Category Archives: Risk Management

Игроки всегда ценят удобный и стабильный доступ к играм. Для этого идеально подходит зеркало Вавады, которое позволяет обходить любые ограничения, обеспечивая доступ ко всем бонусам и слотам.

Preparing for the Next Stage of the COVID-19 Pandemic at RIMS Content Roundtable

Posted on by

In last week’s “RIMS Content Roundtable: COVID-19 Vaccines and Distribution,” a group of RIMS members gathered for an exclusive Q&A with Dr. Adrian Hyzler, chief medical officer at Healix International, who focused on progress with COVID-19 vaccination efforts and moving toward a “next phase” of the pandemic.

“Where we’re headed is: this pandemic will end—all pandemics end—but it doesn’t end all of a sudden, it goes out with a whimper…it sort of just seeps away at different rates around the world,” Hyzler said, noting the rates of vaccination and controls implemented country by country will curb the coronavirus at different paces. “But it’s now going to be an endemic disease, meaning it’s something we live with. We’re not going to get rid of this disease.”

He believes recognition among public health experts that COVID-19 will become endemic rather than be eradicated prompts new conversations about expectations and preparations around the world.

“The new dialogue is: what is the acceptable level of COVID and what is the acceptable level of deaths from COVID? Because COVID is a respiratory disease and people die of respiratory diseases every year, especially in winter. That’s something we live with,” Hyzler said. “We’re going to have to get to a point where there are going to be people who die from COVID every year, but they’re not going to overrun hospitals, and they’re not going to affect care of other diseases.”

Getting to the stage of “a disease we live with” requires mass vaccination, and he stressed the importance of the widespread effort to encourage people to get COVID vaccines as soon as possible. Scientists are not yet sure what percentage of the population will need to be fully vaccinated to control the pandemic sufficiently and, he said, “that’s vaccinated across the whole population evenly, and that’s not the case—we know there are communities where they are vaccine-hesitant, we know there are religious groups that are not as confident about the vaccine, and they tend to cluster, so those are always ready for outbreaks.”

Rather than discuss the sometimes controversial or scientifically debatable concept of “herd immunity,” Hyzler encouraged thinking about “community immunity.”

“‘Community immunity’ is good because it’s more about what we can do for each other,” he explained. “Getting vaccinated, for a 28-year-old, is not necessarily about that person, it’s about what it can do for the community—the older people, the people who have preexisting conditions that make them vulnerable.”

This kind of community orientation and widespread adherence to best practices will be critical in getting to any next phase of the pandemic, and to staying there. Reflecting on his experience of the acute lockdowns implemented in the U.K., for example, Hyzler stressed the lessons learned about the impact of mass adherence to mitigation and prevention measures. “Even with the variant that’s come out here that is very transmissible and has become common in the States, we’ve shown that non-pharmaceutical interventions—which are masks, distancing, isolation, hygiene—they work,” he said.

Many of these non-pharmaceutical interventions will not be going away any time soon—indeed, they may be just as critical moving forward. Hyzler predicted, “I think, into next year, we may still be wearing masks in many situations and there may be a great move to more things outdoors, since we know how much safer that is, and I think we’ll have learned a lot of things from this… Hopefully we’ll also be more ready for something that will happen again.”

As the world moves toward mass vaccination to help curb COVID-19, companies should be preparing for the next stage of the pandemic and creating detailed plans for safely returning to work. To that end, Hyzler noted some large private companies have publicly offered resources to help other enterprises protect employees and operations amid the pandemic and prepare for a return to workplaces.

For example, Ford has published two versions of a “Return to Work Playbook,” one for manufacturing and another for non-manufacturing companies. According to Ford, in addition to providing these documents to employees, “the company is also providing a copy to its suppliers, business partners and relevant third parties to ensure they are all aware of its health and safety practices when they are on site at Ford facilities or are interacting with Ford personnel.” Companies outside of Ford’s supply chain can also benefit, however.

“Add in some CDC advice, and look at what people [around you] are doing, because there are little things you can do that are very specific to your area or your workforce,” Hyzler recommended. “Then, take the information [from the playbook] that’s useful and mold it into a mini version of a playbook, if you’re a smaller company.”

In addition to the Ford playbooks Hyzler mentioned, check out these publicly available resources from the private and public sectors that may offer help in managing COVID-19 risks and creating a return-to-work plan for your enterprise:

Ford’s Return to Work Manufacturing Playbook [PDF]
Ford’s Return to Work Non-Manufacturing Playbook [PDF]
IBM’s Return to Workplace Playbook [PDF]
Kaiser Permanente’s COVID-19 Return to Work Playbook
CDC’s Guidance for Businesses and Employers Responding to Coronavirus Disease 2019 (COVID-19)
CDC’s “Daily Activities” Guide for Returning to Work
OSHA’s Protecting Workers: Guidance on Mitigating and Preventing the Spread of COVID-19 in the Workplace

Participants in the roundtable event were able to debrief with fellow risk professionals in breakout rooms, sharing impressions from the session and experience addressing related risks within their own organizations. For more opportunities to discuss return-to-work plans, vaccine considerations and other COVID-related risks with other risk professionals, all RIMS members can continue the conversation on Opis, the society’s community engagement and networking platform. Among almost 200 education sessions, the upcoming RIMS Live 2021 virtual conference will also offer dozens of COVID-related education and networking events from April 19 to 30, and registration is now open. To hear more insights directly from Dr. Hyzler, you can check out his appearances on the RIMScast podcast.

Human Trafficking and Supply Chains: Q&A with Tim Nelson of the Slave-Free Alliance

Posted on by

The International Labour Organization estimates that 25 million people are subject to human trafficking around the world, with children comprising one of every four victims. In many cases, the victims are used and transported by their traffickers in supply chains. 

Tim Nelson is the international development director for Hope For Justice, an anti-trafficking organization that aims to end modern slavery. He also holds the same title at the Slave-Free Alliance, an affiliated group that collaborates with businesses to assess and prevent the risk of human trafficking in their supply chains. Nelson recently appeared on RIMScast to discuss the how human trafficking has evolved into a major supply chain risk and how employers and employees can identify signs of this abuse.

Check out some highlights below, and to take a free deep-dive with Nelson and learn how to take action to prevent human trafficking in your company and community, download RIMScast episode 120.

For more information on steps businesses should take to help identify and combat modern slavery on their premises, you can also check out the Risk Management feature article “Human Trafficking: How Businesses Can Combat the Modern Slavery Epidemic.”

What inspired the creation of the Slave-Free Alliance?

Tim Nelson: We primarily started in the U.K., and formed because of the Modern Slavery Act, which requires companies with £36 million (about $50 million) or more in their annual revenue to state their efforts to remove slavery from their supply chain. Consequently, we tend to work with businesses above that £36 million level and we try and effectively help them honor their commitment.

We also work alongside federal or local police and alongside other NGOs and effectively try and be a trusted friend. Many people, because of the countries that they come from or what they’ve been told, are suspicious of police or are worried about corruption. We can be there to build that bridge of trust.

How can someone identify trafficking and modern slavery?

TN: Traffickers are those individuals who would use other people to generate profit for themselves and are looking for every opportunity. Global estimates indicate that there’s $150 billion made from this illegal activity. And therefore, the traffickers have thought it through. 

One of the complexities in identifying it is that human trafficking is hidden in plain sight. The common form that most people are aware of is sexual exploitation. But ultimately, traffickers [also] realized that they could traffic individuals to work in the supply chains of businesses, making components, working in manufacturing, working in agriculture.

Could you provide an example of how traffickers permeate supply chains?

TN: Last year there was a case where 400 victims were identified as being slaves within the primary supply chain of some of the major supermarkets within the U.K. And, like we said earlier, it was in plain sight—no one could see how this was happening.

This particular occurrence happened because the traffickers had gotten control of a recruitment company and they were able to bring individuals from a non-English-speaking nation to the U.K. Those individuals were given jobs, but the traffickers had control of their bank accounts. They were forcing these 30-plus individuals to live in a three-bedroom property. Many of them were washing themselves in a local river—not having running water was a sign that this is not how people should be living in 2020. 

National Slavery & Human Trafficking Prevention Month is held annually in January to educate about the different forms of human trafficking. What can risk professionals do to ensure the awareness continues all year?

TN: I would encourage all businesses to realize that they’ve got the power to change this so easily if they start to engage and put in different processes and systems. And part of what we’re trying to do is not to just encourage individuals or companies to stop buying goods from a particular company. If you just stop dealing with a company because you suspect there’s modern day slavery or trafficking happening, that company will close and another one will open like a phoenix. Companies can also sometimes be complicit just by not even looking or allowing enough due diligence to show that they are slave-free within the supply chain.

Is there a bottom-line impact as well?

TN: What we are seeing now is, internationally, inaction can be a major risk to your business. I can think of companies where issues around slavery were brought to the fore and share prices dropped by half as institutional investors pulled out. This is a key ESG issue, which makes it a C-suite-level risk in many cases.

What should companies expect when they engage with the Slave-Free Alliance?

TN: The first thing that we would do is conduct a gap analysis. This is not just looking at where you’re getting supply from—it’s to try and identify the weaknesses that may be in your supply chain. And that gap analysis forms something almost like a risk register.

Every company is different. I spoke to a Fortune 100 company last month that didn’t even have a procurement division. And that’s what I would have assumed every major multinational had. But every company has a different approach to it.

Quite often, a lot of people find that the even the thought of how big their supply chain creates a massive complexity because there might be just three people running the procurement department.

When we see something that would sit within the risks that we identify, then we work with the companies to diminish that risk. It could be an [unannounced] site assessment or working with those people who are going in and auditing the factories themselves.

For more information about how your business can combat and identify modern slavery, visit the Slave-Free Alliance and Hope For Justice. You can report suspected activity in the U.S. to the National Human Trafficking Hotline and internationally to the International Labour Organization.

How to Prepare Now for Your Next Crisis Post-COVID

Posted on by

As business leaders remain hyper-focused on navigating through the pandemic, few have sufficiently considered how to prepare for the next major crisis. There are many steps leaders can take, some of which include reassessing their risk management plans, constructing cohesive frameworks that proactively identify potential gaps, and identifying protocols and procedures to fill those gaps in preparation for future crises, no matter how big or small. 

Reflect and Optimize

Very often, companies have not taken the time to assess how they responded to previous crises because they are either too busy afterwards, or too happy to have survived with minimal consequences. But the pandemic has shown that this is a dangerous game to play. While we have seen that most organizations had some of the core elements of crisis management success—whether a crisis management plan and team, mass notification technology, risk and intel monitoring capabilities, or business continuity plans and teams—many had (and still have) not connected these parts into a successful framework. Moreover, they have not reflected on those plans to improve them and optimize their crisis and risk management approaches.

Businesses must evaluate their preparedness for and response to past crises and use lessons learned in those reviews to optimize their responses moving forward. Given COVID-19’s unexpectedly “long tail,” companies should review and reflect on their plans now, rather than wait months or years.

Create or Enhance Your Plan

While enhancing an old crisis plan or developing a new one will take work (and cost money) upfront, it is a process that will pay massive dividends in the long run. Once businesses have a concrete crisis management plan in place, have practiced the plan, and are prepared, the cost will realize itself both in terms of the monetary outlay and by mitigating potential risks that could prove highly detrimental to the business down the line. While different companies take varied approaches to crisis management planning, certain plan elements have proven their value during COVID-19 and likely will again during future crises. This is demonstrated in “the 3 S’s”: scenario analysis, stakeholder analysis, and standing media agenda.

  • Scenario analysis: Scenario analysis encourages companies to focus on the best, worst, and most-likely case scenarios when confronting a crisis and planning for various organizational responses. At the beginning of COVID-19, many companies saw the crisis as a “China problem,” and did not actively prepare for its potential global impact. Preparing in this way would have enabled them to have a broader, more proactive approach to crisis management, rather than getting caught in constant response mode, as many companies were. 
  • Stakeholder analysis: In times of crisis, businesses must quickly identify the key internal and external players that will be impacted and require critical attention. The companies that do so will be able to quickly identify their specific needs and/or interests and build their crisis responses around them. Not doing so often results in disorganized management of key stakeholders, exacerbating the impact of the crisis and/or causing additional work for the crisis team.  
  • Standing meeting agenda: Standing meeting agendas are crucial for helping to keep meetings on track, ensure discussions are impact-based and holistic, and guarantee key facets of the response are consistently revisited until resolved. Organizations that do not utilize standing meeting agendas often find their meetings to be frustrating, disorganized, and never-ending as conversations go around in circles.

Practice Responding to Crises

It would be easy to believe that you do not need to practice your crisis responses and exercise your plans after navigating a massive crisis like COVID-19, but that would be a mistake. Every crisis has its own unique characteristics, impacts, and challenges, and crisis exercising has proven to be one of the most effective means of preparing organizations and their leaders for navigating the next crisis or managing multiple, smaller crises at once. Just as with physical exercise, crisis exercising keeps organizations nimble and helps develop organizational muscle memory to ensure businesses and leaders are prepared for a real crisis.  

Do Not Forget Travel 

While most business leaders are thinking about bringing people back to the office, few have considered that many, ironically, are going to be looking for opportunities to leave it again—getting back on the road and visiting suppliers, customers, etc. So it would be short sighted for companies to only focus on policies and procedures around returning to the office, when they should start thinking about policies around returning to travel too. This will bring exponentially more challenging situations given the lack of consistency and (likely) inequity of vaccine distributions across the world, especially in developing nations where many employees may be traveling. Business leaders should be thinking about this now and planning for how to enable and support employee travel when it is safe to do so.

Take Risk Management and Monitoring Seriously

Risk management programs can no longer be developed with a “check-the-box” approach. As COVID-19 proves, high impact-low probability events are not only possible but probable, and so companies must take risk management and monitoring seriously. During this time, companies have started to build information and intelligence monitoring capabilities to help them digest the large volume and varied kinds of information they are receiving. This has included agreeing on scenarios and triggers that, when met, result in particular organizational action (e.g., reopening the office when case counts are at a certain level or enough people have received the vaccine). The last thing companies should do is stop monitoring when it seems as though the pandemic or any other crisis seems to be slowing or ending. In fact, organizations should not only maintain this monitoring but expand it to include other risk types identified during the crisis that could create another significant disruption down the line. This will allow the organization’s leaders to make data-based, proactive decisions rather than waiting until a crisis happens.

Crisis and business continuity planning has never been more important. The COVID-19 pandemic has dramatically shifted the way businesses operate and has created new problems that business leaders must solve. To effectively plan for the next crisis, leaders must prioritize these capabilities, creating a holistic framework that addresses various types of threats. Taking these steps now will better prepare organizations for the next major crisis, however unlikely and no matter the scope and scale.

On Data Privacy Day, Catch Up on These Critical Risk Management and Data Security Issues

Posted on by

Happy Data Privacy Day! Whether it is cyberrisk, regulatory risk or reputation risk, data privacy is increasingly intertwined with some of the most critical challenges risk professionals face every day, and ensuring security and compliance of data assets is a make or break for businesses.

buy prevacid online www.soundviewmed.com/wp-content/uploads/2023/10/jpg/prevacid.html no prescription pharmacy

In Cisco’s new 2021 Data Privacy Benchmark Report, 74% of the 4,400 security professionals surveyed saw a direct correlation between privacy investments and the ability to mitigate security losses. The current climate is also casting more of a spotlight on privacy work, with 60% of organizations reporting they were not prepared for the privacy and security requirements to manage risks with the shift to remote work and 93% turning to privacy teams to help navigate these pandemic-related challenges. Amid COVID-19 response, headline-making data breaches and worldwide regulatory activity, data privacy is also a critical competency area for risk professionals in executive leadership and board roles, with 90% of organizations now asking for reporting on privacy metrics to their C-suites and boards.

“Privacy has come of age—recognized as a fundamental human right and rising to a mission-critical priority for executive management,” according to Harvey Jang, vice president and chief privacy officer at Cisco. “And with the accelerated move to work from anywhere, privacy has taken on greater importance in driving digitization, corporate resiliency, agility, and innovation.”

In honor of Data Privacy Day, check out some of Risk Management’s recent coverage of data privacy and data security:

CPRA and the Evolution of Data Compliance Risks

Also known as Proposition 24, the new California Privacy Rights Act (CPRA) aims to enhance consumer privacy protections by clarifying and building on the expectations and obligations of the California Consumer Privacy Act (CCPA).

Frameworks for Data Privacy Compliance

As new privacy regulations are introduced, organizations that conduct business and have employees in different states and countries are subject to an increasing number of privacy laws, making the task of maintaining compliance more complex. While these laws require organizations to administer reasonable security implementations, they do not outline what specific actions should be taken. Proven security frameworks like Center for Internet Security (CIS) Top 20, HITRUST CSF, and the National Institute of Standards and Technology (NIST) Framework can provide guidance.

Protecting Privacy by Minimizing Data

New obligations under data privacy regulation in the United States and Europe require organizations not only to rein in data collection practices, but also to reduce the data already held. Furthering this imperative, over-retention of records or other information can lead to increased fines in the case of a data breach.

buy ocuflox online www.soundviewmed.com/wp-content/uploads/2023/10/jpg/ocuflox.html no prescription pharmacy

As a result, organizations are moving away from the practice of collecting all the data they can toward a model of “if you can’t protect it, don’t collect it.”

3 Tips for Protecting Remote Employees’ Data

As COVID-19 continues to force many employees to work from home, companies must take precautions to protect sensitive data from new cyberattack vulnerabilities. That means establishing organization-wide data-security policies that take remote workers into account and inform them of the risks and how to avoid them. These three tips can help keep your organization’s data safe during the work-from-home era.

What to Do After the EU-US Privacy Shield Ruling

It was previously thought that the EU-US Privacy Shield aligned with the EU’s General Data Protection Regulation (GDPR), but following the CJEU’s recent ruling, the Privacy Shield no longer provides a mechanism for legitimizing cross-border data flows to the United States. This has far-reaching consequences for all organizations that currently rely on it. In light of the new ruling, risk professionals must help their organizations to reevaluate data strategies and manage heightened regulatory risk going forward.

The Risks of School Surveillance Technology

Schools confront many challenges related to students’ safety, from illnesses, bullying and self-harm to mass shootings. To address these concerns, they are increasingly turning to a variety of technological options to track students and their activities. But while these tools may offer innovative ways to protect students, their inherent risks may outweigh the potential benefits. Tools like social media monitoring and facial recognition are creating new liabilities for schools.

2020 Cyberrisk Landscape

As regulations like CCPA and GDPR establish individuals’ rights to transparency and choice in the collection and use of their personal data, one can expect to see more people exercise these rights.

buy doxycycline online www.soundviewmed.com/wp-content/uploads/2023/10/jpg/doxycycline.html no prescription pharmacy

In turn, businesses need to ensure they have formal and efficient processes in place to comply with such requests in the clear terms and prompt manner these regulations require, or risk fines and reputation fallout. These processes will also need to provide sufficient documentation to attest to compliance, so if businesses have not yet already, they should be building auditable and iterative procedures for “data revocation.”

Data Privacy Governance in the Age of GDPR

As personal information has become a monetizable asset, risk, compliance and data experts have increasingly been forced to address the regulatory and operational ramifications of the rapid, mass availability of personal customer and employee data circulated both inside and outside of organizations. With new data protection regulations, Canadian and U.S. companies must reassess how they process and safeguard personal information.

Key Features of India’s New Data Protection Law

Among the new data protection laws on the horizon is India’s Personal Data Protection Bill. While the legislation has not yet been approved and is likely to undergo changes before it is enacted, its fundamental structure and broad compliance obligations are expected to remain the same. Companies both inside and outside India should familiarize themselves with its requirements and begin preparing for how it will impact their data processing activities.