New Site- New Content

Tony Ridley has Relocated

Tony Ridley has moved to a new site with even more content, tips, resources and advice.

Some of the new content includes:

• Social Media
• Marketing
• Travel Safety and Security
• International Business
• Business Intelligence Tools
• Security
• And much, much more…..

Visit Tony’s new site, click the link below:

Tony Ridley’s Website

Pareto’s Law-20% of your assets will be exposed to 80% of threats. Do you know which ones?

Bad weather or even natural calamities do not affect every city in the world nor every resident of the affected area. Accidents, an inevitable part of some environments, do not affect all your people or totally devalue all your assets. Terrorist do not consider everyone a viable target nor are their actions likely to impact everyone over the course of their lives. The facts remain that only a small percentage of events or incidents resulting in loss of value or productivity will affect your business but conversely a smaller part of your overall assets are likely to succumb to these events; possibly even repeatedly. If this is the reality, why are there so many singular strategies for organizations, one-size-fits-all policy, uniformity in the approach when greater economy could be achieved by focusing on the priority areas? Most of the threats (80%) will only likely place at risk a smaller percentage (20%) of your assets. Do you know which ones?

Too much time and deliberation is spent perfecting the process of identifying and qualifying the threat. While it remains a valid and useful phase the process becomes unexplainably weaker or less popular once value and measurable impact are introduced. This is in part possibly due to the skill and experience of those conducting the analysis/assessment who typical originate from a weak financial background. Even for those with little resources, training or even time, a qualifying exercise to determine what the impact of service failure, disruption or other stressors will provide you with a workable project plan for applying solutions, counter measures or treatment options. This should have financial implications, tangible and intangible. The higher the number, the greater the priority and easier to be presented to business leaders or collaborators. The easier you make the measurement or driver, in a format most commonly used, the greater adherence and buy-in you will get. Abstract terms, ratings, scientific pontification or just made up data will only erode the objective and almost all will loose interest. No single person ever saved an entire organization, it takes systems and team work that follows a plan.

Many conventions are derived from habit or transferred from what others believe to be comparable models. Take fire sprinklers and suppression systems for example. A worthwhile investment and certainly mandated in some jurisdictions to prevent loss of life, undue stress on public services or even making local authorities look bad. Whatever the driver they are common place. However, not every square meter of a building is at risk of having a fire originate in that locale. Much of the planning and installation works on the assumption it could start anywhere, spread anywhere so lets just cover the entire structure. Not necessarily an efficient or effective process but wide spread practice none-the-less. Transferring this methodology to all/any other part of the business would have questionable benefits or make financial sense. These kind of general applications of similar strategies discredit the validity of risk management and force undue cost onto organizations that quite reasonably at times will forego the entire solution because the bulk of the concept is unnecessary, leaving the critical minority (20%) unprotected.

Vision and direction begins with policy. However, this policy is a guiding principle with brevity and clarity not a standalone document. It should include the priority of care or concern such as people, brand, buildings, etc. Priority of response along with the objective of the efforts should be made clear to all. Any and all measures, outlined in subsequent procedural documents and training, should be measurable (financially, operationally and even brand integrity) and constantly reviewed. While policy is unlikely to change for longer periods of time, the process and even certain objectives may as the business changes in both culture and nature. The most effective policies are a single paragraph that encompasses all the aforementioned elements and does not dictate tactics for execution but ensures everyone at least moves forward in the same direction.

Data is a great tool for creating foundation analysis but it should originate from both objective and subjective sources. Single minded collection, measurement and review lead to much bigger falls. No company knows everything about itself or everything else around it, no matter what some may think. Comparative information, data, review and even assessments ensure greater transparency in the final outcome. Care needs to be applied to ensure it is not a popularity contest or management by consensus, a final impartial decision maker is still required. Companies of all sizes can apply this approach cost effectively and expediently while enjoying maximum return on investment not just plain old return on investment (ROI).

The clock is ticking, the world moves on and the business you had an hour ago is not the one you operate now. The process needs to be renewable, adaptive but above all constantly applied by monitoring and surveillance. Monitoring is required of the business, its actions, its impact, resources, threats, disruption impact potential and relevance to the overall business concerns. Many events that arrive on the doorsteps of your business first visited your neighbor or the business down the street. Just because you weren’t watching will not get you a leave pass on the impact your lack of preparation may bring to your organization. Larger companies have internal resources for this purpose, but the smartest have both internal and external for the reasons of effectiveness previously mentioned. Smaller companies, increasingly thanks to technology and a global market, can enjoy all the benefits of outsourced support that the larger companies do without the cost of ownership or inefficiency but with all the benefits.

Only a fraction of your workforce are at risk; a percentage of your travelers too. Not all your fixed assets are of equal value nor will they be exposed to the same single loss expectancy (SLE) or annual loss expectancy (ALE). Only some markets need heightened levels of support and protection as much as only some markets are the most valuable to your overall financial health. Every single email piece of information your company possesses shares the same value. A single piece of code could be worth thousands but a warehouse of files could be nothing more than an administrative cost and operational burden. The problem with this all is that most companies simply don’t know which end is which. The one-size-fits-all approach is cheap, easily understood and been around for years. Secretly the more profitable, efficient and even safer companies have dispensed with the rule-of-thumb and focus their 80% resourcing on the most valuable 20% assets. Do you know your most valuable assets and are they better preserved than the lesser value assets? Or are you just applying the same approach for everyone, thing, process or bit because that is the way it has always been done?

Shake, Rattle and Roll-Natural Disasters; Asset preservation and business continuity

Enter at own risk

Disruptions due to natural phenomena are far more prevalent than many individuals and certainly companies are aware. For some inexplicable reason people appear to be unable to retain the frequency, probability, damage, disruption and location of natural disasters in comparison to other events such as terrorism or political unrest. Ask yourself, do you remember more details around the Union Carbide leak, the Exxon Valdez spill, World Trade Center attack or the Sichuan Quake, Myanmar Typhoon or PNG Tsunami which all singularly killed more people than the 3 prior events in total? It is perhaps due to the fact that many individuals and more concerning companies, relies on living memory to determine the planning requirements and probability of natural events. The impact and frequency however is far greater than that of most other business disruption events and catastrophic incidents.

Over the past few decades increasing numbers of the world’s population have migrated to the long-term cities and developing mega cities across the globe. It is in part the reason why in recent years the impact and devastation from natural disasters has become greater than that of years gone by. Additionally, one of the few consensuses by experts is that the predictability and probability of natural disasters is still an inexact science with far more research or study required. This has led to locations thought to be free of Mother Nature’s fierce reprisals suffering surprising events with often catastrophic outcomes. Further amplifying the affects of such unpredicted incidents has been the diverse and inconsistent building or development standards engaged as cities and communities increase their economic and infrastructure development. Tragically, the worst natural calamities in recent history has been where poor preparation and standards have met with moderate to extreme natural disasters that most likely would have had less impact had it hit those locations with the higher level of development and standards due to their acknowledgement that they are within the accepted area of natural disaster events.

The adoption of the term natural disaster is perhaps more applicable to man’s response and preparation to natural events. While a flood, fire, quake, eruption, wave and wind is not indicative of a disaster, it is often the inability of governments and companies to protect their assets in the wake of such events that determines the true scale of a disaster. The concentration of population, insufficient infrastructure, limited emergency procedures, poor emergency services provision, the potential for loss of life and suffering of affected communities along with extended duration of loss of acceptable living standards following the event all contribute to the overall formula for determining if a natural phenomena is indeed a disaster or calamity.

Planning and preparation for natural disasters is relatively simple when compared to other business disruption events. By using a threat-based approach and determining as many of the plausible outcomes (such as power failure, denied access to premises, stranded commuters, etc) planners discover that many of these events are similar if not common with other business disruption events albeit not occurring simultaneously. Identifying existing resources and required resources to mitigate or prevent negative outcomes is also a straightforward process. While the training and preparation of personnel is not that demanding it is important to ensure travelers and expats receive a more targeted and frequent training curriculum. The reason for this is that due to their business mobility requirements they may be exposed to a wider variety of natural phenomena than that of the fixed office location, therefore requiring a wider range of information and response knowledge. Furthermore, the level of support or footprint of disaster could be significantly wider in locations of their travel than that of their location of origin. They should also assume that a higher degree of self-assistance or vendor support will be required when traveling, especially in developing countries as the government response is often generic in application, non-commercially aligned, minimalistic in design and hampered by inter-agency communications and language barriers.

It is becoming increasingly paramount that businesses maintain and monitor  a higher level crisis management system such as at the country or regional level as many local offices are the first affected in such calamities and potentially unable to notify corporate support due to the failure of communication infrastructure. Similar planning consideration should be applied to travelers. This monitoring and surveillance should have both predictive and preventative intervention capabilities coupled with continuous activation and notification capacity. Businesses will also find that such systems result in business and operational efficiencies due to the elimination of false activations and failures in activation due to ill-perceived assumptions on whether or not the company had people, facilities, equipment or processes exposed. Moreover, such systems will be the governing factor for the time taken from identification to response and the ability to preserve assets or prevent loss of life, damage to other company assets or continuity of operations.

In the wake of the global economic challenges that are resulting in many governments even less capable of large scale emergency response, diminished safety and quality standards as well as a decrease in internal company resilience at a time when we continue to see an unprecedented change in climate, environmental hazards, fierce natural phenomena and multiple large scale incidents it is possibly more hazardous to people and property now than it has been in the past decade. Individuals should be reviewing their immediate action plans for such events, specific to each location of travel and companies should be reviewing or implementing consistent applicable training programs for those affected personnel and assets. All of these tactile preparedness measures are underpinned by a wider business resilience plan and allocation of resources.

Ashes in our mouths-How a volcano shed light on the true state of affairs in corporate travel risk management

Friend or foe?

Volcanos that erupt and disrupt the world’s travel plans don’t happen every day but travel disruptions and threats to travelers do. It often takes a dynamic or amplified event to display just how much planning and oversight goes into day-to-day risk management, in order to reveal just how ineffective the process may be overall.

Travel buyers have admitted that the volcano eruption in Iceland has taken a substantial bite out of their 2010 travel budget, if a new survey is to be believed.

Polling its international members, the Association of Corporate Travel Executives (ACTE) found that some 71% of global travel buyers said the disruption in Europe has resulted in a “substantial” economic hit on their travel spend for the year. Of this 71%, 36% percent described the unanticipated expenses as “severe”. An additional 21% indicated the hit was slight, while 8% reported being unaffected.

“It is important to note that the financial factors of this crisis have a special significance in the light of the fragile global economic recovery for business in general and business travel in particular,” said ACTE president Richard Crum. “If even just 1% of the industry’s financial contribution to the global economy were affected, that would equate to roughly 4 billion euros.”

Crum added that travel managers have been preparing for contagion, pandemic, conflict, war, and earthquakes for years. For many travelers, that level of preparedness was reflected in their corporate response to the eruptions in Iceland. Forty-seven percent of companies responding to the ACTE survey had a plan in place to accommodate stranded travelers. Twenty-nine percent did not have a specific program for this crisis, but moved forward with implementing one cobbled from other crisis programs. Twenty-five percent believe this crisis is so extraordinary and rare, that no preparation could have dealt with these developments and have no immediate intentions to change their policies.

The unanticipated expense of the crisis has already taken a big bite out of existing travel budgets for 2010, but survey respondents believe the crisis would not force the company to travel less in 2010 (76%). Twenty-two percent were unsure as the crisis is ongoing and 2% said yes.

Stories continue to emerge of how travelers and companies have been forced to sleep in airport terminals, pay thousands of dollars for taxi rides across countries or cancel major business activities, all the while suffering substantial productivity losses of some of their company’s most valuable human resource group. It is not acceptable that company travelers be subjected to the same limited response or emergency interventions as your everyday tourists, in the event of such wide spread disruptions. If you have been significantly affected, you have failed and your system just doesn’t work.

Poor surveillance of developing events, superficial plans and even less effective decision making methodologies reduce workable response options; if any exist after such systemic failure. Failure to identify and plan for whole-of-journey risk management leads to situations where your traveler/s is stranded in transit without a valid visa forcing them to sleep en mass in terminals with limited solutions. Similar oversights lead to false hopes that the situation will correct itself and “anytime soon” everything will be okay. After all this, if you believe that the overall situation will return to normal and you and your travelers will be on their way immediately after the airspace ban has been lifted, again; you’re in for a nasty shock.

Numerous managers and travelers now understand the various roles required to achieve productive, efficient and safe travel management. Your insurance company is more than capable, and perhaps willing, to process your claim for losses and expenditure incurred but you are still stuck at the airport without a workable solution and suffering a major loss in productivity for those that are typically within the top 20% of your human capital earning (compensation and business contribution) demographic. Your cheque will arrive in the mail and tangible loss/expenditure compensated. It still doesn’t get you from A to B or even via D. Your local office or contacts don’t possess the network or experience to manage your requirements, especially when the rest of the world is scrambling for the same resources. Those without wild stories of adventure to relate after this event are not inclusive of a well thought out plan and capacity to act. Those with a more boring story to tell but maintained productivity and contained costs, all the while preserving the safety of their people, have in their team brokers, insurance, travel management companies and assistance. Which is the smarter business option?

Total failure resulting in numerous stranded people are the result of high walled departments without collaboration. Lack of unification and leadership/ownership in the practice of travel risk management has lead to wide spread helplessness and stranding. If you have key executives traveling for leisure also affected that will prevent them returning to work as scheduled, you have yourself to blame and your appreciation has proven to be too shallow.

This is not over. Hotels are likely to default on bookings for pending travel as they still haven’t been able to clear the backlog of stranded travelers. Ground transport will be stretched and prices will rise even further. Government departments will debate the options but essentially there is nothing you can do to influence their inconsistent influence. Airlines will be pressured into economic decisions long before safety data is consolidated or examined under normal parameters. The thousands of inbound and outbound travellers will take much longer than a few days to clear, not forgetting those adding to the mele than need/want to travel this week. Overtime payments, supplies of food and water to airports, cash reserves and transnational collaboration will all act upon the solutions and choices. It is one thing to read about this in the media but do you really have a handle on what is happening and how it affects you? Failure to do so will compound past mistakes too.

There was adequate warning that this event would have far reaching implications. The impact could be calculated. There was opportunity to implement plans or develop an effective solution to support the objective and effective, rehearsed management teams would have had sufficient time to assess the impact and act accordingly. The final impact was not fate but determined by everything you have done to date. You have been weighed, you have been measured; have you been found wanting?

Business class is cheaper than economy: whole-of-journey travel risk management

Just what have you cut?

The majority of travel departments/managers are only empowered, authorized or capable of looking at travel management from a cost perspective exclusively. However, to truly ensure that the process of travel is efficient, profitable and safe; a much wider focus is required-predominantly in the areas of cost, productivity and safety.  When such a wider and more comprehensive perspective is engaged, most organizations will discover that business class flights are in reality much cheaper than economy class for the majority of their executives and traveling talent.

Consider a short-haul flight of under four hours. For an executive this will typically translate to an eight-hour working day. If traveling in economy class they will typically need to be at the airport nearly 2 hours before departure. Even with privileged frequent-flier status they will need to be checked in much earlier than their business class counterparts. Without such privileges, the time required maybe even longer as check-in queues and airline efficiency lengthen and decline respectively. The immigration processing will potentially be lengthened also as many airlines now have preferential immigration processing of business travelers. The traveller in economy will now be left to fend for themselves in the public seating/WiFi/meals environment of economy class travel. Boarding time will be  lengthened and carry-on luggage will be reduced which again will have added to the overall pre-departure time.  Regardless of the physical size of the traveller, their work laptop, the airline or the seating space; very few people get anything close to productive work conducted whilst in economy.  Not to mention, when corners have been cut,  everyone within proximity of a business laptop user can often see the entire content and context of business presentations, e-mails, discussions and intellectual property. The arrival stage will also entail longer immigration processing times, time lost awaiting baggage and jostling within the bulk of the flights travelers. If after all this, on a short-haul flight you expect the traveller to bring their A game or deliver pivotal business results, you should prepare yourself for disappointment now.

Conversely, a journey that has been considered in a whole of risk  manner will play out significantly different. First, the traveller will have the time and flight best suited to the work productivity objectives and reduced commute, check-in and processing times. Utilization of the business lounge will ensure productivity and access to information and systems prior before departure. Overall fatigue and affect on the individual will also be reduced. Whilst not entirely risk free, the threat to personal belongings, company information  or other valuables will also be reduced.  Productivity (best calculated by adding the per hour cost to the company for the executive and the per hour revenue potential of the trip or executive) will also be enhanced by a compact yet usable mobile workspace. Even if the individual is not conducting work on a computer platform, the demands to the individual  are also diminished.  It is also almost ensured that the executive will hit the ground running and clear the aircraft, immigrations and baggage claim much faster, leaving only the commute from the airport to the place of business. This streamlining and efficiency is also replicable for multiple travelers or trips.

When analyzing all of these factors (even in a developed country) the hundreds or even thousands of dollars between economy class and business class travel is often much cheaper than the thousands or tens of thousands of dollars  of business productivity, time and dollars at risk. However, the functional heads responsible for cost, productivity and safety are all typically measured and evaluated on cost containment rather than profitability or maximized earnings of their senior executives. All of these elements are significantly amplified in developed or developing countries. When the entire journey is constructed along whole-of-journey travel risk management lines thousands or even millions of dollars in opportune business can be preserved while appropriate expenditure managed. Reduction or elimination of disruption and wastage can be easily achieved. When it comes to whole-of-journey travel risk management most companies are penny wise and pound foolish. There is nothing more comical and economically tragic than a senior executive or CEO traveling on a budget airline. While sitting in cheap seats being nonproductive and paying five dollars for peanuts or drinks they are losing thousands of dollars or even millions in productivity or earnings for the sake of a few bucks. In the wake of the financial crisis, some very savvy financial institutions openly conveyed that they dare not reduce the privilege, risk or status of their major wealth generation executives for fear of losing them to more competitive or sophisticated banks or financial institutions. Why should this be any different in the face of many other threats to talent and revenue?

The empirical data and evidence of enhanced productivity and efficient travel risk management exists at present in every company. The only limitation is that few are rewarded or supported in harvesting, processing and analysis of such data. If companies and their respective leadership took the time to stop and analyze such processes or even historical culture within the organization, they would find that simple and efficient adaptation of such processes like the use of business class travel versus economy class travel could potentially unlock thousands of hours of productivity and greater business competitiveness. This is certainly the case in developed markets and significantly more acute in developing markets where there is an accumulation of much greater threat, costs, threat disruptions and safety issues.

The question then  is not “Is business class is cheaper than economy?” but more a case of  “Can you accurately prove that it’s not?”

Here today gone tomorrow-International gatherings and sporting events; security threats and concerns

Where to now?

International events such as major product launches, corporate meetings, annual or regular sporting events continue to fall outside the standard methodology and practices of risk and people risk management. Many organizations and individuals, also fail to anticipate or include this in travel risk management strategies for leisure or non-corporate travel.

The bigger the event; often the greater lack of oversight. Many organizations and planners have gotten themselves into what they consider ‘ a well rehearsed process’. However, given the continual growth in this area, one event could be just one of dozens or even hundreds on their annual calendar. Therefore, some planning groups do not even start their planning for these events until mere weeks before the start of the event.  They have become so familiar with the process (in their minds) that they simply template their planning preparation and even the threat profiles.

Issue motivated groups, criminals and even terrorists all have wants and needs. Along with these wants and needs, there a number of capabilities, intent and even historical success that are required before they can even be considered to be truly a threat.  More often than not, criminals and terrorists prefer people over places. Meaning; they will go to where the people are, particular if they gather in large numbers. It often has less to do about location than the accessibility and opportunity for victims or attention. Increasingly, terrorist and issue motivated groups, are about striking at social activities rather than iconic landmark locations. This means that many are at walking into the exact locations or circumstances preferred by both criminals and terrorists alike. In recent times sporting events have even been high on the list of preferred locations. Even athletes have become preferred targets.

Online bookings, cheaper airfares, product launches, the thrill of seeing your star athletes perform live are all increasingly motivating more and more people to travel to these major events and super events. This can in turn result in small or moderate sized cities and locations expanding well beyond their infrastructure capacity or overburdening everything from amenities to emergency services. The planning and preparation vary from city-to-city, location-to-location and even encompass cultural limitations. One should never assume that one particular event held in different locations is even remotely close to the same standard of planning, preparation or resources met with at the last.

Over the course of the next few months, everything from the soccer World Cup to the Shanghai Expo will see hundreds of thousands or millions of travellers descend on individual or clusters of location. These events to, have persistent and specific threats that will affect all travellers and attendees. They will range from the minor and routine, the life-threatening or catastrophic.

Part of the threat are travellers or attendees themselves.  In simple terms you should know before you go. Understanding, adapting and preparing for the local circumstances, rather than just transit or your location of origin, is far more important if not pivotal to determine the success of an overall trip. Many times; Google just does not cut it! One should have accurate and specific advice that helps shape your decision planning an even logistics. Increasingly companies are providing this on behalf of their employees.

Local standards vary. The nature and even the scope of services provided at many of these events are likely to be different to what you may be accustomed at home. You may think it remote, or even unlikely to require such services but you should at least pay attention in order to understand how they will work in the event of an incident, accident or even an emergency.

Plan. Set time aside, to research study and understand the location and even the event in which you are travelling to enjoy. If you have resources to draw upon, use them. If not, seek them out, share and collaborate; but do not omit. It’s not so much the plan that’s important, it’s the planning.

Manage. All journeys (regardless of planning) present choices at various stages of the event. Informed and wise choices are based on the extent and knowledge applied to those particular choices. Ad hoc, ill informed, or simply cavalier choices often result in dangerous outcomes. Ensure you remain updated to changing circumstances. Maintain awareness of your activities and the surroundings in which you’re travelling.  This should be applied to every stage from arrivals, transit to hotels, travel between events and locations; up to and including your return to the airport and subsequent departure.

Actions. Think through plausible scenarios in advance. Consider what resources may be required. Complement those resources with your applied knowledge and access to support services. Should anything occur, that requires even the most routine of responses up to an inclusive life safety and security incidents, your understanding in advance will determine or govern a successful outcome. This should by no means be an individual undertaking, and all travellers or attendees should consider leveraging from other support networks.

Bad things happen to good people all the time. It’s just a fraction of the overall time required to be spent on planning, managing and determining actions, that will determine the success of any incident, big or small.

The Great Human Migration-Chinese New Year 2010

The joy of travel?

This year’s Chinese New Year (CNY) celebrations is predicted to result in 210 million travellers, akin to the entire population of Indonesia or Brazil up and holidaying at the same time. Up 10% on last year. Air travel alone will see an increase of 29 million air travellers over the 40 days, the average monthly visitor rates for either Hong Kong or Singapore. All this makes CNY one of the great annual human migrations.

While current or persistent threats continue to act upon traveller and expatriates alike, this pilgrimage will generate and amplify a number of issues.

Airline safety and security was on the cusp of an easing of accepted trends and boarding protocols thanks to continuous and mounting pressure from consumer groups and sovereign representatives. The December 2009 attempt to detonate a device on a commercial carrier has changed that and allowed for another round of preventative frenzies and reflection. Other less popular issues have also been tabled for review such as the proliferation of falsified passports, raised by the head of Interpol.

Any major convergence of people presents a variety of public health and safety concerns. Coupled with epidemics, pandemics and varied personal hygiene standards; this will raise the level of risk to those exposed. Specific pathogens are ideally suited for transmission during this time or may benefit from accelerated global transmission. The first line of defence will be the traveller themselves.

Novice and seasonal travellers will be at risk by their actions. Carrying large cash reserves (for gift giving and travel spending), extensive wardrobe (cold and hot weather temperate zone shifts), prohibited items needed for sustenance (food and water), health maintenance (medicines and foods) and an inability to keep up to date on events that affect their travel will present opportunity to thieves, delay and frustration.

Commercial conditions will change and in some instances become hostile. Price hikes, touting, fraud, diminished services and decreased service staff will frustrate the process. While it should seem obvious that cab drivers and government staff would also partake in the seasonal break many are unprepared when they discover decreased or suspended support. Many employees will take extended holidays around key dates or public holidays.

Natural events such as weather and earthquakes will continue unabated and have a greater opportunity to disrupt. Concentrations of travellers are not the only ones at risk with those planning on connecting or transiting through areas that are affected.

The holiday and travel activity this Chinese New Year should be memorable for all the right reasons. Acknowledgement and planning for the overall upscale movements of millions of like-minded travellers will smoothen the likely mental stress. The plan is not the focal point to ensure a great family time or break but the planning process. This is even more essential for the business traveller. Consider all the facts, get good advice, keep abreast of changes as they happen, look out for others, keep in contact and be prepared to do specific things if something does go wrong.

Bad things happen to good people all the time but that number reduces dramatically for those with a plan and support.

Full Article

The Great Human Migration Chinese New Year 2010 from Enterprise Security Risk Management

Travel Security and Risk Management Forum

http://www.linkedin.com/groups?about=&gid=2270825&trk=anet_ug_grppro

Qui bono (Who benefits?)- Is your corporate resilience more about personalities than real threats?

The sky is falling!

The vast majority of companies, regardless of what they themselves believe, are significantly influenced in their resilience planning by the personalities that represent the process. Whether it is a sole champion or a department that is charged with the enterprise resilience strategy and execution of planning, it is most likely that their personal passions, skills, experience or even comprehension will dominate the overall corporate preparedness and response to actual threats. This phenomena is further compounded by the degree of humility or hubris of these executors and their ability to assimilate, even in the wake of such shortfalls, to rapidly and effectively respond to such oversights. Regrettably, it is often all too late to change at the 11th hour and many of the failing are dismissed/justified by environment, market forces, mother nature or just bad luck. Not the root cause. Sizeable amounts of money is lost, unrealized or expended on unnecessary opportune cost daily or annually as a result.

The scope and demands of modern and dynamic corporates, especially multinational or geographically dispersed entities, is by no means an easy task. A vast amount of knowledge and planning may be required and then resources/strategies applied to areas that warrant countermeasures/treatment solutions that then must be simplified or distilled for consumption and action by numerous stakeholders or line managers. Limited scope, ego, protectionism, arrogance, incompetence, budget constraints and many other issues act in unison to prevent a less than optimum result for all involved. The most resilient companies and the most efficient departments acknowledge all these issues and build such human failings and influences into the methodology to achieve superior results. Paradoxically, these companies are often the most competitive companies also thanks to this vision and forethought.

If this were not challenging enough, the character, charisma, communications skills or business acumen of the lead/executive representative of such functions could signal the final success or failure of all the accumulated work conducted that comes to then convincing the CEO/COO/CFO that a particular threat is credible or a specific investment is necessitated on the strength of the threat and the potential impact if left unchecked. Should they be found wanting, the threat remains unchecked. The squeaky wheel gets the oil!

Financial management has moved past this similar challenge (for the most part) by means of audits, internal checks, disclosure, review or external validation of findings. Risk management, of a non-financial nature, has a long way to go before such approaches become mainstream.

Resilience is based on a comprehensive understanding of all the assets/investments/capital at risk. Qualifying and quantifying the threats and the residual risk present; once current and proposed mitigation/treatment/corrective measures are implemented. A subsequent project plan based on budgets, tolerances, practicalities, strategies and threats is then initiated. None of this is possible or conducted until executive or leadership elements are consulted, convinced and contribute to the outcome, not retrospectively. The sheer diversity and complications of modern and fast paced business operations mandates that this process be a team sport and a collaborative approach.

If you have never met your risk manager, or contributed to the demand or have no budget for such measures, you are part of the problem and less a part of the solution and remain symptomatic of this chronic disease.

Like all addictions or dependency behavior, the first step in breaking the cycle begins with asking yourself some fairly honest and confronting questions. If you can’t affect change then you need help, not time, but actionable collaboration. If not, are you merely a wolf in sheep’s clothing, only to be discovered when most needed?

Chicken or the pig, what came first?-The growing menace from Swine flu and other health crisis

The evolving threat from any health crisis should be a major concern to all those charged with ensuring their company’s resilience. When Swine Flu first surfaced, the public interest was akin to the gold medal tally board during the Olympics, if my country isn’t represented in the top five, who really cares? Sadly, with planners and medical advocates focusing on an inconsistent and flawed measurement tools such as the WHO’s running tally, most will not recognize the threat until it is literally upon them and rife within their communities. Much like the stock exchange, if the S&P 500 is surging, it is no guarantee that you are inclusive of the rally, alternately if it is plunging you could very well be unaffected. Why should the WHO’s numbers be any different?

When it is widely acknowledged that most governments, certainly within developing countries, are not the most dynamic of organizations and the list of failings by numerous administrations remains long and varied; why have so many placed such absolute trust in their ability to manage this particular crisis? Are so few people aware of the already over extended healthcare system in even the most developed of countries? When people are already waiting lengthy periods for non-life threatening surgeries and general practitioners are dwindling in number do they really believe that thousands of people even mildly ill simultaneously will be serviced in a timely manner? Not to mention the issues over any drug or vaccination that is rushed to market exclusive of any standardized clinical trials. I agree that the current trial periods may be too long but look at the countries that are mandating or implementing widespread vaccination programs of the first round of vaccinations. Concerning? Volunteers?

Even the most progressive multinationals have turned a blind eye to the inequalities of everything outside their home country when addressing planning and prevention for a major health crisis like swine flu. Their “home ground” view seems to be the same assumptions and standards for addressing the issue abroad. Since when has India had the same labor laws as the US? Since when has Indonesia enjoyed the same level of broadband connectivity to enable for employees to telecommute? And who in their right mind would assume that employees in China will stay at home and monitor their own health to ensure they do not contaminate the rest of the office/factory? Contractors and consultants in the UK recently declared that they were unlikely to stay away from the office if sick as they are on an hourly/daily rate which would be reduced should they not turn up for work. So much for that assumption! How many people do you think fill in the health declaration forms accurately when entering a country with such screening? Even Hong Kong’s current attempts are nothing more than superficial and mere inconvenience rather than anything of substance or consistency.

Malaysia has acknowledged their citizens are oblivious to Swine Flu and its affects. India is in a growing state of fear over the sudden realization they could be affected too, and they are helpless to do very much at all. Many employees in companies within India simply walk off the job to care for family if they think or confirm an ailment. How much of the world’s back office is situated in India? What do you think the impact will be from thousands who don’t turn up for work or significant diminished service capacities within India? South Korea, Taiwan and China all have major problems. They thought it was a European and Americas problem. Their population is ill informed, suspicious of the government, dependent on them to do something, have very underdeveloped risk management strategies and little to no budgets for such countermeasures, not to mention the care of extended family responsibilities well beyond that of the European and American cultures. Forget what the conflicting medical opinion is, do you really believe this will not be a problem?

Swine Flu (I don’t refer to water as H20 either) is not a human health issue. It is not limited to public health and safety. Like never before, company resilience to this issue will be determined by their actions and implementation, not industry standards or piecemeal government efforts. More concerning is that while these companies will be well prepared, their vendors, suppliers, consumers, affiliates, distributors, advocates and just about everyone else will not enjoy the benefits of their planning and be at the mercy of dynamically shifting environmental influences. You don’t need an economist to confirm the impacts of the economic downturn, equally any similar announcements by the medical fraternity will come well after the obvious, and at present, inevitable impact. On the scale of victim to survivor, where do you fall?

Penny wise, pound foolish-human capital risk management

Do you know the actual value?

In spite of the considerable investment and development around the preservation of assets and the mitigation of risks across conventional corporate assets such as facilities, information, equipment and products, the same methodology and motivation remains far less advanced in regards to human capital.

Before any organization even explores risk management strategies for their human capital it is fundamentally important that they first determine the value at risk. Not only is it a case of valuing the contributions of the individual or groups of personnel but differentiating the value in which they contribute to the company, whether it be through the provision of specific skills and services or the commercial value they present the company. These distinctions also need to be made between job functions or management/executive levels. No two individuals are contributing to the company in the same manner, much less two diverse business functions.  How many companies even know this definitive financial value of their people?

Following the basics of valuation, and any other unique considerations that the company may have (mobile work force, fixed laborers, knowledge capital, research and development) a unit cost can then be applied for prioritizing strategies or expenditure. For example, an individual that reflects a unit cost/investment per hour of $1 will be less likely to addressed as a priority when compared to an individually that presents a unit cost/investment per hour of $100. However, if there are significant numbers of the basic unit cost of $1 at risk, that group as a whole may be a greater priority than that of a single or limited $100 per unit cost individual.

Threats and residual risks associated with human capital are many and varied. Over time a detailed and thorough analysis can be conducted to determine the probability, velocity of onset and other governing factors that will provide a single or annual loss expectancy to the company. A single loss expectancy, such as death, may cost the company significantly more than just the forecast value identified in the first stages. Conversely, an annual loss expectancy, especially in light of the fact many companies are unable to even quantify this loss, may equate to millions of dollars in lost productivity, administrative burden or opportune costs.

To truly understand or appreciate the current or potential losses to a company through their human capital it is imperative to model the disruptions and time loss (inclusive of management and departmental support) to a cellular and group level. If someone falls ill, how long are they unproductive? What does it cost the company? Should the become a victim of crime or their business activity disrupted due to a natural disaster, what is the cost to the company? When applied to our entire human capital asset base, what is our single and annual loss expectancy?

“You can’t improve what you can’t measure” If you are making a truly informed decision on where your assets are distributed, you can then make informed decisions around strategies to preserve their value. You also enjoy the benefits of comparative investment/management. Most companies are surprised to discover that despite their commitment to their people, they actually devalue their contribution by not acknowledging them as an asset and preserving it accordingly. Are you one of those companies?

Companies that have undertaken to approach the management of their human capital consistent with other corporate assets have found the process highly rewarding and very confronting. Conversely, those adverse to such strategies or behind the curve continue to loose more money than the cost of such preparation and mitigation. They too find over time that penny wise turned out to be pound foolish.