Column: Risk Management

What Comes After Z?

By: | August 3, 2016 • 3 min read
Joanna Makomaski is a specialist in innovative enterprise risk management methods and implementation techniques. She can be reached at [email protected]

I was at a dinner a few months ago with colleagues. At the table was a group of risk professionals ages 40 to 60 years young. We all had worked within organizations  identifying risks that could impact strategy.


The dinner conversation turned to the future of our transportation systems. We tried to be prophetic about risks that faced the car industry, trains and taxi systems, Uber, and ride shares like Zip car or Auto-share.

One thing I found thought-provoking. We seemed to speak of risks mostly from our generation’s standpoint. We spoke of risks as we could imagine them.

So getting the key to a Gen Z’s psyche is vital. How do they see the world? How do they access the world? What is important to them? How do they perceive risk?

When the car buffs at the table digressed and shared their dreams of owning a new Maserati or a Tesla, certain assumptive statements caught my attention such as: “Every kid would love to own a Maserati? Why wouldn’t they?”

I challenged the group. Maybe the biggest risk is that we are not paying enough attention? Maybe we don’t understand or accept what the next generation of consumers want or need when it comes to transportation? Maybe our risk registers as a result don’t reflect future risks sufficiently?

Let’s think of a 15-year-old and all of their tween and teen friends. Meet Generation Z.

In a few short years, they shall be the retail disruptors of tomorrow.  Reports indicate that by 2020, this generation will translate to $3.2 trillion in purchasing power.

So getting the key to a Gen Z’s psyche is vital. How do they see the world? How do they access the world? What is important to them? How do they perceive risk?

A typical Gen Z was born around 2001. They were born with a smart phone in their hand but also their first memories were of economic doom, recessions, acts of terror and war shaped by events like 9/11 and Columbine.

Born witness to all this, Gen Zs are growing up fast and developing sensitivities beyond their years and with a strong sense of social justice and philanthropy.

Many have drawn parallels between Gen Zs and the “silent generation,” also known as Gen Zs’ grandma and grandpa, who also lived through the aftermath of the Great Depression. These kids are developing life skills, and forming personalities different than their older “millennial-Gen Y” siblings who seem to be struggling to leave home and secure jobs.

Studies show that Gen Zs are more financially conscientious. They are also more risk-averse. They worry about the economy, privacy, cyber crime, job security and terrorism.


They think about cars differently too. For many, a car is no longer a status symbol but more of a symbol of greedy capitalism. Gen Zs live in a world where things move quickly. They are much less likely to attach themselves to a long-term obligation like a car that will only become obsolete. In fact, they are more likely to pool friends together to share a car or use public transport. For those who do end up buying a car, they would most likely choose a car for its environmental friendliness, modesty, affordability, practicality and safety. Sounds a lot like a car grandparents would buy, doesn’t it?

I guess it makes sense that if we are to talk of future strategic risks we need to hear more from the future. We need to stop guessing.

Invite our Gen Zs to our risk sessions. Invite them to our dinners. Have them teach us “baby boomers” and Gen Xers. &

Share this article:

Risk Insider: Paula Vene Smith

The Risk Register: Dead or Alive?

By: | July 27, 2016 • 2 min read
Paula Vene Smith directs the Purposeful Risk Engagement Project (PREP) and is a professor at Grinnell College. Paula consults on risk in higher education, and has written Engaging Risk: A Guide for College Leaders. She can be reached at [email protected]

If your organization practices Enterprise Risk Management, senior leaders probably have endorsed a list of top risks that demand action.


Once ERM is in place, the list undergoes review — maybe annually. After a few cycles it’s time to ask: Are we practicing risk management or list management? A risk register can either drive change, or persist as a lifeless spreadsheet.

Use these questions to test the vitality of your institutional list:

How long is your register, and how often does it change?

In my research on higher education risk management, I spoke with leaders at small to mid-sized colleges. Institutions with lengthy risk registers (50-80 items) didn’t see much change from year to year.

Their annual review consists of “checking in” to make sure people are working on their risks. Organizations with shorter lists (5-15 items) saw higher turnover. They acknowledge progress, shift gears and set new goals.

Have entire areas been overlooked?

For the initial risk assessment at Grinnell College, we brought in consultants. They interviewed senior leaders and staff to identify risks.

The purpose of a risk register is to drive action. A short, dynamic list serves this purpose better than a compendium that makes people feel they’re chipping away at something so massive that no amount of effort can make a difference.

Remarkably, the “top seven” list they produced did not include risks related to student life. Later, it emerged that the person then serving as vice president of student affairs had such a confident attitude, he convinced the consultants there were no risks in his area that he couldn’t handle.

Reviewing the register internally, we agreed that student risks had to be recognized.

Does one item encompass several distinct risks?

Risk identification often starts with concerns about a broad area. When, for example, we resolved to add something about students, the initial risk description was wordy and cumbersome. By the next cycle, we recognized multiple risks: substance abuse, mental health services, Title IX processes and improved student retention. Separating these items helped us develop mitigation strategies.

What happens to a risk that drops off the list?

Some of the risk leaders I interviewed found no need to drop risks from the register. They pointed out that no significant risk is ever completely mitigated. Nonetheless, we refresh our “top 10” periodically. Once significant mitigation is in place, the item can move off — but we’ll continue to monitor progress. If the risk remains well managed, we check in more briefly and less frequently.

Can risks come off the list too soon?

In the first year we worked hard on developing a policy to protect minors. It felt great to remove that item from the register. But we still needed to conduct training, step up background checks, and assist program directors.


Should we have kept “minors on campus” on the register for another year? The time invested was not so different from that spent on top-priority items. Still, no harm was done by renaming this work as “monitoring.”

The purpose of a risk register is to drive action. A short, dynamic list serves this purpose better than a compendium that makes people feel they’re chipping away at something so massive that no amount of effort can make a difference.

Share this article:

Sponsored: Liberty International Underwriters

Cyber: The Overlooked Environmental Threat

Environmental businesses often don't see themselves as a target, but their operations are just as vulnerable to the threat of an industrial cyber attack.
By: | August 3, 2016 • 6 min read

“Cyber breach” conjures fears of lost or ransomed data, denial of service, leaked corporate secrets and phishing scams.

But in a world where so many physical operations are automated and controlled by digital technologies, the consequences of cyber attacks extend far beyond the digital realm to include property damage, bodily injury, and even environmental pollution.

Industrial companies that deal with hazardous materials — like power plants, refineries, factories, water treatment facilities or pipelines — are heavily dependent on automated technology to maximize their efficiency. Other sectors use technology to control HVAC systems, power and utilities, placing their properties at risk as well.

Cyber risks like theft of personally identifiable data have been highly publicized in recent years, but physical risks like pollution sparked by a cyber breach may not be as obvious.

“It’s significant to lose 100,000 customers’ Social Security numbers,” said William Bell, Senior Vice President, Environmental, Liberty International Underwriters, “but can you imagine if a waste treatment facility’s operations get hacked, gates open, and thousands of tons of raw sewage go flowing down a local river?”

In many industrial complexes, a network of sensors gathers and monitors data around machinery efficiency and the flow of the materials being processed. They send that information to computer terminals that interpret the data into commands for the hardware elements like motors, pumps and valves.

This automation technology can control, for example, the flow of pipelines, the level of water or waste held in a reservoir, or the gates that hold in and control the release of vast quantities of sewage and other process materials. Hackers who want to cause catastrophe could hijack that system and unleash damaging pollutants.

And it’s already happened.

In 2000, a hacker caused 800,000 liters of untreated sewage to flood the waterways of Maroochy Shire, Australia. In 2009, an IT contractor, disgruntled because he was not hired full-time, disabled leak detection alarm systems on three off-shore oil rigs near Long Beach, Calif.

Just last year, cyber attackers infiltrated the network of a German steel mill through a phishing scam, eventually hacking into the production control system and manipulating a blast furnace so it could not be shut down. The incident led to significant property damage.

According to a leading industrial security expert and executive director of the International Society of Automation, “Today’s operational technologies—such as sensors, SCADA systems, software and other controls that drive modern industrial processes—are vulnerable to cyber attack. The risk of serious damage or compromise to power and chemical plants, oil and gas facilities, chemical and water installations and other vital critical infrastructure assets is real.”

“The hacks could come from anywhere: a teenager looking for entertainment, a disgruntled worker, or more sophisticated criminals or terrorists,” Bell said. “There are certainly groups out there with political and ideological motivations to wreak that kind of havoc.”

LIU_SponsoredContent“We are working to bring the cyber component of environmental risk to the forefront. Cyber security is not just an IT issue. Industry executives need to be aware of the real-world risks and danger associated with an industrial cyber attack as well as the critical differences between cyber security and operational technology security.”

— William Bell, Senior Vice President, Environmental, Liberty International Underwriters

The cleanup cost of an environmental disaster can climb into the hundreds of millions, and even if a cyber breach triggered the event, a cyber policy alone will not cover the physical and environmental damage it caused.

The risk is even more pointed now, as resource conservation becomes increasingly important. Weather related catastrophe modeling is changing as both flooding and drought become more severe and frequent in different regions of the U.S. Pollution of major waterways and watersheds could have severe consequences if it affects drinking water sources, agriculture and other industrial applications that depend on this resource.

Managing the Risk

LIU_SponsoredContentUnfortunately, major industrial corporations sometimes address their environmental exposure with some hubris. They trust in their engineers to remove the risk by designing airtight systems, to make a disaster next to impossible. The prospect of buying environmental insurance, then, would be superfluous, an expression of doubt in their science-backed systems.

Despite the strongest risk management efforts, though, no disaster is 100 percent avoidable.

“We are working to bring the cyber component of environmental risk to the forefront,” Bell said. “Cyber security is not just an IT issue. Industry executives need to be aware of the real-world risks and danger associated with an industrial cyber attack as well as the critical differences between cyber security and operational technology security.”

The focus on network security and data protection has distracted industry leaders from strengthening operational technology security. Energy, manufacturing and other industrial sectors lack best practice standards when it comes to securing their automated processes.

After the Homeland Security Act of 2002, the Department of Homeland Security began comprehensive assessments of critical infrastructure’s cyber vulnerability, working with owners and operators to develop solutions. It also offers informational guides for private companies to do the same. The National Institute of Standards and Technology also continues work on its cyber security framework for critical infrastructure. Although this helps to establish some best practices, it does not completely mitigate the risk.

Many businesses don’t see themselves as a target, but they need to look beyond their own operations and property lines. They could be an attractive target due to their proximity to densely populated areas or resources such as waterways and highways, or nationally or historically significant areas. The goal of a cyber terrorist is not always to harm the target itself, but the collateral damage.

The Role of Insurance

LIU_SponsoredContent“Environmental liability is still by and large viewed as a discretionary purchase,” Bell said, “but the threat of a cyber attack that can manipulate those systems and ultimately lead to a pollution incident is added incentive to buy environmental coverage.”

Liberty International Underwriters’ environmental coverage could respond to many pollution conditions set off by a cyber breach event.

“Property damage, bodily injury and cleanup of any pollution at or emanating from a covered property would likely be taken care of,” Bell said. “The risk is not so much the cyber exposure but the consequence of the attack. The resulting claims and degradation to the environment could be severe, especially if the insured was a target chosen because of their unique position to have a large effect on the local population and environment.”

LIU also offers dedicated Cyber Liability insurance solutions designed to manage and mitigate the cost of responding to a cyber attack and any resultant loss of data and associated liability. Coverage includes proactive data breach response services designed to help organizations comply with regulatory requirements and prevent data breaches.

LIU’s loss control managers are also on hand to conduct assessments of insureds’ properties and facilities to examine potential environmental impacts. They can educate brokers on the importance of enhancing cyber security to prevent an environmental accident in the first place.

“People are relying more and more on their systems, automaton is increasing, and the risk is growing,” Bell said. “We’re all focused on protecting data, but the consequences of a cyber breach can be much farther reaching than data alone.”

To learn more about Liberty International Underwriters’ environmental coverages and services, visit

Liberty International Underwriters is the marketing name for the broker-distributed specialty lines business operations of Liberty Mutual Insurance. Certain coverage may be provided by a surplus lines insurer. Surplus lines insurers do not generally participate in state guaranty funds and insureds are therefore not protected by such funds. This literature is a summary only and does not include all terms, conditions, or exclusions of the coverage described. Please refer to the actual policy issued for complete details of coverage and exclusions.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Liberty International Underwriters. The editorial staff of Risk & Insurance had no role in its preparation.


LIU is part of the Global Specialty Division of Liberty Mutual Insurance.
Share this article: