Imagine your business is being asked to partner with the trendiest new luxury goods distributor. They have a strong presence throughout Europe, are establishing a growing network of suppliers, and come backed by some significant capital. Wow! It MUST be your lucky day!

Or is it?  A quick look into the distributor’s leadership reveals that the principal supplying that capital is best known for stepping down as the founder and CEO of his previous business after multiple Lacey Act violations, including unethical sourcing and the sale of dangerous, toxic products. These violations cost his previous company millions in criminal penalties.

Not to ruin the fantasy here, but this is the real world (and a true story).  Proper due diligence saved the business from this bad partnership before it could happen.  It truly was their lucky day.

This positive outcome is less common than you might think. Fraud is everywhere, but just a small amount of basic due diligence can help a business avoid it or other unnecessary risks. From a small-town pawnbroker that lost his business after hiring a friend whose felonious past was only revealed after a six-figure theft, to a multinational corporation that lost millions in fraudulent payments to a duplicitous supply contractor living well beyond his means, there are countless stories demonstrating the steep price paid by companies that trusted before verifying.

What is due diligence?

Due diligence is a specific but flexible process performed by qualified experts to identify and obtain disparate information to form a complete picture.  In the above example, the research would have included the history and business filings of the company (as well as those of the principles, owners or key management) and any actual or perceived affiliations, to name a few.

Why do businesses need it?

New personnel or new partners can shape the future of your business.  Whether it’s a college coach, a board member or a supplier, the whole story matters and should include:

• Investigation of Character
• Investments
• Acquisitions
• Mergers
• Assets identification (for debt enforcement and recovery)
• Location

What else should I know about due diligence?

It’s always important to understand who you’re working with to eliminate the potential for fraud. When doing your due diligence, here are some best practices to consider:

• Access to public records. A subject’s criminal record (or lack thereof) is of prime importance, but equally significant may be history of litigation or bankruptcy. Even seemingly minor issues like traffic infractions may be indicative, especially when a subject has tallied dozens.
• Complete and comprehensive history. The most thorough background investigations can reveal the truth of what’s been put forward in a resume or MOU and what may have been deliberately omitted.  Ask the questions that illuminate the answer.
• Asset verification. Before entering into any formal arrangement, understand and confirm a potential partner’s claimed resources and reveal when things don’t add up.  Don’t underestimate the power of pressure in the Fraud Triangle.
• Social media review. Despite its prevalence, not everyone uses it wisely. A review of both personal and corporate profiles can identify some of the most egregious red flags.  Consider recurring sweeps to mitigate or uncover your exposure.

BONUS: Red Flags

Incompetence is often much more apparent than criminal activity.  When evaluating a person or vendor, does your due diligence evaluation include the following?

• History of mismanagement
• Jumping from job to job
• Living beyond perceived means
• Having a history of “start-ups” or serial entrepreneurial ventures
• Relocation, either town to town, or state to state
• Longer and undefined timeframes with no employment

If your business is struggling with due diligence or would like to set up a consultation in-person or remotely, please reach out to us.

A perfect storm of human errors — six of them to be exact — caused the biggest nuclear accident to date, the Chernobyl disaster in 1986. An IT mistake prompted 425 million Microsoft Azure users to experience 10.5 hours of downtime. Lack of communication between maintenance crews caused what would have been a simple fix to, instead, lead to the crash of a 1.4 billion dollar stealth bomber.

While there are many sources of enterprise risk, probably the most dynamic and difficult to contend with are those driven by or otherwise impacted by human capital — that is, people. The fact is, most risks start and end with people. The decisions people make, how they perceive situations, how closely they follow policies and procedures… these and other human-driven factors can significantly influence how risks are identified, managed, and addressed.

In our work in the realm of human capital risk, we see many areas where people have the potential to positively or negatively impact the organization from a risk management standpoint. Unfortunately, when people fail, they sometimes fail in big ways. Here are some of the places where human capital risk can rear its head, causing damage to people, brands, and profits:

1. Cybersecurity

Staying secure goes beyond technology (think servers, network, firewalls, etc.); it requires the aid of humans to maintain that secure digital environment. And while most employees get some degree of IT security awareness training in the course of their jobs, mistakes still happen.

IBM estimates the average number of records lost to data breaches annually to be 25,575, and the average cost per breach of USD $3.92 million. Social engineering, malware, and phishing attempts continue to pay dividends for the fraudsters who deploy them. We all know we’re not supposed to click on that link or divulge sensitive information over the phone, but still, people do it. Lapses in judgment, failure to follow a process, having a sense of overconfidence or the feeling that it won’t happen to them, whatever the reason, humans have the ability to sidestep even the strongest cybersecurity protocols.

2. Occupational Fraud

Risk doesn’t always stem from human error; sometimes it’s the result of deliberate actions by employees. Common types of occupational fraud include asset misappropriation, corruption, and financial statement fraud. In 2017, these types of fraudulent activities resulted in $7 billion in losses, according to ACFE’s 2018 Report to the Nations.

When the workplace lacks internal controls, fails to have separation of duties, or neglects to invest in data monitoring and technologies that could flag anomalies, unscrupulous employees see their opening.  Bookkeepers set up fictitious employees in payroll systems in order to cut checks, executives find ways to alter records and financial statements, and line workers take home company property for personal use. These incidents have a median per-loss cost of $114,000, as noted in the ACFE Report.

3. Physical Security

Check with most workplaces and you’ll find they have certain security protocols in place or at least policies that address physical security. Visitors may be asked to check-in at a front desk, employees might be required to wear ID badges, and doors might be required to be locked at all times.

Unfortunately, over time, employees become complacent and policies become outdated. People forget, or simply choose to ignore, the basics they’ve been taught. They leave doors propped open, inviting strangers to come in the building. They neglect to report a broken lock or missing lightbulb. They forget to keep up their annual emergency exit drill schedule. Or, they fail to log off a computer just as someone else decides it’s okay to let a guest circumvent the front desk sign-in because they “know this person.”

These small, but meaningful, errors in judgment often mean the difference between a workplace that remains physically secure and one that opens itself to the risks of theft, data breaches, or even active shooter situations.

4. Workplace Violence

Workplace assaults resulted in 18,400 injuries and illnesses and 458 fatalities in 2017. Assaults range in severity from threats and verbal assault to stabbings, rape, and intentional shootings. In fact, mass shootings at workplaces, schools, and public venues have become the new norm with an average of at least one happening per day in the United States.

We can’t always know which employees are at high risk for engaging in workplace violence, but experts have begun to identify the behaviors that often precede events like these. They include the inability to focus, crying, social isolation, threatening behavior, concerning posts on social media, or complaints of unfair personal treatment. A sudden change in behavioral patterns, or in the frequency or intensity of these behaviors, is also a red flag.

5. Negligent Hiring and Retention

Exercising due diligence in hiring is the best line of defense against negligent hiring and retention lawsuits. Background checks, of course, are the first course of action in rooting out applicants who might disproportionately introduce risk into the workplace. Gathering criminal background records, doing drug testing (as appropriate), and verifying references and credentials are all critical to mitigating your hiring risks.

Beyond background checks, organizations need to have effective fraud detection methods in place. This is particularly relevant considering 96 percent of fraud perpetrators had no prior fraud conviction, and fraudsters who were employed for more than five years stole twice as much, $200,000 vs $100,000 for newer employees! They need to understand the elements of human risk that can be an early indicator of fraudulent activity, including employees who live beyond their means, are experiencing financial difficulties, or have an unwillingness to share job duties.

Manage Your People, Manage Your Risk

Humans are, well, human. They introduce a spectrum of risk into any workplace, from purposeful criminal behavior on one side to unintentional, garden-variety mistakes on the other.

Managing those risks is an ongoing challenge, particularly when it’s difficult to pinpoint the precise human factors that contribute to failures. If you’d like help identifying those areas in your organization that are most susceptible to the human element of risk – whether it’s your cybersecurity program or your hiring processes — request a meeting with a risk management professional.

Ah, complacency. That quiet sense of security or satisfaction with the status quo that prevents a person from acknowledging the potential dangers or risks around them.

We become complacent about internal controls, believing our employees have always been trustworthy and therefore we can eliminate extra steps in the process. We slack off in our security training, thinking “surely our team knows not to click on an unfamiliar link.” Or, we fail to conduct a background check because the applicant is the nephew of one of our fellow executives.

In our recent blog, 4 Culprits of Complacency, we highlighted some of the underlying factors that lead to complacency. In this blog, we bring forth five stories that expose the negative fallout and damage that can occur when organizational complacency takes root.

1. The Law Firm with Weak Accounting Controls

A law firm specializing in intellectual property let complacency derail its internal controls. The firm has five offices throughout the United States, and the satellite offices normally forward their customer payments to the corporate office for processing. Recently, however, customers from at least one of the five locations notified the firm that their previously cashed payments were being duplicated, forged, and re-cashed, leading the customer to have fraudulent withdrawals taken from their bank accounts. Fraudsters left some of the personalized information on the check, such as handwritten notes in the memo line, but had replaced the recipient name, date, and check number with false information and deposited it remotely through an ATM. Rather than keeping customer payments in a secure, locked location, the firm’s complacency in its failure to follow its own internal controls led to this embarrassing and costly mistake.

2. The National Political Committee Duped by Social Engineering

It was the hack heard round the world, all perpetrated by a simple case of spear phishing made possible by complacency. Hackers sent an email to members of the committee that looked like it had been sent by Google and requested them to click a link to reset their passwords due to malicious activity on their accounts. Several members took the bait, and with the new credentials in hand, hackers subsequently breached (and later published) more than 150,000 emails stolen from the Gmail accounts of committee members.

3. The Nursing Home That Failed to Check Employee Backgrounds

A Texas nursing home employee was caught on video physically assaulting an 83-year-old resident, who had advanced Alzheimer’s disease and could barely move, talk, or understand what was going on around her. The family sued the nursing home for $1 million for its negligent hiring of a 23-year-old employee who had previous arrests for fraud, marijuana possession, and criminal mischief on his record. Had the facility not succumbed to complacency, it would have required all workers to undergo a background check before being hired.

4. The Business Merger That Skipped Due Diligence

Two regional telco companies that had been in competition with one another decided to take the plunge and merge, with Company A doing the actual acquiring and Company B being the one acquired. The executives of both teams had been collegial over the years and knew each other’s respective businesses fairly well, so Company A opted to forgo a formal due diligence process. It was only four months into the new merger that Company A realized Company B had inflated the size of its client base and the average revenue per subscriber (ARPS) for each of those clients. Yes, Company B had 800 clients in their account records, but a full 200 of those clients had discontinued service at some point in the preceding timeframe, leaving only 600 active clients. The true value of revenue, then, wasn’t ARPS x 800 clients, it was ARPS x 600 clients, a reduction of about $600,000 in revenue a year than had been presented in the pre-merger discovery process. Once again, complacency reared its ugly head.

5. The Medical Diagnostic Company Lacking Sound Loss Prevention Strategies

We like to think that all of our employees are honest, but even with good internal controls in place, people find ways to cheat their employers. In this case, a manager set up a series of fake companies, invoices and expense reports to reimburse himself for more than $1.2 million in false expenses. His deception was ultimately uncovered through mismatched addresses used on his falsified documents. While loss prevention tactics can’t necessarily filter out every deceitful action, it’s far better to be proactive than remain complacent, as this company did.

Is complacency a risk factor in your organization?

Lowers and Associates works with a wide range of industries, including financial institutions, healthcare providers, casinos, couriers, and insurance companies, to protect their people, brands, and profits. We offer a full range of services, from cash-in-transit evaluations to venue security to IT risk assessments.

If you’re concerned your business is at risk of being complacent, let’s talk. We’d love to help.

“Complacency is the last hurdle standing between any team and its potential greatness.”

Pat Riley, former NBA Coach and Player

You’ve done the important legwork to protect your business against undue risk. You’ve conducted a threat assessment, reviewed security measures, fortified your IT infrastructure, put controls into place, built a business continuity plan, and trained your people. So now what?

Though you’ve taken great measures to prevent and/or mitigate losses, if people fail to consistently follow through with the day-in day-out responsibilities required to keep risks in check, it is all in jeopardy.

Complacency – that sense of quiet pleasure or security, usually accompanied by a lack of awareness of potential dangers or deficiencies – is the enemy of excellence and can be the single largest threat to any business.

Complacency can lead to massive failure. Consider the now infamous example of the Deepwater Horizon explosion which killed 11 people, injured another 126, and caused an oil spill that took three months to get under control. The catastrophe was “the result of poor risk management, last-minute changes to plans, failure to observe and respond to critical indicators, inadequate well control response, and insufficient emergency bridge response training,” according to a federal report. In a nutshell, complacency.

Once complacency takes root in an organization, it’s hard to change course. In this blog, we’ll explore four common causes of complacency and show you how to steer clear of them.

1. Foregoing a “Moment of Insight”

Insights, or those “eureka moments,” abound in our personal lives, in society, and in the workplace. We experience a sudden understanding of something that was previously unknown or incomprehensible. The answer to a puzzle abruptly becomes obvious. A series of seemingly unrelated incidents suddenly reveals a clear pattern.

In the context of risk mitigation these “aha moments” happen all the time. Businesses connect the dots between the events happening around them (e.g., wide area disasters, data hacking incidents) and make the adjustments they need to make in their own operations to stay protected (e.g., creation of disaster recovery plans, beefed up cybersecurity).

So why, then, do some people fail to act despite a clear moment of insight? It often comes down to a lack of leadership or sense of urgency. Often, they are focused on what’s in front of them – the objectives, processes, and budgets before them – rather than presenting a compelling vision for the company. This is especially true during times of change, the thinking being, “The crisis isn’t imminent, and we already have so much on our plates.”

Brent Gleeson, the author of TakingPoint, says, “Most organizations that continue to succeed and innovate have a culture poised for positive change and taking a risk. They don’t wait for the ship to spring a leak. They proactively and constantly set aggressive goals. They sometimes even intentionally develop a sense of urgency.”

2. Maintaining a Sense of Overconfidence

Another reason why organizations stay in a state of complacency is due to an excessive sense of self-confidence, which can express itself in different ways.

Sometimes overconfidence stems from a false sense of security or well-being. “We’ve never had anything bad happen before, and the probability is so small that we can let our guards down.”

Whether it’s a statistical calculation, the illusion of preparedness, or outright arrogance, people operating with this mindset are inviting problems.

Someone leaves the door propped open while they run an errand, crisis communication plans become outdated, or passwords aren’t decommissioned when an employee leaves the company. Teams might even take their cue from management and begin letting practices and policies slide.

3. Having a False Sense of Reality

It’s human nature to be lulled into complacency, especially if you’ve lived the same basic existence in the same company for years on end. You come to believe you’ve lived pretty much every scenario and can reliably predict the outcome of most situations. When we believe we know the answers, our creativity and ability to proactively plan for potential threats become stagnant.

The key in these situations is key to have a learning mindset, to be curious, ask questions and think more deeply. Jeffrey Simmons, President and CEO of Elanco, says it’s helpful to “find people who make you feel uncomfortable, who help you learn a new skill or broaden your perspective.”

4. The Tendency to Make Excuses

Similar to having a false sense of reality, complacency thrives with people and in environments where excuses are made and accepted. Some of the common excuses that lead to inaction, for example are, the failure to conduct quarterly safety trainings, the absence of consistent background checks, or the failure to conduct due diligence with a new business partner.

• The likelihood of a disruptive event (e.g., tornado, data breach, active shooter, embezzlement) happening is so low it’s not worth our time to protect against it.
• We’ve done business with this company for a dozen years, so we don’t need to investigate them as a part of this merger.
• We’ve been very successful so far, so we must be doing something right.
• Our team has very little turnover, so even if something were to occur, most of us were trained at one time on what to do in the event of an emergency or major incident.
• We’re already doing all we can to protect our business from risk, we don’t have the bandwidth to do more.

How to Avoid Complacency

The military has a mantra that “complacency kills.” In fact, signs with this message are often posted at their bases and outposts. They know that complacency in combat may mean the difference between life and death.

In the business world, companies that fail to continuously evolve face obsolescence, at worst, and significant financial or reputational loss, at best.

Here are seven strategies recommended by American Express for warding off business complacency:

1. Be clear on your long-term vision (no more than two years out) and your short-term goals needed to make that vision a reality.
2. Have a specific plan for each day.
3. Give yourself specific time each week—no more than one hour—to think strategically and evaluate where you are and if you are heading in the right direction.
4. Challenge your team to think.
5. Encourage and reward innovation.
6. Create a formal process to learn from mistakes.
7. Invest time and money to improve your skills and knowledge.

Lowers & Associates works with a wide range of industries, helping organizations with a full range of solutions, from assessments to loss mitigation to recovery. Contact us for a consultation to understand what unknown threats you might be facing and how to address them, so that you don’t become a victim of the four culprits of complacency.

No doubt, times are changing. The U.S. is in the midst of a historic presidential transition. Economic pressures and complexities continue to squeeze the purse strings of many businesses and workers. Technology evolves more quickly than we can adopt and adapt. Communication continues to speed up and diverge in myriad directions. Volatility and violence in our social fabric continues to create tension, leaving us on the edge of our seats curious about what is going to help.

One solution that is relevant across all aspects of our life today is security. Promoting ways to feel safe and secure helps everyone relax into whatever actions are needed to continue to move us in a productive direction. This applies to us as individuals, in our homes, in our businesses, cities, airports, and other dimensions of daily life. Security is an important element to promote productivity.
… Continue reading