The Art of War and ERM – Energy
This is the sixth chapter in Grace Crickette’s series of posts focused on how to gracefully bring together traditional risk management, change management techniques and enterprise risk management concepts by using phrases and tactics to develop strategies devised by Sun Tzu, a Chinese military general, strategist and philosopher.
Make ERM Not War
Art of War Key Principal: Opportunistic Flexibility in Adapting Strategies and Tactics to Situations
The way to capitalize on the endless opportunities created by ever-changing conditions, is to become engaged as a part of a well thought out plan and be flexible in adapting tactics to those ever-changing conditions within the context of each pre-determined strategy.
Chapter V, focuses us in on moving to the Creative or Energy mode, wherein the greatest amount of preparation and on-going effort takes place in implementing Enterprise Risk Management.
In the prior post I provided a menu of common elements of an ERM Program. Let’s focus in on the first element, understanding the organization.
Understand the Organization
In addition to understanding the processes and procedures and basic “ins and outs” of your organization, you need to learn its culture. There many studies on organizational culture, what it is, how to improve it, how leaders impact culture, etc. I’m of the belief that culture is like the weather, it is always there and is not static. You take the weather with you wherever you go — meaning that while an organization through its mission, vision and values, governance and accountability efforts can provide the foundation and cornerstones for encouraging a particular
culture, there are still micro-climates within divisions, units, departments, and even individuals.
Every individual has their own micro-climate that extends beyond themselves and impacts others based on their experiences and paradigms. For the ERM Practitioner simply understanding the organizations culture is not enough. ERM is about change, and change requires developing relationships and influencing others. You have to understand the various micro-climates through-out the organization.
One approach to understanding the micro-climates in our organization and connecting with people is to conduct a risk assessment to find out what risks individuals and groups are facing in your organization, but proceed thoughtfully.
Particularly for an initial implementation of a risk assessment, try and avoid sending out a survey or file for people to complete, rather meet with people in-person, or at least via web or phone and have a conversation (which you will document and use to populate your assessment framework).
Also, really think about how you want to approach the discussion. If you want to drive a risk aware culture, then try and avoid a risk adverse approach, both in your assessment process and in your conversation. One technique is rather than asking people “What keeps you up at night?” try asking “How do you know you are managing your area of operations well?”
The answer to “What keeps you up at night?” could be anything from a large earthquake to workplace violence to currency devaluation. All serious concerns, and surely ones that need to be mitigated and monitored, but this type of questioning often gets a response that is not very telling and does not reveal the issues or drivers that are impacting current strategic and operational activities.
How do you know if you are doing well?
- My continuity plan is up to date and when we tested it, we found that it worked well, but we need additional processes around who has access to purchase cards.
- When we retain good employees. But I can’t get adequate data from our HR IT systems to figure out what the drivers are.
- Our customer satisfaction survey shows improved scores, but I have noticed that our employee satisfaction results have been headed the opposite direction.
When you ask an “upside” question, you tend to get a response that informs you about the day-to-day concerns, and the issues raised are much more actionable. You get a better sense of how people are feeling about the workplace, and how they are achieving success and managing challenges.
With an “upside” question, people tend to be much more open and will volunteer information, even about what is not working well. You start to understand if the climate is sunny or stormy. This approach creates an opportunity for you to help solve a local problem and then leverage that success to engage a broader audience in identifying and mitigating risk across the enterprise.
Key Takeaway: Implementing ERM takes energy and creativity, understanding your organization’s culture requires that you engage with the people. Taking a creative approach to conducting a risk assessment can help you to understand the challenges your organization is facing and reveal opportunities for you be of assistance. Get away from you dangerous desk and connect with people!
Remember – It’s not Risk Management, its Change Management!
Stoned is Stoned
With a flip of the calendar, on July 1, Oregon became the fourth state in which recreational marijuana use became legal. For many Oregon employers, this status change from illegal to legal wasn’t a big deal.
Medical marijuana is already legal in 24 states, including the Beaver State, and possessing less than an ounce was decriminalized in Oregon 40 years ago. This is just a new twist on an old story.
All it really means is you can’t go to jail (or be fined) for smoking pot recreationally. However, this “non-event,” has made risk managers ponder the ramifications of recreational use, especially for their employees who work in the manufacturing industry.
Manufacturers have strict policies to ensure a safe work environment. It goes without saying that people who are under the influence at work in a manufacturing or an industrial setting are far more likely to be injured on the job.
It is predicted that in 2016 – the third election cycle in which marijuana legalization measures will be on ballots across the country – as many as seven more states could allow recreational use of marijuana.
Being stoned at work should be treated no differently than being under the influence of alcohol or prescription medication. You certainly can’t show up drunk for work.
The employer is responsible for that employee as soon as they walk on to the job. Any drug use that impacts an employee’s ability to perform their job should be a genuine concern for the employer.
The difficulty for employers is the fact there is no scientific method to determine a marijuana intoxication level, unlike a blood-alcohol level for alcohol. So until there is definitive scientific evidence, employers are being advised to err on side of safety and forbid an employee to be under the influence of marijuana.
To do that the employer needs a crystal clear, zero-tolerance policy. Unless the employer has been living in a cave the past 50 years, they already have such a policy. But it should be updated to specifically address marijuana use, both on-the-job and recreationally, in which case it could affect the employee’s job performance.
It is predicted that in 2016 – the third election cycle in which marijuana legalization measures will be on ballots across the country – as many as seven more states could allow recreational use of marijuana. As each state approves the recreational use of marijuana, there looms in the background the knowledge that under federal law, its use remains illegal.
Whether that will eventually force the feds to take a stand remains to be seen. Right now the feds have just rolled over to let you scratch their belly.
But as each state joins the ranks of approving pot use recreationally, what was a minor irritant to the feds could grow too large for them to ignore.
The bottom line is that a stoned CPA might drop a number or two, but a stoned assembly line worker might drop a few fingers. It doesn’t matter if it’s pot, alcohol, or prescription medication. Smoke cannabis at work – or show up stoned – and you’ll be disciplined. It’s not about a worker’s rights; it’s about workplace safety.
Pathogens, Allergens and Globalization – Oh My!
In 2014, a particular brand of cumin was used by dozens of food manufacturers to produce everything from spice mixes, hummus and bread crumbs to seasoned beef, poultry and pork products.
Yet, unbeknownst to these manufacturers, a potentially deadly contaminant was lurking…
What followed was the largest allergy-related recall since the U.S. Food Allergen Labeling and Consumer Protection Act became law in 2006. Retailers pulled 600,000 pounds of meat off the market, as well as hundreds of other products. As of May 2015, reports of peanut contaminated cumin were still being posted by FDA.
Food manufacturing executives have long known that a product contamination event is a looming risk to their business. While pathogens remain a threat, the dramatic increase in food allergen recalls coupled with distant, global supply chains creates an even more unpredictable and perilous exposure.
Recently peanut, an allergen in cumin, has joined the increasing list of unlikely contaminants, taking its place among a growing list that includes melamine, mineral oil, Sudan red and others.
“I have seen bacterial contaminations that are more damaging to a company’s finances than if a fire burnt down the entire plant.”
— Nicky Alexandru, global head of Crisis Management at AIG
“An event such as the cumin contamination has a domino effect in the supply chain,” said Nicky Alexandru, global head of Crisis Management at AIG, which was the first company to provide contaminated product coverage almost 30 years ago. “With an ingredient like the cumin being used in hundreds of products, the third party damages add up quickly and may bankrupt the supplier. This leaves manufacturers with no ability to recoup their losses.”
“The result is that a single contaminated ingredient may cause damage on a global scale,” added Robert Nevin, vice president at Lexington Insurance Company, an AIG company.
Quality and food safety professionals are able to drive product safety in their own manufacturing operations utilizing processes like kill steps and foreign material detection. But such measures are ineffective against an unexpected contaminant. “Food and beverage manufacturers are constantly challenged to anticipate and foresee unlikely sources of potential contamination leading to product recall,” said Alexandru. “They understandably have more control over their own manufacturing environment but can’t always predict a distant supply chain failure.”
And while companies of various sizes are impacted by a contamination, small to medium size manufacturers are at particular risk. With less of a capital cushion, many of these companies could be forced out of business.
Historically, manufacturing executives were hindered in their risk mitigation efforts by a perceived inability to quantify the exposure. After all, one can’t manage what one can’t measure. But AIG has developed a new approach to calculate the monetary exposure for the individual analysis of the three major elements of a product contamination event: product recall and replacement, restoring a safe manufacturing environment and loss of market. With this more precise cost calculation in hand, risk managers and brokers can pursue more successful risk mitigation and management strategies.
Product Recall and Replacement
Whether the contamination is a microorganism or an allergen, the immediate steps are always the same. The affected products are identified, recalled and destroyed. New product has to be manufactured and shipped to fill the void created by the recall.
The recall and replacement element can be estimated using company data or models, such as NOVI. Most companies can estimate the maximum amount of product available in the stream of commerce at any point in time. NOVI, a free online tool provided by AIG, estimates the recall exposures associated with a contamination event.
Restore a Safe Manufacturing Environment
Once the recall is underway, concurrent resources are focused on removing the contamination from the manufacturing process, and restarting production.
“Unfortunately, this phase often results in shell-shocked managers,” said Nevin. “Most contingency planning focuses on the costs associated with the recall but fail to adequately plan for cleanup and downtime.”
“The losses associated with this phase can be similar to a fire or other property loss that causes the operation to shut down. The consequential financial loss is the same whether the plant is shut down due to a fire or a pathogen contamination.” added Alexandru. “And then you have to factor in the clean-up costs.”
Locating the source of pathogen contamination can make disinfecting a plant after a contamination event more difficult. A single microorganism living in a pipe or in a crevice can create an ongoing contamination.
“I have seen microbial contaminations that are more damaging to a company’s finances than if a fire burnt down the entire plant,” observed Alexandru.
Handling an allergen contamination can be more straightforward because it may be restricted to a single batch. That is, unless there is ingredient used across multiple batches and products that contains an unknown allergen, like peanut residual in cumin.
Supply chain investigation and testing associated with identifying a cross-contaminated ingredient is complicated, costly and time consuming. Again, the supplier can be rendered bankrupt leaving them unable to provide financial reimbursement to client manufacturers.
“Until companies recognize the true magnitude of the financial risk and account for each of three components of a contamination, they can’t effectively protect their balance sheet. Businesses can end up buying too little or no coverage at all, and before they know it, their business is gone.”
— Robert Nevin, vice president at Lexington Insurance, an AIG company
Loss of Market
While the manufacturer is focused on recall and cleanup, the world of commerce continues without them. Customers shift to new suppliers or brands, often resulting in permanent damage to the manufacturer’s market share.
For manufacturers providing private label products to large retailers or grocers, the loss of a single client can be catastrophic.
“Often the customer will deem continuing the relationship as too risky and will switch to another supplier, or redistribute the business to existing suppliers” said Alexandru. “The manufacturer simply cannot find a replacement client; after all, there are a limited number of national retailers.”
On the consumer front, buyers may decide to switch brands based on the negative publicity or simply shift allegiance to another product. Given the competitiveness of the food business, it’s very difficult and costly to get consumers to come back.
“It’s a sad fact that by the time a manufacturer completes a recall, cleans up the plant and gets the product back on the shelf, some people may be hesitant to buy it.” said Nevin.
A complicating factor not always planned for by small and mid-sized companies, is publicity.
The recent incident surrounding a serious ice cream contamination forced both regulatory agencies and the manufacturer to be aggressive in remedial actions. The details of this incident and other contamination events were swiftly and highly publicized. This can be as damaging as the contamination itself and may exacerbate any or all of the three elements discussed above.
Estimating the Financial Risk May Save Your Company
“In our experience, most companies retain product contamination losses within their own balance sheet.” Nevin said. “But in reality, they rarely do a thorough evaluation of the financial risk and sometimes the company simply cannot absorb the financial consequences of a contamination. Potential for loss is much greater when factoring in all three components of a contamination event.”
This brief video provides a concise overview of the three elements of the product contamination event and the NOVI tool and benefits:
“Until companies recognize the true magnitude of the financial risk and account for each of three components of a contamination, they can’t effectively protect their balance sheet,” he said. “Businesses can end up buying too little or no coverage at all, and before they know it, their business is gone.”
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Lexington Insurance. The editorial staff of Risk & Insurance had no role in its preparation.