Monday, December 29, 2014

Risky Business

 A couple of articles have seemed spot on today.  Take a look below, for instance, at this summary of how a company can truly get in trouble.

"In order to be considered truly poorly run, a company must have a track record of missed opportunities, mismanaged risks, poor operational decisions, or executive malfeasance. In short, a company must demonstrate a pattern of decision making that calls into question the ability of its management and directors to adequately provide returns to shareholders."

Operational risk, then, is not just gaps or holes in existing corporate programs. This quote identifies some of the other areas that ASA looks at when it partners with a company.  It's from a Wall Street Journal article recently that looked at the most poorly run companies on the S&P500.  Holding down the top three spots on the list are IBM, McDonald's and Staples, all of whom suffer from sluggish strategic response to digital forces and changing market pressures.

 To this article, I would add Andrew Blau's new white paper for Deloitte on disruption, which seems apt when discussing strategic risk, especially since it is at this risk level that boards of directors are involved.  He notes that "The trouble with strategic risks is there’s often no historical precedent to draw from to assess their potential nature and impact. Sometimes they’re the product of a visible trend, but often they appear as a surprise. And hard as they are to spot in time or manage, they are extremely difficult to recover from."

It's not easy to be either an executive or a board member these days.  Decisions must be made very rapidly, often in the uncharted areas Blau describes in his paper, calculating the amount of risk exposure the decision may bring.

I'm on break right now, but will be back in the saddle next week, teaching the introductory operational risk course I designed in 2012, but which I have rather completely revised for 2015, to make it even more relevant to graduate students who know that risk taking and risk managing will be part of their leadership experience going forward.

Tuesday, December 23, 2014

Still thinking....

If I had something to say about current events, I would.  But I can't seem to muster more than a single sentence each morning over the past month or so.  In the meantime, I wish each and every one of you the happiest of holidays.  There is plenty to think about and more than enough to do as we move toward a new year.

Monday, November 17, 2014

Recurring risks

A recent Pew Trust survey of what people are most concerned about identifies inequity as the issue for Americans.  The locus of that concern over inequity has resided in Ferguson, Missouri, since this past summer's events.  Now, as we wait for the grand jury decision on the officer who shot and killed Michael Brown, cities all across the country have made plans to stand up their emergency operations centers because of possible demonstrations around the outcome.  It will be about more than that particular shooting.  Police departments across the board are having to answer indirectly for the response of the Ferguson and St. Louis police departments, none of which was by the book. 

Meanwhile, our concern that Ebola is coming to this country to infect us all has receded.  I wish I could say this is because everyone has understood the science behind the infectious disease, but I suspect that is rather that attention spans have moved on to other issues.  The West African coast is by no means out of the woods on Ebola, but there do appear to be some signs of progress with diagnostic tests that quickly identify then isolate patients while their contacts are tracked down and monitored.  Nigeria appears to have been most successful in its efforts, using mobile phones to quickly upload information and dispatch medical assistance.

In America, the airports that carry the traffic from West Africa are all monitoring incoming passengers.  And when soldiers return from helping to set up emergency centers in West Africa, they are being quarantined for 21 days.  So far at least, only four cases have been diagnosed in the United States -- three in Texas and one in New York City.  Three of the four patients survived, and it is suspected that the fourth might have lived if he had been properly diagnosed when he presented himself at the hospital.

We'll undoubtedly return to the issues of inequality and infectious disease again.  It is to be hoped that those on the front line will show us what it is to be a good citizen, a respectful participant in our democratic process.

Thursday, November 6, 2014

Coming up for air.

I have been down in the weeds with several risk issues that have been in the news, teaching two UW graduate courses on back to back days, and speaking at a couple of significant events here in Seattle.

I promise to write more in the November column for ASA News & Notes, which ships next Monday.

I intend to spend part of that column talking about what a social conscience can mean to a public company.

Wednesday, October 8, 2014

Purposeful Education

Now that the Ebola patient who was being treated in the Dallas hospital has died, it's time to get moving, without hysteria, with purposeful calm, on two fronts.

First, the media, particularly the virtual and broadcast media, need to tamp down the sensational hysteria and take that same amount of airtime to educate the American public about the value of flu shots, vaccinations for their children, and any other measures they feel might keep Americans safe.  I say this because we are about to deploy troops to Africa and it is likely that some of them -- or Americans already working in Western Africa -- might fall ill and need to be treated in our communities.

Second, it's not just hospitals who need to sit up and pay attention, and rehearse their response -- although from the comments of associations of nurses, it's clear that institutional strategies have not been shared, nor have the protective measures that will be put in place for personnel.  And the training and rehearsals must also include ambulance drivers and EMTs as well as a range of other medical support personnel. 

Meanwhile, vaccine trials proceed.   Trying out vaccines on patients already infected is not the same as a full on Stage 2 double bind trial that carries its own risks. In our rush to find a way to contain the virus, and to find a vaccine that works, we'll find a range of ethical questions presenting themselves.

Let's get started.

Wednesday, October 1, 2014

Public Health and the Secret Service both need better checklists

The Liberian public health and airport security personnel in Liberia did their jobs, and checked outgoing passengers at three distinct checkpoints.  We've patted ourselves on the back in this country for the sophistication of our medical capabilities, yet as I listened to the story today of the nurse in Dallas who followed a "checklist" and got a Big Red Flag answer back from the patient, but failed to escalate it in such a way that the team could isolate and contain the patient -- in fact, they sent him away with antibiotics and he came back a second time when he felt worse -- I thought once again of Dr. Atul Gawande's book, The Checklist Manifesto

This type of error is called one of ineptitude, as opposed to one of ignorance, presumably.  We don't know if this was an Ebola-specific checklist; one prepared by the hospital itself; or one from the Center for Disease Controls.  A quick read of Gawande's book might be very helpful, especially if the checklist has more than 5-7 items on it, without what Gawande calls "pause points."  His book is full of stories of how pilots, builders of skyscrapers and surgical teams perform extremely complicated feats, and how using checklists that involve every member of the team makes a difference.  His work in this respect for the World Health Organization has made a large impact:  deaths after surgeries have been reduced significantly by the implementation of several simple procedures that are part of the checklist.

I would also recommend the book to the new acting director of the Secret Service and to the panel that is currently being constituted to review the disturbing procedural/process failures over the last several years for the organization charged with guarding the president.  It may be that those procedures or processes have become shopworn.  Certainly it must be the case that, unless on a form of high alert (the United Nations responsibility, for example) agents' situational awareness is at an all time low.  Whether this is a factor related to the move from Treasury to the Department of Homeland Security or not is difficult to estimate, but will undoubtedly be reviewed by the panel.

The tipping point I mentioned last week seems more vivid as weeks go by.  Yet there was one piece of good news this morning:  that it appears Nigeria, the most populous and also most well-off African country in terms of infrastructure and medical personnel, has contained Ebola.  We just can't move quickly enough to get more personnel, hospitals, emergency operations centers and supplies deployed in the remaining countries. 

Thursday, September 25, 2014

A tipping point?

As I teach my second class this week, I realize how very focused I have been on two global issues, each of which has their own consequences from a risk perspective.

Many of you have been reading me on Ebola risk since last spring.  Though it does appear that the rapid mutation and growth of cases has caught the attention of the world stage, we are still a month or so away from seeing the actual deployment that result from commitments from the private sector (The Gates Foundation $50 million; Paul Allen $4 million, for example); and from both governmental organizations and world health organizations often funded with a mix of public and private sector funds.  This morning's New York Times story on home deaths in Monrovia, Liberia,  is just one more illustration of far away from our comprehension such a human situation is. All I am able to do is monitor the modeling that is now being done by research teams on how and where the virus will spread.

I understand that not more attention is being paid because terrorist threats from ISIL (The Islamist State) have risen to such a level that the United States once again finds itself leading an effort to push back against a cultural and religious landscape it doesn't understand.  This is especially the case now that ISIL is using social media to make its brutal points, as it continues to behead unbelievers on camera.

Watching the Ken Burns series called "The Roosevelts" last week caused me to reflect on how little either Teddy or FDR would have been able to accomplish today, with every moment, every gesture, every inflection studied of our leaders is analyzed into the ground.  FDR, for example, was able to prepare Americans for a war they initially did not want through the effective use of his "fireside chats."  When it was suggested after his first broadcast that he do them more often, he replied that their effectiveness would lie in them not being too frequent.  Ultimately he made 30 such talks over 11 years, covering both the Great Depression and World War II.

Today President Obama is in an entirely different place and time:  social media records every gesture,  microphones pick up even private conversations, and not much is any longer considered confidential.  He faces a passive aggressive Congress and election year votes that may change the very composition of the Congress, conveniently on a long break until after those elections.  To his credit, the president is leading as he always has wanted to lead: in the presence of other nations who also have a stake in the outcome.  To see both a Saudi prince and a Saudi woman piloting missions today is another sign of how things are evolving.

I'm keeping an eye on all of it, and have the rare privilege of being able to talk about these matters with my students as part of understanding the checks and balances that make up our system of government.  We use three lenses on such current topics:  ethics, policy, and law, especially when influenced by the evolution of technology.

For students especially, "we choose hope over fear."  (President Obama, yesterday, to the United Nations Assembly)

Sunday, September 14, 2014

Ebola Risk

I wish those public health departments would hold off from announcing that there is no risk to residents in America.  We don't know how long this will be true since globalization has truly reduced both time and space among countries.  It's also now being rather quietly suggested among epidemiologists that the virus is mutating so rapidly that it could become airborne.

I published an ASA News & Notes column last Monday on high level Ebola risk and the cultural dimensions that make containing Ebola just that more difficult.  Tomorrow a London-based magazine called The Risk Universe will be publishing a piece directed primarily to the financial sector, on how firms can prepare for bio-threats.  I'll post it up to our website, in case you're not already signed up to receive updates.  You can adapt many of the practices I recommend for businesses for your own family.

Monday, August 25, 2014

The bell has tolled. Did you hear it?

We all shivered when we read that the Napa region in California was recovering from a 6.0 magnitude earthquake early yesterday morning.  Today, some of the excitement has receded, as the area assesses damage and cleans up.
Always in the trunk of my car: boots, water bottle and "evac pack" with flares, blanket, etc.

From first floor hallway, our "away" backpack that contains supplies, water, food. I also have included information on medications, insurance policies, credit cards, etc.

We're nearing the end of a glorious Seattle summer, and starting to think about back to school matters.  Even as we're out there picking up school supplies, why not see what you can do about building or enhancing your emergency supplies kit?  Take a look at what you've got that needs to be replaced, or what you need in fact to get started.

My own challenge is larger than life.  Though we have one of those backpacks filled with dried rations, I don't eat processed foods any longer.  So I've started to think about what I could maintain off the grid that might work:  cans of low salt beans or tomatoes work fine, as do containers of unsalted nuts, but that's about it.  I eat several cups a day of raw salad or steamed vegetables, and four fruits, and a handful of nuts.  So that means I've got to start thinking about year-round gardening in a relatively small space.  I'll keep you posted on what I come up with.

In our neighborhood, we've organized even further.  Not only do we have the 300+ house region divided up with first aid and daycare sites identified, but we've raised the money to invest in medical supplies housed in each region.  We're now producing a laminated flyer with area-specific information for residents.   We're hosting a community event in September, and also signing up folks at an upcoming neighborhood event.  We have identified neighbors with special skills or access to tools we might need in the event of a major earthquake.

So we're moving forward, on the assumption that there won't be help from police or fire or emergency teams from the city for at least three days.  We are getting ready, that is, to help ourselves.

This model can be replicated in any city, anywhere.  If you'd like more information, let me know.

Thursday, August 14, 2014

My hands are raised.

There are so many critical points of decision for any thinking person nearly every day.  For each decision made, one would hope that there is a risk managed.  But it's not always so.  In the last week or so, the Ebola virus and the  Ferguson, Missouri chain of events take a great deal of thought, but without any clear path forward, no matter how much our hearts and minds might ache for those involved.  Is containment possible in either case?

I am saddened by the Africans' fear of American doctors, by the belief that the doctors brought and are spreading the virus.  At such a level of fear, education is very much hit and miss -- why should they believe medical personnel who tell them not to touch the bodies of their dead ones, or let them be burned by those wearing protective suits, who look like space aliens?  Why especially believe in the seriousness of the problem when your government leaders downplayed the risk for so long, when travel continues even now?  And then there's us:  we are told not to worry here, that there's very little risk.  Please expect that information to change once several more non-Africans are infected and cross borders.

Then we have Ferguson, Missouri.  Investigators have not yet even agreed on what happened last weekend.  Was an unarmed black youth's hands in the air, and was he yelling "Don't shoot?"  Or was he trying to take a police officer's gun away?  Who was the officer who shot him multiple times?  It won't be until outside investigators are on the case, this many days later, that we will begin to have answers or eyewitnesses are interviewed.  The fact of the matter is that the suburb of Ferguson has become a place not unlike Jackson Mississippi in the 60s, except that so far dogs and fire hoses have not been used. Riot gear and weapons are the modern replacements, but the police mindset is exactly what it was 50 years ago.  They are facing off against members of the media and a few troublemakers in what has each night been a peaceful crowd of citizens, exercising their right to peaceably assemble, as guaranteed in the First Amendment to the U.S. Constitution:

"Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble and to petition the government for a redress of grievances."

Unfortunately,  shooting young black men is an altogether too familiar news story for us here in America.  Congressman John Lewis asked today who knows what those young men could have become:  "How many more young men of color will be killed before we realize that we have a problem in America? We are permitting the incarceration and shooting of thousands of black and brown boys in their formative years who might have become great artists, leaders, scientists, or lawyers if we had offered them our support instead of our suspicion.

Yesterday, this photo appeared from students at Howard University.

I stand with the Howard University students, and with the Ferguson citizens who have come out each night to ask for an accounting of what happened last weekend, whose hands are also raised.  I hope you will consider standing with them too.   Not just this week, but into the future as we demand better accountability and less stereotyping and profiling from our police officers, no matter what city we are in.

Tuesday, July 29, 2014

Travel risk is high

It's not just that airplanes have been disappearing, or shot down, or that the infectious disease Ebola is out of control in parts of Africa, or that Tel Aviv travel was suspended by major airlines when shelling came too close to the airport . Travel risk has always been an issue for corporations whose employees are spread round the globe.  In this morning's New York Times article, Joe Sharkey goes inside a gathering of corporate travel managers to better understand their concerns, including legal and ethical risks, given the last week or so of travel events.

If you're traveling on your own and don't have a corporate travel office to rely upon to filter out threats and make best recommendations, then your best bet is to go to the Department of State's website and read through the threat analysis they perform on countries you might visit. 

If you're just learning to travel, then the "On The Road" chapter of Advice From A Risk Detective will be of use.

No one wants you to stop traveling.  But we do want you to make safe choices at a time when many parts of the world are less stable than usual.

Sunday, July 20, 2014

Happy Fifth Annivesary!

Here's a look back at my blog post from July of 2009, where it all started with the launch of ASA's website and a celebration.

 ASA Launch Photo Essay

As I mentioned yesterday, the launch party was a grand event. All design and details were handled by Lauren.

She persuaded photographer Weston Jandacka to come and shoot the first two hours of the party. These are all his photos.

Lauren and Leroy guarding a tray of chocolate dipped strawberries and Trader Joe's cashews.

ASA logo designer Jesse Brown looking over the website in a moment of quiet...

Mike Crandall and myself....

Another of Lauren's table arrangements...

Mike, Annie and Shelby Edwards.

From the left: Bruno Langevin, Bo Hok Cline, Julie Hillers, Annie and Karen Pierce, right foreground. Al Wilson is in the background.

Shelby Edwards and Fred Pursell.

Greg Harp greets former colleague, Kris Jorgensen.

The First and Union web team....Sherry Stripling, Rick New, and Molly Martin.

Annie and visual artist/architect Bo Hok Cline.

There are always folks in the courtyard, near the food and drink.

Left to right: Molly Martin, Eric Holdeman, Al Wilson, Annie.

Greg Harp, Kris Jorgensen, Steve Hankel, who drove up from Portland.

Susan Hildebrand Stringer.

Al Wilson and Greg Harp.

Jan Reynolds.

Me and my former boss, Deb Horvath, who is always there to support me.

Here are the co-conspirators looking a little punchy: Annie and Lauren, who has made this launch and my summer a truly memorable experience.

Last but by no means least. Tracey Graham. one of my former team, now leading the Washington state financial coalition. She presented me with a three legged frog who has coins in his mouth for good fortune. When we are in the office, the frog looks out the door. When we leave, we face the frog into the office, so as to maintain our good fortune.

It is a pleasure to have friends and colleagues such as those pictured above, especially when you have known many of them through various cycles of their lives.

For a few more thoughts on what we have accomplished this first five years, and how things are about to evolve next month, please take a look at my personal blog, "A Walker's Journal."

Saturday, July 19, 2014

What technology hath wrought....

Last quarter, I received an excellent paper on the risks around robotic surgery.   This morning, I opened my TED summary to find a TED talk about a new and improved trochar, designed by an engineer.  And when I opened the   the Financial Times later this morning, I found "Wear Your Medicine," on new digital tools for those with medical conditions.

We view much of what medicine has to offer with increased trepidation over cost, over whether or not a procedure or medicine is actually necessary, and with suspicion that is a result of having seen too many revisions on instructions on what is or is not good for your health.  As technology has more of an impact on the medical profession and on healthcare in general, costs appear to be rising, not decreasing.

The most egregious example of course is the layers of bureaucracy and incompetence among schedulers for the Veterans Administration.  It's not just that it's difficult to get an appointment.  The computer platforms are  outdated and interconnections with other relevant databases -- like military medical record history -- seem to be painfully slow or non-existent.  Both the military and the Veterans Administration have the same challenges as private hospitals in bringing what were formerly paper records online.

The moral of this reflection is that what technology hath wrought is often peril rather than streamlined ease of use, whether it's in large databases, surgical suites, Google Glass, or even smart contact lenses for diabetics.

Monday, June 23, 2014

On the road again!

I'm off in the morning to Boston, then on to New York City.  I'll actually spend four days away this trip, something not possible during the academic year, when I'm teaching.  Though this is a work trip, it certainly feels more like a vacation in many respects.

I'll be at New York University on Wednesday and Thursday for a gathering called the Global Risk Forum, a group of 50-60 experts from around the world and major critical infrastructure sectors on both the public and private sides that meet once a year.  I've been attending since 2007, when we met in Florence.  This year's forum looks at regional resilience and will feature remarks from colleagues like Pete O'Dell on cyber, Brian Tishuk on coalition building, and Paula Scalingi on regional focus.   The keynote address on the first day will be on climate change, and I'll report back on that and other sessions that take place.

I'll have time to visit the recently completed 911 museum that we saw a year ago under construction on Friday morning.  The museum is mostly underground, with the memorial fountains outside marking the actual footprint of the towers.
Names of those who died are inscribed on the sides of the fountain.

2011 Fountains still under construction

Original WTC slurry wall preserved in museum.
One of the original WTC girders, also preserved in the museum.

Assuming that my faculties are still working after that visit, I hope to work in a trip north to the Metropolitan Museum of Art to see the new roof garden installation as well as a Chinese calligraphy show and an exhibit of wallpapers and textiles from William Morris.  I figure I can go directly from the Met to the airport if necessary.

Post trip postscript:  I just plain ran out of time and energy.  Next trip I will build more time into such visual pleasures.

Thursday, June 12, 2014

Locking your house

Here's a very thorough review, titled "Losing the Key" by Steven Kurutz, of the pros and cons of digital security systems for the home that appeared this morning in the New York Times.  Despite some appealing new features on many of the locks now available, I'm sticking with old-fashioned locks as first line of defense.

Wednesday, June 4, 2014

Is there such a thing as Free Wi-Fi?

Here's a terrific New York Times article on how to think about free wi-fi, and what precautions you can take to be as sure as you can that it's safe to use that service.

Over the next couple of weeks, as we move into summer, we're going to be talking about this type of basic blocking and tackling on the Internet.

Friday, May 9, 2014

Cyber Incident Management

When I was in New Orleans last month at the Continuity Insights conference, I heard Steven Ross from Risk Masters make a presentation titled "Cyber Attacks: Myth and Reality."  Ross has been doing this work for a long time, and much of his talk covered sensible risk management against possible cyber threats.  He hooked me into the discussion once he suggested we get rid of the myth that business continuity and information security are two distinct groups.  Then he backed up and proposed a special crisis management team for cyber.  I was not enchanted with this notion, since the more teams created, the more the confusion reigns about who is in charge.  His proposed team looked a lot like what the standard crisis management team would look like in environments where I am charged with streamlining business processes and corporate functions.  One of his justifications for the creation of a special team was that a crisis management team that usually focused on traditional recovery methods like redundant data centers just wouldn't work for cyber, because it is likely that the software will be infected in both locations.

I came away from that session thinking that even seasoned professionals, in a field where we have a dearth of candidates for actual posted jobs, are still thinking in hierarchies and processes that are not real time where cyber is concerned.  The best possible scenario, at least in my view, would be for there to be a cyber incident response team that worked on the ground up until a point when a trigger (cost, additional resources, reputation, media) kicked the questions that applied up to the regular crisis management team to handle while they kept working on the ground.  Target is a good example of a company that could benefit from this type of streamlining, now that they have shed both CEO and CIO, and become the target of a range of lawsuits.  That corporate sloppiness is going to cost them millions before they are through this problem -- and I would doubt that their insurance company will be paying out against any of the loss, given that their security team ignored alerts about compromises of their systems.

Yesterday, I had the privilege of hosting former Seattle CISO Mike Hamilton in my advanced risk course.Through examples and out of his years of experience,  he made clear to students that firms can avoid financial loss from cyber attacks only if they employ state-of-the-art monitoring (and then pay attention to what the alerts say); and by developing a "rapid-response capability," using on the ground data collectors like help desks and ticketing systems to escalate incidents.  He suggested that key metrics any firm could invest in would be time to incident close, cost per incident,  and incident frequency.

Two thought-provoking takes on the state of the union where cyber is concerned.  I'll get a third perspective later this month from Aaron Weller, head of PwC's information security practice here in Seattle, when he visits the same class.  Along the way, before they here Aaron, they'll hear from Microsoft security chief Mike Howard, who'll describe the global reach of his organization as well as Mary Gardner, head of information security at Fred Hutchinson Cancer Research Center.

Though security isn't the only area of risk we focus on in this course, it's certainly central to many of our discussions.

Sunday, April 20, 2014

To Know Your History is to be Boston Strong

Building's tribute to its great architect, Charles Follen McKim.
Front left steps of the Boston Public Library pays tribute to science.

Right side of the steps pays tribute to arts and humanities.

Inner doors.

No lion is complete without inscriptions.

And also the other half of a pair.

Looking upstairs from the central entry.

More of the ceiling and second floor.

A busy reading room.

A look at the stacks.

A fine second floor room in which to hold receptions among those who think.

Geography anyone?

Could you work here?

Temporary Exhibition Space, probably where they will present the Boston Strong exhibition.

 This post is reproduced here in its entirety from last week's update in my personal blog, "A Walker's Journal."

I shot these photos in the Boston Public Library in January of 2013.  Since it's National Library Week and also the place where so many will go to view the Boston Marathon exhibit, I thought you might like to see what a magnificent building it is.  The library dates to 1848 and is the second oldest publically supported municipal library in the United States.  All residents of the Commonwealth of Massachusetts have research and borrowing privileges.

CBS did a moving segment  last night on the new exhibit that opens Monday at the library.  The library, like the historic Trinity Church across the street, was just blocks from the finish line of the marathon.