RISK FOR REWARD

Business is all about risk....good risk.

A good risk is one with a limited or understandable downside and a great upside. So HOW DO YOU LIMIT THE DOWNSIDE?

First you have to understand where you can lose, many companies I deal with do not realize the current exposures they have, let alone new exposures when undertaking a business action.

Sometimes business's get lucky and everything goes well. Sometimes it does not. Sometimes, most times, the results get buried and only the CFO knows too well the cost of a failed initiative, they hide money just for these occasions.

I have been at many presentations where a "great idea" is introduced and the "hockey stick" graph chart comes out showing how only profits and growth can come, but there is rarely an intelligent analysis of the risk and costs and how they will be mitigated.

Actually if most managers went a little further with their thought process and looked at these risks, they would also find ways to mitigate or eliminate the risk and still present their great idea. This idea will have a chance of getting past the CFO whispering to the President after the meeting as to why the idea has not been thought through well, and the idea dies.

You should not gamble with your career or company without doing a full job and conducting a risk analysis first, so you know the downside and how to limit it.

Ross McLean, Security Expert

Leadership and Successful BCP Planning

There is no more important issue to the successful implementation of a Business Continuity program then leadership.

There are two key factors.

First the CEO or leader of the organization MUST understand that it is his or her responsibility to see that the program gets done. They must support the appointed leader in the organization (who carries the water on the project), or the plan will fail or be ineffective. The CEO is the one who has the ability to see that ALL parts of the organization take part and fulfill their responsibilities. This is the reality of the nature of organizations. I cover this area right off the bat in my course. In fact I will tell you if you do not have top level support, don't even bother doing the program, it will fail or be ineffective.

The second key factor is the person or the "Champion" for leading the BCP team to do its work. This is the next most likely cause for failure, if this person does not get the instruction and support needed to do the job.

The foremost comment I recieve from customers who have taken on the job (or been given the job) of doing a corporate BCP plan is that they are "overwhelmed" by the enormity of the job. They don't know were to start, and most importantly they don't know when they are finished. It becomes a thankless task, doomed to second guessing if you do not have a model or a paradigm to follow. The format we use in our training is to lay out the format for a successful program so you know what you need to do, and what information you need to work with, and the steps the organization MUST take to protect itself. Go to rossmcleansecurity.com for more info on the model.

If you look at the failures in Katrina, that is where they started.

I'll spend the month of November discussing the issues of leadership in Business Continutiy Planning in this blog.

Fear of Change as Risk

There is no doubt about it, change and the rate of change that is underway, and that is coming is the Tsunami that is coming to North America.

Change to value chains, change to "labor", change in technologies, change in demographics, and the list goes on and on.

The problem is not just change, but the rate of the change, which requires an intelligent response from an organization. So the questions are;

does your organization understand the fundamentals of your current business? (do you?)

Go ask any 5 senior level or mid level people and ask them if they know what the major objectives of the company are for this coming year, ask them for the 3 greatest dangers to your company, and ask them if they have a plan to deal with them. (what would you say?)

If you get any answers, my bet is they will almost all be different and you will get many "deer in the headlights" looks from your subjects.

If you don't understand the terrain and the battle, you'll lose the war.

How would it be if you asked 5 senior people in your company and you got the same answer, the same battle plan? How would you like to be in that position? How would you feel about your chances of succeeding as a company then?

Companies will and are competing on their ability to accept, and implement intelligent change as a company in a rapid fashion. In order to do this, everyone must be on the same page. What score would you give your company out of 10?

Change is here and it is coming rapidly and in greater strength then many can imagine. Denial and ignorance are not good defenses, it could cost you your job, your company, and the future you are depending on. MAKE NO MISTAKE ABOUT IT, CHANGE IS ON THE WAY FOR YOU!

2006 is your year to wake everyone up and get your ducks in a row, and be prepared to respond quickly, where does your organization stand on knowing how to rapidly and intellegently implement change.....where do you stand as an individual?

If you would like more info. Drop me a line at;
ross.mclean@rossmcleansecurity.com I'll help you get prepared.

KATRINA REPORT - AN ABJECT FAILURE OF LEADERSHIP

When a crisis strikes - who do you want leading you?

The person you select to lead your Business Continuity Team should be a person who has dealt with crisis before, repeatedly in their life. Why?

Because once you dealt with them enough, you realize you want to avoid them at all costs, and what the intelligent leader does is start the next day making sure this problem and other similar ones will not bring such havoc and destruction to their lives and businesses.

If you think the only way to deal with a crisis is to respond to it after it happens, you will fail every time - guaranteed.

You must be proactive, have a plan, be prepared to execute the plan, and then deal with what happens when the plan goes off badly with further intelligent contingencies.

PROACTIVE VS REACTIVE

I find it interesting that the person in charge of Homeland Security has a background as a prosecutor and a judge. While these are honorable professions, I am hard pressed to find a background that is so far from what is needed in crisis planning and response. A prosecutor and a judge both have a habitual professional style of acting after the fact, that is what their job is. They wait for the crime the charges and all the facts to be brought to them before they make any judgement to act. Even then they act only on the facts, well after the fact if you will.

The head of homeland security even said, he waited after he got the first warning that the levee's had broken (even though that was over 12 hours after it had occurred), and he still did not act, he said he knows that often times the first reports are not correct in emergencies, so he did not act. WELL DUH!

In a crisis you have to act and act fast without 100% knowledge of all the facts. Ask any business leader.....it is rare they are 100% sure when they are making business decisions in the comfort of the boardroom, don't expect to have all the answers and info when disaster strikes, you have to act. The sooner and the more intelligent your response the greater your chance for success, and your opportunity to avoid disaster.

You need to have a proactive mindset to manage risks and deal with the response.

Selecting a Corporate Champion

Once a business has decided that business continuity & disaster recovery is an issue that needs to be addressed (as opposed to it being a back burner, or not even on the stove or radar screen issue) someone needs to placed in charge.

Companies that have worked to tackle Business Continutiy eventually end up creating a position and a department for Business Continuity, why, because they see that it is absoultely necessary to the GROWTH and survival of the company. (more about this in later posts). In the meantime though, someone needs to be charged with the responnsiblity.

The ideal candidate is a position ranging in responsiblity from a Senior Manager to Senior Director or equivalent.

From the CEO's perspective, it should be a person who is in succession planning for promotion, because the person leading the team will gain SIGNIFIGANT insight into how the overall operation works.

From the employee's perspective, I know of no other way to learn so much about how your company operates then by developing a BCP plan. As a candidate, you should also be looking for responsiblity to lead a team of people from across your company ranks, nothing will develop your skills better.

More information will follow on how to be an effective leader, which is the essence of a succesful BCP & DR program.

Ken Thomson - 1923 - 2006 A Titan Passes

Ken Thomson, a former close protection client of mine, and the ninth richest man in the world has passed away.

Never have I met a more humble and gracious person. There was not an ounce of pretention in the man. When I first met him I said "Hello Mr Thomson" as I stood outside his home, holding open the rear door to the limosine.

"Call me Ken" he said casually, then asked "is it all right if I just ride upfront with you?".

That's the way he was, he would ask me to stop so he could roll down the window and ask the kids in the neighborhood how they were doing and what was new. He knew their names and what they were up to.

He was and excellent steward of his companies, there was not a detail that would slip past him, but he never micromanaged or interfered with someone doing their job, but he did want people who knew their job working for him.

There are lots of stories I could tell - all of them good by the way. He will be missed.

I have a feeling he is on his way up to heaven, going past the pearly gates, finding a quiet side door, slipping in, and when they see him they will say, "welcome Mr Thomson" and he will say, "Just call me Ken."

Bird Flu - a Pandemic of Fear

"If it bleeds - it leads" has long been the driving force behind the media. Fear of what might happen, information, stories, and pictures contrived to make you more afraid then you need to be.

Government, companies, and people, are easily led to jump to knee jerk reactions to "percieved" problems and threats. What is needed though is a rational system for evaluating your threats, first the likely hood of it happening, second the amount of damage potentially to be caused, then third, the minimal precautions you should take weighed against "other" threats and the likely possibility of them happening.

Read and listen to the media reports and look at how often the word fear is used, the old line of fear being false evidence that appears real has never been truer. Look how many times the word "fact" is used as they describe the risk.

HERE ARE SOME FACTS REGARDING THE BIRD FLU PANDEMIC

Fact - there has been no "human to human" transfer of the virus - ever. This is a pre-requiste for a pandemic to break out anywhere among humans. The only people who have gotten sick and died from the disease, have been older and they work with birds and their excrement. So unless you do this, the risk is not great.

Fact - it could be a factor in your business if you provide products or services to companies that make their money from birds. If they get struck and lose their flock, they may not need your products or services, or they may not be able to pay you.

Fact - you should have a plan if your income depends on them. 33% of Tyson Foods revenues come from poultry, they have already seen some activity by the market on bets protecting investors from losses, possibly due to the flu. Their earnings call is coming up on Nov. 14th, will they share the risk with their shareholders?

Every company should develop at least a loose plan on how to deal with biological outbreaks now, so that the leaders in the company who make policy will have some idea of how to proceed.

Governments need to develop a realistic framework to deal with a generic biological outbreak, once a framework is in place (tested and working), you can tailor the response.

As Joe Friday used to say on Dragnet, " just the facts please."