The RIMS Conference 2023, one of the most anticipated events in the risk management industry, brought together professionals from around the world. This year’s conference witnessed a strong return of attendees, fostering insightful conversations on the influence of technology and AI, the hardening market in some sectors, promising lead generation, and the topic of reevaluating values at risk. As risk managers grapple with the complexities of today’s economy, the conference shed light on innovative approaches to asset valuation, business interruption coverage, and risk assessment. In this blog, we will delve into five key takeaways from RIMS 2023.

1. Attendance at RIMS was Back Full Force

The RIMS Conference 2023 saw a remarkable resurgence in attendance, with professionals from diverse industries coming together to exchange knowledge and best practices. The strong turnout highlighted the industry’s commitment to continuous learning, networking, and staying updated on emerging trends in risk management. This renewed enthusiasm served as a testament to the importance of conferences like RIMS in fostering professional growth and collaboration within the field.

2. Conversations Influenced by Technology and AI

Technology and artificial intelligence (AI) took center stage at the conference, captivating attendees with their potential impact on the risk management landscape. Participants engaged in discussions on leveraging advanced analytics, machine learning algorithms, and data-driven insights to make more informed risk management decisions. The integration of technology and AI was identified as a crucial enabler for identifying emerging risks, enhancing risk assessment processes, and developing effective risk mitigation strategies.

3. Market Hardening and Cost Pressures

The prevailing market conditions, marked by increasing inflation and supply chain disruptions, led to a hardening of the insurance market in some sectors. This hardening brought forth new challenges for risk managers, necessitating a comprehensive evaluation of their risk transfer strategies. With rising costs and limited coverage options, risk managers explored innovative solutions to mitigate their organizations’ exposure, while ensuring optimal protection against potential losses. Adaptability and agility emerged as critical attributes in navigating the evolving market landscape.

4. Networking and Unique Challenges

The conference presented valuable networking opportunities, with risk managers from prominent organizations seeking assistance in asset valuation and business interruption coverage. The complexities of today’s economy have compounded the challenges faced by risk managers in assessing their true exposures. Our conversations at the conference emphasized the need for specialized services such as physical assessments, business interruption studies, drone imagery for risk assessments, and cyber risk evaluations to help organizations better understand, manage and mitigate their risks.

5. Revamping Risk Management Strategies for Values at Risk

The concept of values at risk emerged as a hot topic of discussion at the conference. Risk managers recognized the need to rethink traditional approaches to valuing physical assets, particularly large-scale industrial equipment that is difficult to source. Furthermore, the assessment of business interruption values to protect against lost profits requires a fresh perspective in light of evolving market dynamics. The conference urged risk managers to revamp their risk management strategies, embracing innovative methodologies to adapt to the current environment effectively.

The RIMS Conference 2023 served as a hub for risk management professionals to share insights, discuss industry trends, and explore solutions to pressing challenges. Attendees returned to their organizations armed with a wealth of knowledge on harnessing technology and AI, navigating a hardening market, generating promising leads, and reevaluating values at risk. As the risk management landscape continues to evolve, it is imperative for professionals to remain proactive, adaptable, and forward-thinking in their approaches. The RIMS Conference proved once again to be an indispensable platform for industry leaders.

Business Continuity Plans (BCPs) are funny things.

At their most basic, BCPs are the real-world response to the old “Hope for the best, Plan for the worst” adage.  It’s honest recognition that being stuck between a rock and hard place is better with a hammer, albeit with no guarantee that the hammer is big or small enough to be helpful.

Nonetheless, a well-conceived BCP provides peace of mind, like insurance does, with the added satisfaction that only authorship (or ownership?) brings.  The rub, of course, is that every BCP is, at the end of the day, still just a plan.  As boxer, actor, felon, playwright and corporate strategist ’Iron‘ Mike Tyson once famously said, “Everyone has a plan until they get punched in the mouth.”

Indeed.  Because sometimes pipes break in the 2^nd floor ceiling of your office and leak antifreeze everywhere.  And because, other times, there’s COVID-19.

The benefit of having a BCP plan in place to manage either situation is that, well, there is at least a plan.  And despite what Kid Dynamite says, the real truth is that any company with a plan retains, at the very least, a fighting chance to get back up after they’ve been hit.

For Lowers Risk Group, like many others, COVID hit our industry, our business – our people.  We were fortunate, though: our Business Continuity Plan was 5 years in the making.  It didn’t matter, until it did.

Back in 2015, CTO David Lowers, Chief Security Officer Joe Labrozzi and Director of IT and Security Chris Sosnoski recognized the need for our growing staff to have partially, if not fully, remote capabilities.  What was initially driven by space concerns evolved with the access to and the ability of new technology to support fully secure, remote work that reduced cost, increased efficiency and enabled greater flexibility that could support new business opportunities within Lowers Risk Group.  With this foundation in place, Lowers, Sosnoski and Labrozzi were able to take the organization’s global footprint of over 550 people (spread over 3 continents) to fully remote in less than 2 weeks with zero business interruption when COVID hit.

And though Facilities might disagree, being fully remote due to COVID made the impact of that leaky pipe one less headache to manage when stress levels are already elevated.

We asked Labrozzi and Sosnoski to tell #OurStory of transition to a fully remote work environment.  We asked them what made it possible and to share a few insights that could help other organizations with the creation and implementation of their own BCPs to author their future resilience.  Below is a transcript of our conversation.

On behalf of the entire organization – thank you both for your efforts and keeping the organization on its feet as COVID hit.  How did your teams manage this transition?

Sosnoski
Our ability to go remote during COVID was strategic and began 5 years go.  Wholesale Screening Solutions, our largest division at Lowers Risk Group, was beginning to test our space limitations.  At that time, the VA HQ had about 400 people on-site.  Additionally, the Wholesale team recognized a need that they had to hire in different areas, not just in VA HQ.  We were tasked with how to support that, and it was clear we had to embrace the cloud.  Buy-in from David and other executive leadership there was the first step.

Labrozzi
What really drove the process was what was happening in Wholesale’s Georgia office, our first off-site campus.  We needed a base to get our people into the courts to do research.  That organically began to create resiliency in our operations – rather than rent out trailers, for example, in the event of something happening, our second location offered redundancies as technology matured.  As we gained more experience managing this remote location in GA from our VA HQ, we saw it was possible to have and manage a remote workforce while still doing secure work.  We then built a series of processes around this concept that laid the foundation for more remote work, and we’ve been working at that ever since.

Sosnoski
Right before COVID hit, for example, we launched phase 1 a Unified Communications as a Service (UCaaS) initiative with plans to roll-out Phases 2 and 3 in the coming months.  What would have been a much more measured roll-out was accelerated by COVID.  But, had we not been building towards that – not just with the UCaaS launch, but all the work leading up to the launch – it would not have been as easy or seamless.  However, we had our BCP in place and were able to activate it,.  Our teams stepped up and, again, the full support of leadership helped make it happen.

What were the steps you were taking to build that initial foundation over 5 years?

Sosnoski
The goal was always to keep the working experience as secure and as available as possible, so it was about taking small bites at the apple.  Exploring, testing, and implementing remote training, for example.  Cloud-based email.  Our UCaaS environment.  We were able to leverage cloud resources like Microsoft, Adobe, Salesforce, AWS and Zscaler to achieve this.

The complicating factor was the cost associated with it – we had to be willing and able to spend monthly on subscription services.  For a while, that was a barrier, but we continued to make the business case while moving from a hybrid environment to a cloud environment.  Transitioning the phone system to UCaaS, for example, was a two-and-a-half-year effort to make happen and now our teams are loving the flexibility it offers.  Our teams can do remote assessments and maintain contact with each other and clients easily.

How did you each manage the workload during the COVID transition to remote work?

Labrozzi
Teamwork.  At VA HQ, Chris and I have sat next to each other for years, so we have a great working relationship – that’s part of the culture at LRG, which is probably also a reason the transition was smooth.  But it’s about the quality of who you work with.  Chris’ IT team knows what needs to get done – they’re reliable and fast.  I focused on the human capital element, making sure that we were dealing effectively with any productivity concerns, making sure teams were staying connected.  We all operate from a leadership mindset and depend on each other to play our parts.

Sosnoski
The real risk in remote work is not technology, it’s management process.  My team trusts each other to get things done.  When COVID hit, we found a useful strategy was to use quick, daily stand-up meetings.  For the most part, these types of meetings continue in some capacity across all departments; I know upper management remains committed to finding one-on-one time for their direct reports.  Process is super important in all this, but equally so is everyone’s ability to do their job.

Any key takeaways to offer other organizations from your experience?

Sosnoski – I think there’s really three that worked for us:

• We started planning early and had already explored the risk environment, developed the processes that would provide us a path of least resistance to continuity and had leadership buy-in.
• We identified the right digital tools and had assessed, budgeted for and tested them as part of the plan strategically; having to do this during COVID would have been very difficult.
• We were all aligned on the work that had to be done to achieve the vision; for us that was finding a secure, scalable and available environment to perform our risk mitigation work.

Lowers Risk Group provides comprehensive enterprise risk management solutions to organizations operating in high-risk, highly regulated environments and organizations that value risk mitigation.  Our human capital and specialized industry enterprise risk management solutions protect people, brands, and profits from avoidable loss and harm.  With Lowers Risk Group you can expect a strategic, focused approach to risk assessment, compliance, and mitigation to help drive your organization forward with confidence.  Contact us.

Emerging markets tend to fall into that riskiest of strategic planning quadrants: Unknown-Unknown territory. They bring with them both tremendous opportunity and enormous risk.

The cannabis industry is one such market.

While medicinal marijuana has been legal in Canada since 2001, and in select states in the U.S. since 1996, only recently has cannabis transitioned into a full-blown commercial enterprise in both countries.

We spoke with Joe Scarlato, President of Emerging Markets & Technology R&D at Lowers Risk Group, to understand just what risks the cannabis industry poses.

Layer by Layer, the Risks Add Up

Understanding risk is an important first step for any business to take to mitigate the possibility of loss. Risks in the cannabis industry run the gamut from catastrophic loss, business interruption, physical security, and cyber losses to a changing regulatory environment.

Cannabis facilities generally fall into one of three different business models which provide a rough framework for understanding their associated risks.

Grow Only Facilities

Facilities that focus on growing plants or producing their distillates have the most clear-cut risk: the catastrophic loss of their plants. Without plants, the business has no raw materials with which to manufacture its products. It can’t sell the cannabis or its distillates (i.e., concentrates such as raw hemp, flour, CBD oil, THC oil that is separated from the cannabis plant matter through a refinement process).

Integrated Facilities

Many cannabis facilities grow the plant and do wholesale operations, for example producing packaged flours, vapes, or edibles. The products then go straight to distribution to dispensaries or retail channels through a regional product distributor.

Here both the plants and the packaging processes represent the largest areas of financial risk. The facility itself could have a catastrophic event, such as a fire. Not only are the plants lost, but the business must re-tool its original packaging machinery to return to full operations. Or, the dispensary industry might encounter a regulatory shift that prevents them from continuing to use the business’s product.

“Massachusetts just banned vapes from being distributed to dispensaries in the state. So, if you’re a vape producer, and all of sudden you have no one to sell vapes to, your entire distribution network gets taken away from beneath you,” says Scarlato.

These added risks introduce the need for expanded business interruption or contingent business impact coverage.

Vertically-Integrated Facilities

At the highest level of complexity are facilities that integrate multiple aspects of manufacturing and distribution. They grow, process, package, distribute, and sell products, increasing value every step of the way. “As you add more integration, you add in more perils that could impact the bottom line,” notes Scarlato.

A Sampling of Added Risk:

• Trucking distribution (e.g., accidents, delays, explosions)
• Product recalls (e.g, tainted flour)
• Regulatory changes (e.g., shifts in state or federal laws)
• Catastrophic loss (e.g., theft, drought, plant disease)
• Product liability (e.g., THC oil used in vapes)
• Property damage (e.g., for each facility)
• Personal liability, auto insurance, crop insurance

Fully-integrated verticals like these pose an extremely complex insurance program and aggravated financial risks. These businesses have the most to lose.

The Role of Regulatory Compliance

Cannabis facilities in both Canada and the U.S. have another level of risk to navigate: changing laws. One area where this can be seen is in licensing. Right now, cannabis operations in California predominantly use temporary licensing. Many Canadian dispensaries buy products from these U.S.-based manufacturers.

So, if there’s a dispensary in Canada buying their flour from a farm in a California facility that’s working under a temporary license, and the State of California decides tomorrow to have a cessation date for all temporary licenses, it creates a real problem. Even if the California grower qualifies for the permanent license, they’re likely going to be out of flour for a couple of weeks as they go through the certification process. That leaves the Canadian company holding the (empty) bag.

Many of Canada’s publicly-traded cannabis companies look to the U.S. to buy up privately-held facilities, yet the risk of having a licensing problem in the U.S. potentially impacts their Canadian license. Because of these regulatory concerns, Canadian companies are shying away from such investments.

Now, add in the multitude of other regulatory bodies that oversee the industry – the United States FDA, state product safety boards, the U.S. federal bank – and the complexity is exponentially amplified.

“The logistics in cannabis are challenging to understand, which is one of the reasons insurance is so difficult,” explains Scarlato.

Assessing Risks

In order to avoid the perils of operating in the cannabis sector, the risk solutions team at Lowers Risk Group can help businesses assess potential risk – from security to business processes, to supply chain logistics. We’ll help you create a strong business continuity plan that will minimize the financial impact of these vulnerabilities. Please contact us if you’d like to get started.