Keeping Parades and Events Safe for Businesses and Employees


Holiday parades will be marching down many U.S. city streets during the next six weeks, with millions of revelers expected to attend. And while these are historically joyous occasions, safety is a top concern for businesses located near the festivities—especially considering the high-profile violence that has recently dominated headlines. Rezwan Ali, risk solutions group head of security at Falck Global Assistance, which advises companies about security, safety and travel risks, spoke about the challenges and best practices faced by businesses and employees located near parade routes.

Risk Management Monitor: How are companies responding to the rise in low-tech terrorism and violence?

Rezwan Ali: Companies have become more aware of the need for crisis management. Recent terror events in cities such as Paris, London, Las Vegas and New York have shown companies that duty of care is much more than just health and safety – it is knowing where your employees are traveling and aiding them if affected by terror or violent events. As companies become more globally oriented, their employees are required to travel more, which expands the company’s duty of care responsibility and creates a need for travel risk management. In recent years, there has been an increase in the demand for travel risk management, which originates in a company’s acknowledgement of providing duty of care services to travelling employees to mitigate the possible impact of attacks on the business, its reputation and employees.

RMM: What steps can businesses take to prevent disruption?

RA: The best way to mitigate disruption caused by terrorism is to be prepared at both the business and individual level. On a business level, companies should implement a crisis management process and a contingency plan. A crisis management process includes appointing a crisis management team and training the organization using various scenarios. The contingency plan provides guidelines on how to maintain business as usual when a crisis occurs and works in parallel with the crisis management process. On an individual level, training can provide employees with tools to cope with stressful situations and alleviate the impact of an incident. When employees know how to manage demanding situations, the effect on the company will also be minimized.

RMM: How can businesses located near a parade route or major event protect their employees?

RA: All businesses should have emergency and evacuation plans, which can be applied in the event of emergency. These plans should cover procedures for evacuating the office, safe areas and roles and responsibilities. Businesses located in areas identified as potential targets for terror attacks should incorporate specific emergency measures related to terrorism into their plans. They should also ensure that all employees know and understand that the emergency plans exist. These plans could include guidelines for what to do should a terror attack take place outside the office, as well how to react in the event of an active shooter. It is crucial that these plans and procedures are trained, exercised and tested.

Having an office in an area prone to various incidents requires the company to be informed of relevant developments. Sound intelligence can alert the company of an event, enabling quick initiation of applicable plans. Many companies use their network to provide intelligence or rely on local media to provide alerts. Regardless of the information, it is important to use trustworthy sources to ensure validity. The company can choose to develop a trigger system that determines whether the alert should activate any emergency procedures.

RMM: How likely is it that someone will be a victim of terrorism or violence during a large event?

RA: Although terrorism has severe consequences, the likelihood of being a victim of terror is low when compared to other risks such as traffic accidents and illness. The impact of a traffic accident on the individual can still be high, while the impact on the business will be minimal, in most cases. What makes terror so dangerous is not likelihood, but the fear of it happening. Terror literally means “fear,” and it is the uncertainty and severity of terror that is pivotal for how we perceive it. Employees may express a somewhat irrational fear that must be addressed and taken seriously by the company, as it affects the employee and his/her work.

Large Venues Reviewing Security Measures

Venues that attract crowds, such as large sports events and concerts are reviewing their security measures, both inside and out, to prevent an attack such as the suicide bombing after an Ariana Grande concert in Manchester, England, that killed at least 22 people.

Most venues have strict rules about bags, backpacks and coolers. Some check items thoroughly before allowing them inside an arena and others do not permit them at all. Venues also employ security detail to check those attending events as well as plainclothes detail to monitor the crowd. In the Unites States, the Department of Homeland Security warned that the U.S. public may experience increased security at public events.

Hong Kong’s AsiaWorld Expo, where Ariana Grande is scheduled to hold a concert in September, said it plans to improve security at all concerts and events. Besides baggage inspection, there will also be metal detectors and search dogs, it said in a statement.

According to the South China Morning Post, the Hong Kong venue said it will begin using metal detectors to screen for potential threats, in addition to its usual backpack and baggage inspections. It also said it would consider using search dogs for any suspicious items or requiring visitors to wear security straps to track them while in the venue.

One mega event, the annual Indianapolis 500 over Memorial Day weekend, took to heart the task of keeping attendees safe. Adding to security planning measures for more than 300,000 attendees was the safety of Vice President Mike Pence, who was expected to attend—and arrived on Sunday morning.

Indy 500 crowd, May 26, 2017. Photo by Dana Garrett

Reuters reported that the Indy 500 has a Homeland Security SEAR 2 (Special Event Assessment Rating) designation, which means federal assets can be brought in to enhance security efforts during the event.

The Indy 500 is regarded as the world’s largest single day sporting event. Only venues on par with the Super Bowl and the Democratic and Republican conventions are given higher security ratings. Local, state and federal agencies contributed to security efforts at the Indy 500, including sniffer dogs, license plate recognition equipment and multiple security checkpoints to enforce restrictions.

There are those who believe, however, that even with enhanced measures, terrorist acts cannot be completely anticipated or stopped.

“Whatever is done—and in this case it’s British intelligence which is considered among the best in the world—it won’t prevent such incidents happening,” Jean-Charles Brisard, president of the Centre for the Analysis of Terrorism told Reuters. “You can bring back the perimeter, add security gates and as many controls as you want, but that will not change the fact that a determined individual will carry out his act if he is not caught before.”

In a Changing World, Questions For the CRO

Before the financial crisis in 2008-2009, many businesses didn’t think of risk as something to be proactively managed. After the crisis, however, that paradigm shifted. Companies began perceiving risk management as a way to protect both their reputations and their stakeholders.

Today, risk management is not just recommended, it is considered crucial to successful operations and is required by federal and state law. The SEC’s Proxy Disclosure Enhancements, enacted in 2010, mandate that organizations provide information regarding board leadership structure and the company’s risk management practices. Company leadership is required to have a direct role in risk oversight, and any risk management ineffectiveness must be disclosed.

The CRO’s role

Volatility in the current business environment—a confluence of factors including transfers of power, the world economy and individual markets—is nothing new. Political transitions have always been accompanied by new agendas and shifting regulations, economies have always experienced bull and bear markets, and the evolution of technology constantly changes our processes.

Even so, recent events like Brexit, the uncertainty of a new administration’s regulatory initiatives, and thousands of annual data breaches have contributed to an unprecedented atmosphere of fear and doubt. To navigate this environment, the chief risk officer needs to adopt a proactive risk management approach. Enterprise-wide risk assessments grant the visibility and insight needed to present an accurate picture of the company’s greatest risks. This visibility is what the board needs to safely recognize opportunity for innovation and expansion into new markets.

To grow a business safely—by innovating and adding to products/services and expanding into new markets—risk professionals should not focus on identifying risk by individual country. This approach naturally leads to a prioritization of “large-dollar” countries, which aren’t necessarily correlated with greater risk. Countries that contribute a small percentage of overall revenue can still cause major, systemic risk management failures and scandals.

A better approach is to look at risk across certain regions; how might expanding the business into Europe, for example, create new challenges for senior management? Are there sufficient controls in place to mitigate the risks that have been identified?

When regional risks are aggregated to create a holistic picture, it becomes possible for the board to make sure expansion efforts are aligned with strategic goals.

Three processes that require ERM

Risk management is an objective process, and best practices, such as pushing risk assessments down to front-line process owners who are closest to operational risk, should be adhered to regardless of the current state of the international business arena.

While today’s political climate has generated a significant amount of media strife, it’s important not to let emotion influence decision-making. By providing the host organization with a standardized framework and centralized data location, enterprise risk management enables managers to apply the same basic approach across departments and levels.

This is particularly important when an organization expands internationally, which involves compliance with new sets of regulations and staying competitive. Performing due diligence on an ad hoc basis is neither effective nor sustainable. Instead, the process should follow the same best-practice process as domestic risk management efforts:

  1. Identify and assess. Make risk assessments a standard part of every budget, project or initiative. This involves front-line risk assessments from subject matter experts, revealing key risks and processes/departments likely to be affected by those risks. For example, financial scrutiny is no longer a concern just for banks. Increased attempts to fight terrorism mean transactions of all kinds are becoming subject to more review. Anti-bribery and anti-corruption processes estimate and quantify both vulnerability and liability.
  2. Mitigate key risks. Connect mitigation activities to the resources they depend on and the processes they’re associated with. ERM creates transparency into this information, eliminating inefficiency associated with updating/tracking risks managed by another department. Control evaluation is the most expensive part of operations. Use risk management to prioritize this work and reduce expenses and liability.
  3. Monitor the effectiveness of controls with tests, metrics, and incident collection for risks and controls alike. This ensures performance standards are maintained as operations and the business environment evolve. Evidence of an effective control environment prevents penalties and lawsuits for negligence. The bar for negligence is getting lower; technology is pulling the curtain back not only internally but (through social media and news) to the public as well.

Lastly, the CRO role is increasingly accountable for failures in managing risk along with other senior leaders and boards—look no further than Wells Fargo.

Total Cost of Risk Drops for Third Straight Year, RIMS Finds

Despite the challenges of a slowed economy in an election year, a shifting risk landscape as a result of technological advances, and a slow to negative growth rate in some sectors, 2016 saw the total cost of risk (TCOR) decline for the third consecutive year, according to the 2017 RIMS Benchmark Survey.

Even in the face of such uncertainties, the TCOR per $1,000 of revenue continued to drop, ending at $10.07 in 2016. The main drivers were declines in all lines excluding fidelity, surety and crime costs, according to the report. TCOR is defined in the survey as the cost of insurance, plus the costs of the losses retained and the administrative costs of the risk management department.

The survey encompasses industry data from 759 organizations and contains policy-level information from 10 coverage groups, subdivided into 90 lines of business.

Uncertainty around policies in the new presidential administration will continue to dominate in 2017, as the nation’s trade policy, regulatory reform and tax system could see changes, RIMS reported. The new political regime is also expected to reduce regulatory oversight at the state, federal and international levels.

Key findings from this year’s RIMS Benchmark Survey include:

  • Technological advances have caused a seismic shift in the risk landscape, creating new types of claims and forcing insurers to consider new products and solutions for customers.
  • Insurers ended 2016 with average capital and surplus at the highest level in 10 years. However, excess capacity is undermining profitability, as seen by falling net income and return on average equity.
  • The personal insurance space is in the midst of a consumer-centric revolution, offering customers new transaction platforms, better metrics and more flexible pricing and coverage options. Commercial insurance is expected to adopt a similar focus, transforming the way business is transacted.
  • Predicted rate increases for cyber, E&O and workers compensation failed to materialize across the board. Projections for 2017 are more moderate, with property and most liability lines flat to down 10%.
  • Emerging trends in the 2017 risk landscape include the tech revolution, security issues, natural catastrophes and political upheaval.

“The RIMS Benchmark Survey chronicles the evolution of corporate risk management costs over time. This year’s edition highlights how risk managers have effectively managed costs in a time of evolving risks and demands, enabling them to do more with less,” said Jim Blinn, executive vice president of client solutions at Advisen.