Figuring out how and where to stockpile the materials is another challenge.

As far as combating politics and public pressure, that has to be a "fight fire with fire" issue. Political whims are subject to change, faster if a good case can be made for change. Popular pressure can either be ignored or can be countered with information, although people who wear their politics on their sleeve frequently are intractable.

 

If I wrote it, you may quote it.

Monday, August 4, 2014

ERM-BC-COOP

Dealing with the chaos
Around the Mediterranean

 

I have been on both sides of this concern - working in a country that was nearly strangled by a strike by Custom's clerks and working for the same company elsewhere trying to convince prospective clients that we could meet their service requirements "no matter what."


Civil war in Syria.

Political conflict in Turkey.

Iran - enough said.

Ukraine and Russia.

Turmoil in on the European side.

Remnants of the "Arab Spring."

Israel and the terrorists to the south and the north.

And a few more "to be named later."

If your organization buys products or services from anywhere around the Med you can plan on interruptions of product or service.

The Internet and common carriers are not immune as nations close their borders or are quarantined.

 


Mediterranean and surrounding states

 

Assume - always a dangerous thing to do - that your organization must have a product or service from an area of contention.

Your customers are concerned that your source may be prevented from delivering a product or service they expect due to contract. It is a justifiable concern. How can your organization assure them that it has a risk management plan to protect your clients' interests?

 

Hardware Products

Assuring sufficient hardware products is (relatively) easy.

If the product is electronic, you should know the MTBF* of all critical components in the product. Given the MTBF plus the sales projection it would be relatively easy to "guesstimate" how much product and how many spares need to be warehoused in-country. If your organization is selling very large items - aircraft, ships, and other things that cannot easily be folded and shelved - finding a suitable place to warehouse the product can be a problem, but it is a surmountable problem.

 

Software Products

Products delivered by Internet - software applications, bug fixes, upgrades and the like - also are subject to delivery interruption. The Internet is a "pipe" with government "valves" that can restrict both incoming and outgoing data.

A Guardian article headed Internet censorship listed: how does each country compare? includes a table from the OpenNet Initiative listing countries and how each rates regarding (1) Political Filtering, (2) Social Filtering, (3) Internet Tools Filtering, and (4) Conflict/Security Filtering.

Of the 74 nations listed, only 40 had no Internet restrictions while 5 had "substantial" political filtering. ONI's options were, by severity:

  • Substantial

  • Selective

  • Pervasive

  • No evidence

USA Today identifies its Top 10 Internet-censored countries.

 

Service

Just as a nation can close off Internet flow - or have it closed off by cyber-criminals attacking servers in the victim nation - it also can close its borders to two-way traffic - or, as with cyber-crime, be isolated by its neighbors' closed borders.

In either situation, your organization needs to plan ahead and, while travel is possible, either

  1. Send its personnel to the vendor or

  2. Have vendor trainers come to your organization

to train to a level sufficient to meet client requirements.

In truth, this is no different than if the vendor's site is isolated due to a localized epidemic or any other "natural" cause.

Technical manuals are helpful, but having "factory-trained" personnel with hands-on experience always trumps a manual - paper or digital. That should <

be understood to mean technical documentation - with any updates - is not necessary; it is most assuredly necessary.

I have been a technical writer and a trainer. I remain a reader of manuals and other instruction materials.

Don't forget "the usual suspects"

When reviewing the threats to an international supply chain - be the product or service physical or software - remember all the "routine" supply chain gremlins, including but not limited to

  • Competition
  • Customer fickleness
  • Point-to-point transportation (sea, air, rail, roadway)
  • Work (in)actions
  • Theft
  • Vendor failure (temporary or permanent)

 

* MTBF: Mean Time Before Failure

Monday, July 14, 2014

ERM-BC-COOP:

Same ol' song
One more time

 

At one point in my life I claimed to be a risk management practitioner, a/k/a business continuity planner.

I was certified, first by the no-longer-extant Harris Institute, and then by the Business Continuity Institute (BCI). I even provided Jon Seals with filler copy for the Disaster Recovery Journal.

I also participated on a number of professional boards, exchanging thoughts with others in the trade, from tyros to experts.

I thought I was pretty good at my job. Several of my peers told me they agreed with my self-assessment and surely they wouldn't lie.

But all the time one thing - OK, several things, but this one in particular - bothered me: people sans experience with management positions.

I recently saw an "How do I do" something appeal from a director of business continuity.

This person, as with many others, has the title but neither experience or classroom knowledge (the latter a very poor substitute for experience).

The question was about a fairly common situation that organizations with an international operation face on a regular basis: How to protect personnel traveling abroad and, by extension, how to protect the folks at home from whatever unwanted "gifts" the travelers bring back from "wherever."

The person who raised the issue used The "P" Word, "pandemic."

The "P" word was the first clue that the person posing the question was not a professional risk management practitioner or even a business continuity planner. (The difference between the two is area of responsibility or scope of the position.)

First of all, being concerned with a pandemic shows too narrow a focus. This is the type planning director who would develop a separate and unique "pandemic plan" rather than incorporate the threat, its mitigation options, and the responses appropriate for each threat condition into the overall plan.

If the planner has a big budget and wants to use as much of it as possible, multiple, threat-specific plans are the way to go. Not as effective or flexible as an overall plan, but time and fund consuming - and it looks good to Very Senior Management - "Yes, boss, we have a plan for this and a plan for that, and even a plan in the event of."

I gave the poster a fairly detailed outline to things to do - and action plan if you will - without even looking at the poster's "director" title.

Would I still have offered my free advice?

Maybe not. After all, it seems to this scrivener that a director ought to know most of the information I provided.

One question I have from this (and similar) experiences: Is this the Peter Principle or the Dilbert Principle in action?

Sunday, March 2, 2014

For what does a planner plan?

Risk vs. Impact

 

The Risk

Hundreds of thousands of religious extremists are set to march on Jerusalem. Whether or not "hundreds of thousands" will descend on the Israeli capital is to be seen. My guess is that the turnout will be less than expected, but still there will be a sea of black hats.

In preparation for this event, Israel has ordered streets closed, trains to stop running, and buses to stay at the bus station.

The Impact

Whether or not the risk of the mass demonstration occurs - in any volume - the risk already is impacting the capital.

The impact is that people won't be able to

*    Go to work

*    Go to school

*    Go shopping for essentials (bread, milk, etc.)

*    Get to a hospital or clinic if necessary

Essentially they are trapped in their neighborhoods, if not their homes.

My Question

So how is this different that the impact of a

*    Snow storm

*    General strike

*    Flood

Or any other event that closes the roads?

Not only in Israel

Israel is not the only country to see "million man" marches.

Ask the folks in Washington D.C.

Israel is not the only country to see transportation disrupted.

Ask the folks who were stranded by a volcano's ash.

Two-part planning

Risk management is basically a two-part process.

Part One: Identify the threats and ways to avoid or mitigate them.

Part Two: Identify ways to respond to the threats when, despite our best efforts, they occur.

In Jerusalem's case, the threat - not hundreds of thousands descending on the capital, but the State's accommodation of these people - is the same as if the city had been snowed in. It's the same as if sections of the city were blocked off for a parade or a fire or any number of other "it can happen anywhere" scenarios.

In Israel, most people work on Sunday. Government offices and schools are open. Banks are open. Mail is delivered. Sunday is Israel's Monday.

In Jerusalem - and it could be New York, London, Madrid, Tokyo, any large city even if it is not a nation's capital - business is disrupted.

The Question

As a planner, should you plan

   a: For the specific risk

  b: For the impact

From my perspective, planning for the SPECIFIC risk is a waste of energy.

Rather than planning for "a million man march on the capital," plan for a disruption of movement. The bottom line is it really doesn't matter WHAT caused the disruption, there is a disruption.

Granted, considering the sundry causes of the disruption is useful in considering means to avoid or mitigate the risk; e.g., having snow removal equipment on hand or having additional buses to accommodate rail passengers and having alternate routes for those buses, and planning corridors for emergency services.

Plan for the impact. Find the work arounds, and not just for the business interruption's anticipated duration but beyond that.

In the case of the march on Israel's capital, expect some debris; anticipate some police follow-up (in the event someone takes criminal advantage of the situation)

Again, Jerusalem is only the "example du jour." The venue could be anywhere -including where you live and work.

Bottom Line

Consider the risks and the ways to avoid or mitigate them.

Plan for the impact and how people - businesses and individuals - can survive it.

Friday, January 31, 2014

ERM-BC-COOP:

Why limit risk management
To just Business Continuity?

It's frustrating.

Enterprise Risk Management, ERM, is simple and straight forward.

In plain and simple English, it it management of all risks across the organization that can disrupt "business as usual".

Period.

Unlike Business Continuity (BC) which, as I understand it, is concerned with "the usual suspects" of environmental events, human error, and technology error or malfunction, ERM is concerned with ALL threats, including those not directly under the auspices or control of the organization.

The following graphic is NOT "all-inclusive."

A practitioner should always have input from both internal and external Subject Matter Experts (SMEs) to (a) identify potential threats, (b) provide input to help prioritize the threats, and (c) identify ways to avoid or mitigate the threats.

The "Ubiquitous Other" in the graphic is NOT a "Black Swan"; it simply represents the threats I overlooked while creating this document; threats that SME input would make obvious. As I write this management malfeasance and misfeasance come to mind, also stock values and bond ratings.

Although I've been involved in risk management for more years than I care to count, alone I cannot think of every potential risk or risk management measure. Practitioners MUST have input from as many sources as possible, both internal and external.

For ERM, "no man is an island."

In the Business Continuity world, SMEs typically are the folks working within the organization and, again, "typical," IT and critical process personnel with, perhaps, input from the local police and fire departments.

In the ERM world, SMEs can include historians and librarians, geologists, futurists, economists, lawyers, financiers . . . the list is nearly endless, and the expertise of all should at least be considered if not solicited.

Just as Disaster Recovery (D/R) is part of Business Continuity, so too is Business Continuity part of Enterprise Risk Management.

Separating the various functions of ERM is, to this scrivener, counter-productive.

To be effective, all functions must be integrated into one cohesive process.

To whom should the ERM practitioner report? Assuming the practitioner is less than a vice president, then the best person is any vice president with enterprise fiduciary responsibilities.

Monday, July 8, 2013

ERM-BC-COOP:

Always wear
     Clean underwear

 

If a risk management practitioner needs a motto over his or her office door to observe on the practitioner’s way out, it should be:

Always wear clean underwear

Now at first blush you may think this scrivener has lost it. While that is generally debatable, I assure you in this instance I am fully in charge of all my facilities.

What is it we – risk management practitioners – do? Bottom line?

We anticipate and plan for the unexpected.

No, I’m not talking about swans of any hue; I don’t believe in black swans as an event that could not be predicted.

I’m talking about the unexpected event; the proverbial car going out of control and striking someone, the ride in the ambulance to the hospital where the injured person is stripped of all clothing, including unmentionables, and clothed in a no couture open-back gown.

    In polite society no one would mention that even if the victim of such an accident started the day with clean skivvies, they probably would not be that way when removed at the hospital. Still, “it’s the thought that counts” in the admonishment.

Looking for threats

Fact: You can’t prepare for a threat if you don’t anticipate the threat’s probability.

Where can threats be found? Let’s start with

History.

    Competition: What has the competition done – new products, pricing, marketing

    Environment: What are the environmental threats? Tsunamis in the desert, snow storm in south Florida? What about neighbors. What do the neighbors do/make/sell? How if the neighbor perceived by the public, its employees?

    Government: Laws, regulations, taxation, liabilities.

    Labor: Work actions, availability of casual staff and contractors; tools required and available, education and training, work authorizations if multi-national.

    Standards: Local, industry, international

.

Vendors

    Alternate vendors: If the primary vendor for any particular product fails, is there an alternate source; are arrangements in place to buy from that vendor?

    Financial: Are lenders, creditors financially strong; will they be there when needed?

    Food: Is there sufficient food to sustain staff if a shelter-in-place situation presents itself? Consider diabetics and other special diet requirements; poll the people.

    Insurance: Does the business have enough of the correct type insurance? Too much? Have the policies been reviewed by an independent expert? Does management understand the policies’ requirements (e.g., for documentation).

    Transportation: Getting raw materials from vendors; getting product or services to customers; access to the job site, marketing site.

    Vendors' vendors: Consider the vendor’s risk management plan. Is there a plan? Has the customer vetted at least a “sanitized” plan?

Technology

    Communications: Secure? Multiple demarcation points? Multiple vendors? Multiple methods (landline, cell, two-way radio, courier, T-n for Internet connectivity)?

    IT: Data protected, tested, and accessible within time limitations? Low MTBF parts on hand, repair tools and documentation available? (Also see Labor under the History heading.)

Management

    Awareness: Management needs to be aware of risk management; what it can do for the organization; how, unlike insurance, it can bring financial, marketing, and PR (among other) benefits to the organization. Management must realize risk management must be an on-going program. not a one-time project,

    Participation in risk management processes: Understanding the role of management in all phases of risk management and a willingness to perform tasks for which they are best suited by position and personality.

    Policies and procedures: Signing off on risk management-related policies and procedures that impact all personnel at all times.

    Support for risk management: Top down flag-waving support by senior management is required for a successful risk management program.

“Always wear clean underwear” may seem a silly, frivolous remark, but put into a risk management perspective, it takes on new meaning and makes a great deal of sense.

If I wrote it, you may quote it.

Friday, May 31, 2013

ERM-BC-COOP:


DIY Risk Management



I recently saw a report on consultant compensation for business continuity practitioners.

According to a post on LinkedIn’s BC-COOP group, Cheyene Marling, founder of BC Management, reports that

    BC Management’s 11th Annual BCM Study assesses not only compensations for those who are permanently employed, but also for those who work as independent contractors.

    The attached data graph highlights the average low and high billing rates for independent contractors. The data was collected in BC Management's 11th Annual BCM Study between July - December 2012. All currencies were converted to United States Dollar (USD) for comparison purposes. The study received over 2,200 participants with 100 noting “independent contractor”.

  • The lowest low hourly rate was $10.80 USD from Israel, but then based on personal experience, I know most Israelis can’t comprehend “risk management”.
  • The average low hourly rate for all respondents was $83.03 USD.
  • The highest low hourly rate was $217.75 USD from Australia..
  • The lowest high hourly rate was $24.91 USD from Ghana.
  • The average high hourly rate for all respondents was $128.40 USD..
  • The highest high hourly rate was $362.50 USD from Switzerland.

Ms. Marling even attached a graph (http://tinyurl.com/oa9uvpv) that generalizes compensation in different parts of the world.

I shared the information with some other practitioners and then I started wondering why practitioner compensation – at least in the U.S. – is relatively low: from $78 as the average low to $123 as the average high. Every other Low/High on the Weebly chart surpassed the U.S. at both ends.

Many practitioners I know who work in the U.S. are paid on an hourly basis. Most, I suspect are “W-2” meaning that the employer – typically a consulting firm or staffing agency, pays a portion of the consultant’s tax obligations. The consulting house or staffing agency usually gets twice – or more – of what they pay the consultant. If the consultant is paid $55/hour, the consulting house/agency probably is charging the client – for whom the consultant is creating a plan – between $125 to $200/hour. The bigger the provider’s “name,” the greater the mark-up for the consultant’s time and expertise.

So maybe the figures for the U.S. are a little skewed. Maybe not. They are if the question was: How much is a consultant worth, then I hope the figures are skewed, but (bearing in mind W-2 salaries vs. 1099) if the question was How much are you paid by the hour then it may be accurate.

Supply and Demand

I just looked at Monster.com and Careerbuilder.com for “business continuity” opportunities. Strangely, there were more staff jobs than contract jobs. Most of the jobs carefully avoided mentioning compensation, although I did see a job in Ohio offering between $95k and $120k/year, with another in “upstate New York” hoping to snag a risk analyst for $65k/year. On the low end, one consulting gig in Alabama listed by a staffing agency offering compensation of $35 to $45/hour. Another supplemental staffing agency omits any compensation information, but you can rest assured that whatever the consultant expects, the agency will tell the applicant that it can’t manage that – will the consultant take less?

I know a number of practitioners looking for work. Many of them are highly experienced, but the jobs simply are not available.

It occurred to me that one of the reasons so few “less than Fortune 500” organizations fail to engage a practitioner – either as staff or on a project basis – is because risk management is considered, like writing and photography, a Do It Yourself field. Anyone can “do” risk management.” It’s a no brainer.

Writing a decent news story or PR piece; maybe slapping together a technical or even user manual. Grammar? Spelling? Concern for audience comprehension? Who needs them?

Likewise photography. Point and shoot. Never mind that a pipe is growing out of a person’s head or that the tall building falls inward ( / \ ). Shooting an ad for an expensive wine? Show a half-full wine glass and a bottle of the vino. Maybe no one will notice that the bottle has yet to be opened. (That, by the way, is a true story. Resume on request.

For what it’s worth, I was a writer and photographer before moving into risk management. It provided a good background.)

The problem is, risk management is NOT a “DIY” function. Given the advantages a good enterprise risk management program beings to an organization, it seems logical that smart management would rush to engage an experienced practitioner and pay that person a professional wage.

While I’m surprised, and glad, to see so many staff opportunities on Monster and Careerbuilder, I know there are far more practitioners, some highly qualified, than there are jobs, staff or contract.

Our profession is still in a Jacob Cohen profession – it lacks respect. (Who is Jacob Cohen? You know him better as Rodney Dangerfield.)

As long as management considers risk management to be a DIY no brainer, we’ll either be on the market or “transitioning” to a new profession. Maybe senior practitioners should offer their services as Trainers or Mentors for the DIYers.

Meanwhile, practitioners might consider promoting (read generating future business) by presenting risk management or even business continuity to chambers of commerce and BBA/MBA classes at the local U.

As for me, I am not a DIYer. I don’t even like the self-check out machines at the supermarkets. When I need a professional job done, I go to a professional.



Thursday, May 30, 2013

ERM-BC-COOP:

Getting outside expertise

No practitioner is an island

Enterprise risk management should be what the name clearly states:

    Enterprise: Covers the entire enterprise

    Risk: Considers all risks/threats to the enterprise

    Management: Deals with risk avoidance/mitigation and dealing with risks if they occur, both during the crisis stage and the following recovery stages.

Most organizations have some insurance coverage, if only Property and Casualty (P&C). Many have Directors and Officers insurance and some have Business Interruption insurance.

These coverages are only the tip of the proverbial ice berg.

The problem is, insurance also is a risk.

The risks with insurance are several.

    Is there enough insurance; like Goldilocks and the bears’ beds, is the coverage too little, too much, or just right?

    Are all the insurable threats covered, or are some simply not worth coverage?

    Is the insurer’s financial resources deep enough to assure payment even if your organization is but one of many simultaneous claimants?

    Are there a time limits on how soon a claim must be made and when it must be paid?

    If there is a dispute between the insured and the insurer, how is it to be resolved and in what jurisdiction?

As with all things ERM, there are two sides to every coin.

One of the greatest risks is a lack of understanding of the “small print.”

Does the insured comply with all of the policy’s requirements? Does anyone in the organization really know and understand the policy’s requirements?

Insurance policies are created by lawyers and insurers.

You need a lawyer who specializes in insurance coverages and an insurance expert, someone from the field. Not, however, a salesman. The insurance side should be represented by an independent insurance adjuster. Finally, these two people must be willing, and able, to work together and to present their findings in a report prepared in a language that management – and the practitioner - can comprehend.

According to an article titled Counsel's Role In Insurance Risk Management by Finley T. Harckham of Anderson Kill & Olick, P.C. ( http://www.metrocorpcounsel.com/articles/23475/counsels-role-insurance-risk-management), “Insurance policies are complex contracts, and pursuit of an insurance claim is often a high-stakes, conflict-ridden endeavor. Yet all too many companies entrust their assets and their very survival to insurance policies that are never seen by their attorneys, and pursue claims without the benefit of counsel's evaluation of the company's contractual rights. In-house counsel have an important role to play both when insurance is obtained and when claims are pursued.”

Harckham recommends six points to consider when considering insurance:

  1. Analyze Insurance Policies Before Coverage Is Bound
  2. Law and Arbitration Provisions
  3. Manuscript Provisions
  4. Review Insurance Applications
  5. Evaluate Coverage For Any Important Claim
  6. Law And Forum Selection

He defines and details each of the items in the article (ibid.)

While Harckham’s focus is on the specialist attorney, he maintains that “An attorney's review of the company's insurance policies is not as daunting a task as it might first appear, at least after going through the exercise once. Most policies consist largely of standard forms, many of which remain largely unchanged from year to year. The insurance broker can be asked to identify all changes in coverage. Moreover, excess policies often "follow form" to primary policies. So, reviewing higher-layer policies in a tower of insurance is typically far less involved than gaining an understanding of primary policies. However, care must be taken to ensure, if possible, that excess policies do not have less advantageous terms, and that if they do, any policies at higher levels do not follow form to them.”

An independent insurance adjuster’s primary function is to work on the insured’s behalf to make a valid claim. Because of this, an adjuster should be included in the policy review team, even with a lawyer specializing in insurance as a team member.

The purpose of insurance is to assure that the organization remains financially viable and able to continue with “business as usual.” If it does not, the premiums are wasted money.

Engaging experts for insurance reviews before the contract is signed is akin to getting specialists’ opinions before undergoing major surgery. On a less critical level, engaging experts to examine property before purchase; is it up to standards, what about radon, is it in a flood zone, etc. Bottom line: It’s a good business practice and common sense; put in a way lawyer’s like, it is “performing due diligence.”

Practitioners would do well to take a couple of minutes to read through Harckham’s article so they can at least "encourage" management to seek specialists' expertise before signing on the dotted line.



Thursday, May 23, 2013

ERM-BC-COOP:

Give job to best person

 

I’m a fan of the comics.

Dilbert for May 23, 2013 triggered the thought that a risk management practitioner needs to try to match personnel to processes as an organization (a) tries to maintain a minimum level of service and (b) restore the operation to “business as usual.”

Politics and egos can make this a difficult task, but when it can be accomplished, the results are worthwhile.

There are those people, including practitioners, who are excellent workers under normal conditions. These same people may fall apart under event and post-event demands. On the other side of the coin, there are those who “get by” when everything is proceeding normally but shine when the pressure is greatest.

A nurse may handle routine duties in a routine manner, but come alive in a crisis situation. Another nurse also may handle routine duties in a routine manner, but panic in the same crisis.

Most people performing their day-to-day functions are there because they function well under minimal pressure. This is true for most managers; they got to a supervisory position based on their day-to-day performance.

Most older practitioners will remember the infamous “Peter Principle.” To update the younger practitioners, Wikipedia declares “The Peter Principle is a proposition that states that the members of an organization where promotion is based on achievement, success, and merit, will eventually be promoted beyond their level of ability." (http://en.wikipedia.org/wiki/Peter_Principle); The Free Dictionary agrees, showing “The theory that employees within an organization will advance to their highest level of competence and then be promoted to and remain at a level at which they are incompetent." (http://www.thefreedictionary.com/Peter+Principal)

Dilbert simply shows the Peter Principal in action with Dilbert’s Pointed Haired Boss, a/k/a PHB.

Unfortunately, most organizations have managers who prove that the Peter Principle is alive and well.

The practitioner needs first to identify people who, regardless of hierarchy are able to perform under stress and, second, needs to try to assure these people will be in responsible positions during and immediately following a crisis; people who will, as the express goes, be able to keep their heads when all those around them are losing their heads.

There are some ways to (try to) achieve this.

Alternates

Every response function requires at least a primary and an alternate responder. No exceptions.

Actually, that is just good business sense.

People go on vacation, go to seminars and conferences, get sick, tend to relatives, retire, and die, sometimes unexpectedly. A well-run organization - and some not-so-well-run organizations – needs to have an “order of succession.” Even the U.S. federal government has a succession list.

    Presidential Succession Act of 1947 lists the order of succession for the President of the U.S. (POTUS). The list may be viewed at the Government Printing Office site: http://bensguide.gpo.gov/9-12/government/national/succession.html . The list is 18 (18 !) levels deep.

For most organizations, temporary duty assignments (“TDY” in military parlance) can be assigned to different people at different times to qualify more people to step in for a missing person, anyone from the CEO to an intern. (Most people probably don’t consider interns needing alternates, but what do interns often end up doing? Going for this and going for that, i.e., “go-fers.” In a crisis situation, there is a need for “go-fers”; if there are no interns, someone else must perform the function.)

Selling the “alternate” idea should be fairly easy for an experienced practitioner. Just ask the question: “What happens if {name of person or title} is absent then a crisis occurs? Who can make the decisions to keep the organization (department to enterprise) functioning?”

Unless the organization’s management is paranoid – and there are some - the practitioner also can stress the benefits of cross-training. The old Bell Telephone/AT&T used to promote managers from the ranks. The company reasoned, successfully, that if the rank and file went on strike, the now non-union managers could fill in for the duration; the service might slow down a bit, but the company would maintain “at least” a minimum level of service. The U.S. Marines operate similarly; every Marine, without exception, is a rifleman – or maybe today, a “rifle person.” The Marine may be enlisted or officer; most have a secondary function (e.g., radio operator, pilot, cook, Corps commandant) but all are trained to use a rifle.

The only recommendation I would have for managers who assign alternates to their positions is to put the authority in writing: “I appoint Tina the Technical Writer to serve in my position during my absence. Tina the Technical Writer has my full authority and is authorized to make all decisions that normally would be made by me. (Signed) PHB”

Tina the Technical Writer could be named for one absence, Wally for another, Carol the Manager’s Manager (a/k/a secretary), and Dilbert. Asok probably is too inexperienced to sub for the PHB, but someone has to report to the temporary PHB.

Using the military as an example, there are Officers of the Day (OODs) who, while in this role, have the authority of the their commanding officer, Non-Commissioned Officers In Charge (NCOIC) and even Charges of Quarters (CQs), all temporarily with the authority of those in command. (Navy and Coast Guard terminology may differ slightly.)

Final thoughts on alternates Alternates also may be primaries providing both primary and alternate tasks don’t occur at the same time. Also keep in mind that responders may be needed at an alternate site while the primary site is restored.

Finding those who keep calm

Identifying responders who can keep their cool under the pressure of a crisis situation can be a difficult task.

The best, and possibly only, way to identify these people is through exercises.

Walk-through exercises are fine to discover the thinkers, those people who can analyze a problem and come up with possible solutions.

Simulations are better.

Simulations with injects are even better.

“Injects” are, in common terms, the proverbial monkey wrench that gets thrown into a situation to make something simple complicated.

“Injects” are intended to put pressure on responders; to simulate a “real life” situation.

Such monkey wrenches can include managers demanding that a task be performed “right now” – having a manager do this may have the added benefit of the manager seeing this interference is counter-productive.

Other monkey wrenches are to tell the responders that something they expected to be available is no longer available, or that a secondary threat has occurred, e.g., the fiber coming into the building has been cut* and there is no phone or Internet connectivity with the outside world.

    * We know this cannot happen because ALL of our facilities have at least 2 separate points where communications lines come into the structure. Right? Right.

Exercises need to be repeated, swapping in alternates for primary responders. Unlike football teams that practice “first team” against “second stringers,” responder swaps should be random. In a “real life” situation, no one will know who will be available. All team members must be able to work together.

Look for both managers and mentors. Managers may be people who rise to the occasion and, through their personalities and expertise, win their fellows’ following.

Mentors are valuable when dealing with less experienced personnel and with any casual (vendor-provided) staff at the primary and alternate sites. Vendor people may have the technical expertise to do the job but probably will lack the organizational background to work within established policies and procedures.

If a manager cannot manage in a crisis situation

You have my sympathies, but you need to find a way to suggest to the manager that maybe someone else could do a better job “just temporarily.”

One tool that is available is the “alternate.” If the manager can’t handle the pressure of a simulation-with-injects, have the alternate play the role on the next exercise. The manager must be in the exercise area to see the alternate’s performance.

If that fails to have the desired result, having the manager's peers or superiors address the issue with the manager might work. About the only way the practitioner can instigate this is to have the manager’s peers or superiors watch him in action. The practitioner should avoid, if at all possible, “going over the manager’s head,” no matter how inappropriate the manager’s actions, short of causing personnel injury or death.

Critiquing the exercise

The exercise has been completed.

Now is the time for (a) critiques and (b) action items.

A successful critique requires at least two things:

  1. Recommendations to improve, not criticisms of what, or who, went wrong; the purpose is to improve, not tear down other participants.
  2. The lowest ranking person who either participated in or observed the exercise – an intern if available – should offer his or her opinion first; the most senior person should give his or her opinion last. This “lesson from the Sanhedrin” assures that juniors won’t be influenced to simply agree with the seniors and will give their (hopefully) honest opinions.

The practitioner must lay down strict guidelines to avoid rancor and finger-pointing.

Ideally, there will be an amanuensis to record an Action Items list and the names of people responsible for each item on the list. Reasonable due dates should be fixed and a report created, to be circulated to all participants and appropriate management, once the items are completed. Most items can be completed and reported on within 14 working days.

The report will be used as the benchmark for the next exercise.

Keep in mind that nothing is 100% the first time out.

Tuesday, April 23, 2013

ERM-BC-COOP:

Check the facts

 

I just read a book authored by a guy who claims to have been an AP reporter.

The story takes place in New York City and in Sarasota Florida.

I know almost nothing about New York City, but I lived in Sarasota for several years; I know Bradenton (just north of Sarasota), Pinellas (Clearwater, St. Petersburg), and some parts of Hillsborough (Tampa) counties.

Most – 99 percent – of what was written about Sarasota was wrong,

I can understand why the author no longer works as an AP reporter.

Worse, the book’s publisher apparently lacks a fact checker to catch the author’s wild imaginings. Was the author EVER in Sarasota? Doubtful.

While there IS a Starbucks at Sarasota-Bradenton International (it has Customs) there is no TGIF restaurant nor is there a shark tank, hammerhead or other variety as the author wrote. A check of SRQ’s Web site would have saved the author and publisher’s fact checkers some embarrassment.

Tamiami Trail, the section of U.S. 41 that runs from TAmpa to MIAMI (ergo the name) is identified as “Route 45”. I suspect the author depended on Wikipedia. There IS a FL 45 that in places shares pavement with U.S. 41, but in Sarasota, it strictly is U.S. 41. A look at any mapping software (e.g., Mapquest) would belie FL 45 as the Tamiami Trail. Every Cracker knows that.

The author has his heroine heading east into a tacky neighborhood. Driving south from the airport and past the Ringling Museum the first road, the only road in Sarasota County heading west to Longboat Key, the heroine’s destination, is the John Ringling Causeway, FL 789. The road passes by the Sarasota Yacht Club and Plymouth Harbor retirement high rise on one side and a marina for some rather fancy boats on the other. Hardly tacky. (The SYC and Plymouth Harbor both have Web sites the author and fact checker could have utilized.) The factless author also had the Intercostal Waterway on Florida's Gulf coast - in fact, it is on Florida's Atlantic coast, information easily available on the WWW. An aside for those who enjoy trivia: Sarasota is the second richest county in Florida, surpassed only by Palm Beach County, but unlike Palm Beach County, Sarasota’s is “old” money.

But, hey, except for really sloppy fact checking, it was a pretty good yarn. ‘Course those inaccuracies kept me from fully “getting into” the story. Reporter, indeed.

So much for the proverbial “tip of the iceberg.”

How does a murder mystery writer’s laziness relate to risk management?

Consider:

  • Who controls the budget for the risk management program? Usually one or more Very Senior Executives.
  • Who reads – is supposed to read - the practitioner’s reports? Everyone, including those Very Senior Executives, Functional Unit Managers, and Critical Personnel (e.g., the folks in the trenches).
  • Possibly casual (temporary) staff who may be called in to help restore the organization or even to maintain the organization’s minimum level of service, people who will depend heavily on the documentation prepared by, or for, the practitioner.

If the practitioner’s report contains factual errors then the entire document is suspect. If the document is suspect, the plan is suspect. If the plan is suspect, then the practitioner is suspect.

The errors in question are not just typographical, although more than a few besmirch the practitioner’s image; the errors are factual errors usually caused by ignorance and the most often reason for ignorance is laziness.

Grammatical errors also can, and often do, embarrass a practitioner as well as lower the practitioner’s esteem in the eyes of client.

The majority of the contents of a practitioner’s report should be information provided by, and reviewed by, subject matter experts, both within the organization and without (e.g., local emergency services, weather bureau, weather history).

For all that, the practitioner must lead the program’s development (read “ask the right questions”) and accurately record the subject matter experts’ comments.

A poorly, sloppily prepared document could endanger the program and that, in turn, could endanger the client’s organization, and that includes personnel.

Laziness can be expensive.