Disruptive Technologies Present Opportunities for Risk Managers, Study Finds

PHILADELPHIA–Disruptive technologies are used more and more by businesses, but those organizations appear to be unprepared. What’s more, companies seem to lack understanding of the technologies and many are not conducting risk assessments, according to the 14th annual Excellence in Risk Management report, released at the RIMS conference here.

The study found an apparent lack of awareness among risk professionals of their company’s use of existing and emerging technologies, including the Internet of Things (IoT), telematics, sensors, smart buildings, and robotics and their associated risks. When presented with 13 common disruptive technologies, 24% of respondents said their organizations are not currently using or planning to use any of them. This is surprising, as other studies have found that more than 90% of companies are either using or evaluating IoT technology or wearable technologies and that companies in the United States invested $230 billion on IoT in 2016.

Another finding was that despite the impact disruptive technology can have on an organization’s business strategy, model, and risk profile, 60% of respondents said they do not conduct risk assessments around disruptive technologies.

“Today’s disruptive technologies will soon be — and in many cases already are — the norm for doing business,” said Brian Elowe, Marsh’s U.S. client executive leader and co-author of the report said in a statement. “Such lack of understanding and attention being paid to the risks is alarming. Organizations cannot fully realize the rewards of using today’s innovative technology if the risks are not fully understood and managed.” According to the study:

Organizations generally, and risk management professionals in particular, need to adopt a more proactive approach to educate themselves about disruptive technologies — what is already in use, what is on the horizon, and what are the risks and rewards. Forward-leaning executives are able to properly identify, assess, and diagnose disruptive technology risks and their impact on business models and strategies.

This lack of clarity presents opportunity for risk professionals. In fact, previous Excellence reports have indicated that C-suite executives and boards of directors want to know what risks loom ahead for their organizations and increasingly rely on risk professionals to provide that insight.

“As organizations adapt to innovative technologies, risk professionals have the opportunity to lead the way in developing risk management capabilities and bringing insights to bear on business strategy decisions,” said Carol Fox, vice president of strategic initiatives for RIMS and co-author of the report. “As a first step, risk professionals are advised to proactively educate themselves about disruptive technologies, including what is already in use at their organizations, what technologies may be on the horizon, and the respective risks and rewards of using such technology.”

One thing companies can do to manage risks associated with disruptive technologies is facilitate discussions through cross-functional committees—yet fewer companies, only 48%, said they have one, a drop from 52% last year and 62% five years ago.

Whether discussed in weekly, monthly, or quarterly organization-wide committee meetings, emerging risks — including disruptive technologies — need to be examined regularly to anticipate and manage the acceleration of business model changes. When risk is siloed, too often the tendency can be toward an insurance-focused approach to risk transfer rather than an enterprise approach that may lead to pursuing untapped opportunities.

The Excellence survey, Ready or Not, Disruption is Here, is based on more than 700 responses to an online survey and a series of focus groups with leading risk executives in January and February 2017.

Findings from the survey were released today at the RIMS 2017 Annual Conference & Exhibition. Copies of the survey are available on www.marsh.com<http://www.marsh.com> and www.rims.org<http://www.rims.org>.

Protecting Employees in the Face of International Risks

Increasing globalization and the growing world market presents employees with opportunities to travel and experience new countries and cultures. With travel comes risk, however. In the event of an unforeseen incident, it is an organization’s top priority to ensure its employees are safe and out of harm’s way.

By following proactive travel risk management strategies, employers can help ensure not only the safety of their employees abroad, but also the success of their businesses while avoiding major financial, legal and reputation costs. When developing travel policies, companies must consider the health, safety and security risks that their employees could encounter.

Security Risks
The frightening unknowns of crises such as sudden earthquakes or airport terror attacks can cause distress and chaos. It is the duty of a company’s human resources department to ensure employees are safe and secure, as being unprepared for such events could have dire consequences. For the best outcome, companies should proactively develop travel risk management plans before disaster strikes. Consider these guidelines for your company’s travel emergency plans:

  • Share information. Ensure employees are educated on how to avoid security risks in their destinations and share corresponding safety advice.
  • Develop a communication plan. Decide how employees should contact HR and/or other crisis response team members and vice versa in the event of an emergency.
  • Give employees information about who to contact if they’re in an emergency scenario. Create staffing patterns or third party resources that can accommodate after-hours calls.
  • Consider rearranging travel plans if there’s a high security risk. Use technologies, such as video conferencing, to keep business rolling as usual if employees need to conduct in-person meetings in destinations where it may be temporarily unsafe to travel.
  • Encourage employees to enroll in the Smart Traveler Enrollment Program (STEP). The app provides updated travel warnings and alerts via email. It can also help the nearest U.S. embassy or consulate locate individuals in the event of a disaster.

Health Risks
Recent disease outbreaks in several countries have caused concern among business and leisure travelers alike. If organizations have plans for employees to travel to areas experiencing widespread illness, consider exercising flexibility. If a disease epidemic is dominating news headlines, there is a good chance employees will be concerned about going to a destination that’s affected. In these cases, advise alternative options such as video calls or contacting local partners to help out. On the other hand, if employees elect to travel to the location, it is the employer’s job to ensure they have the knowledge and resources they need to have a safe and successful trip. To help protect the health of a traveling employee, HR professionals should:

  • Research and understand destination-specific health risks and share this information with employees. Education is essential to preventing life-threatening situations.
  • Ask employees to fill out personal medical information Forms. An employee should bring a copy on the trip and also leave copies with trusted friends or family. In the event of a medical emergency, the trustees will be able to obtain important personal medical details from the document, such as insurance coverage, current or past medical conditions and emergency contact information.
  • Remind employees to carry prescription paperwork. This can prevent issues at airport security and can be useful should a new or similar prescription be necessary locally.
  • Confirm that employees are covered by health insurance that is accepted overseas. This will help avoid monstrous fees later on.

Potential Costs for the Business
The costs of not following these strategies can be far-reaching. Your employees’ health and safety is always of utmost importance. However, there are also some continuity issues to consider.

At the most basic level, a health or safety issue that affects a traveling employee will likely cause a loss in productivity and, therefore, an impact to your organization’s bottom line. Companies could furthermore face cancellation fees, lost deposits, unused inventory or lost sales. Additionally, medical bills, medical evacuations and security evacuations can pose huge financial burdens on both employees and the company.

Furthermore, an organization that doesn’t adequately prepare for potential risks and therefore compromises an employee’s safety can lose loyalty quickly. If employees know their colleagues were put in risky situations, they will likely lose trust in their companies—which could cause engagement (and business results) to decline.

Adding to the strain of a disillusioned workforce, legal disputes could arise. An injured worker seeking remedies could bring an injury claim against their employer. The cost a company could face when it comes to duty of care disputes depends on the complexity of the case, the length of time and whether it reaches a full trial. Businesses should be prepared for the possibility of facing court cases by following key risk management strategies before being pulled through lengthy and costly litigation processes.

There are also reputation costs to consider. One of the most damaging scenarios may be that the company’s failure to fulfill their duty of care obligation leads to media headlines resulting in serious brand damage. In this case, the news can mar the company’s reputation, causing stakeholders to pull away and resulting in devastating loss in revenue.

Above all, employees are the backbone of an organization, and their safety and security should be the top priority for every business. Devising a sound risk management plan for travelling employees is crucial for ensuring the safety of employees as well as the longevity of your business.

8 Steps to Stronger Passwords Enterprise-Wide

Passwords remain one of the most critical security controls widely used to protect and secure company infrastructure and data. While the need for strong passwords has long been discussed, they continue to be the difference between a secure infrastructure and a potential cyber catastrophe.

Last year was extremely busy in cybercrime, with more than 3 billion credentials and passwords stolen and disclosed on the internet. That works out to a rate of 8.2 million credentials and passwords each day or 95 passwords every second.

Passwords have always been a good security control, but password strength and how they are processed make a major difference in how secure they really are. For example, it is critical to choose an easy password to remember, keep it long, and use some complexity and uniqueness. In addition, how the password is processed and stored in an encrypted format plays a major role in password security.

Here are eight easy steps to get in control and ensure passwords are strong and secure:

  1. Go with encryption: Passwords cannot be left in plain text ever and especially not in an Excel document. Always store passwords with encryption.
  2. Escape complexity: Focus on teaching your end users to use longer and more easily remembered passwords, like password phrases. Don’t let them get bogged down with having to remember special character requirements.
  3. Teach employees: Continued training is critical and is the most important step in implementing your policy. Make sure your users understand their role, prepare quarterly reviews, and make it fun with incentives.
  4. Size matters: The longer the password, the harder for a hacker to break. Make human passwords at least eight characters long and systems passwords 12-50 characters.
  5. Trust no one: Two-factor authentication is a must! No matter the size of your organization, there are two-factor options for you, like RADIUS tokens, DUO, or Google Authenticator.
  6. Omit duplicates: Use a unique password for each of your accounts. The same password should never be used more than once!
  7. No cheating: Remembering a long password can be difficult, but don’t allow password hints. These just make it easier for hackers to get in.
  8. Get a vault: Start using a trusted password manager to enforce strong password best practices. This way, users can always generate long and complex passwords, never have to remember all their passwords and, if you use a vault for your IT team, you can find one that automatically changes your admin passwords. When it comes to IT, automation is key to preventing a breach.

For more information on what’s expected in relation to security and passwords, check out Thycotic’s recent report on the current and future state of password security.

Most Organizations Deny Prevalence of Fraud

At a loss of more than $6 billion annually, experts have found fraud occurs in most organizations, but 80% of respondents to a recent survey by ACL believe their organization has “medium to no” exposure.

The 2017 Fraud Survey of more than 500 professionals in the United States and Canada found that “alternative facts” extend to the mentality among many businesses.

“As the phenomena of ‘fake news’ and ‘alternative facts’ permeate the U.S. landscape, it is interesting to see how disconnected many executives are from the true prevalence of fraud and corruption in their organizations,” said Dan Zitting, chief product officer at ACL, a risk management software provider. He added that companies increasingly discover they have had “numerous instances of potential fraud” that need to be investigated.

Almost two-thirds of respondents (63%) also said that most instances of fraud committed in their organizations are not detected, and more than 75% said that at least some of the fraud that is detected goes unreported.

Respondents noted that a company’s fraud experts can feel pressure from senior leaders, direct managers and even peers to suppress or alter their fraud findings. While the existence of internal pressure is no surprise to most, the survey confirmed that pressure from all sides makes fraud harder to overcome.

“As long as companies refuse to admit that fraud exists, the fraud will continue,” Zitting said. “As unscrupulous employees and vendors realize the company’s ignorance, the problem has great potential to grow.”

According to ACL:
2017 Fraud Survey Results