The RIMS Conference 2023, one of the most anticipated events in the risk management industry, brought together professionals from around the world. This year’s conference witnessed a strong return of attendees, fostering insightful conversations on the influence of technology and AI, the hardening market in some sectors, promising lead generation, and the topic of reevaluating values at risk. As risk managers grapple with the complexities of today’s economy, the conference shed light on innovative approaches to asset valuation, business interruption coverage, and risk assessment. In this blog, we will delve into five key takeaways from RIMS 2023.

1. Attendance at RIMS was Back Full Force

The RIMS Conference 2023 saw a remarkable resurgence in attendance, with professionals from diverse industries coming together to exchange knowledge and best practices. The strong turnout highlighted the industry’s commitment to continuous learning, networking, and staying updated on emerging trends in risk management. This renewed enthusiasm served as a testament to the importance of conferences like RIMS in fostering professional growth and collaboration within the field.

2. Conversations Influenced by Technology and AI

Technology and artificial intelligence (AI) took center stage at the conference, captivating attendees with their potential impact on the risk management landscape. Participants engaged in discussions on leveraging advanced analytics, machine learning algorithms, and data-driven insights to make more informed risk management decisions. The integration of technology and AI was identified as a crucial enabler for identifying emerging risks, enhancing risk assessment processes, and developing effective risk mitigation strategies.

3. Market Hardening and Cost Pressures

The prevailing market conditions, marked by increasing inflation and supply chain disruptions, led to a hardening of the insurance market in some sectors. This hardening brought forth new challenges for risk managers, necessitating a comprehensive evaluation of their risk transfer strategies. With rising costs and limited coverage options, risk managers explored innovative solutions to mitigate their organizations’ exposure, while ensuring optimal protection against potential losses. Adaptability and agility emerged as critical attributes in navigating the evolving market landscape.

4. Networking and Unique Challenges

The conference presented valuable networking opportunities, with risk managers from prominent organizations seeking assistance in asset valuation and business interruption coverage. The complexities of today’s economy have compounded the challenges faced by risk managers in assessing their true exposures. Our conversations at the conference emphasized the need for specialized services such as physical assessments, business interruption studies, drone imagery for risk assessments, and cyber risk evaluations to help organizations better understand, manage and mitigate their risks.

5. Revamping Risk Management Strategies for Values at Risk

The concept of values at risk emerged as a hot topic of discussion at the conference. Risk managers recognized the need to rethink traditional approaches to valuing physical assets, particularly large-scale industrial equipment that is difficult to source. Furthermore, the assessment of business interruption values to protect against lost profits requires a fresh perspective in light of evolving market dynamics. The conference urged risk managers to revamp their risk management strategies, embracing innovative methodologies to adapt to the current environment effectively.

The RIMS Conference 2023 served as a hub for risk management professionals to share insights, discuss industry trends, and explore solutions to pressing challenges. Attendees returned to their organizations armed with a wealth of knowledge on harnessing technology and AI, navigating a hardening market, generating promising leads, and reevaluating values at risk. As the risk management landscape continues to evolve, it is imperative for professionals to remain proactive, adaptable, and forward-thinking in their approaches. The RIMS Conference proved once again to be an indispensable platform for industry leaders.

Business Continuity Plans (BCPs) are funny things.

At their most basic, BCPs are the real-world response to the old “Hope for the best, Plan for the worst” adage.  It’s honest recognition that being stuck between a rock and hard place is better with a hammer, albeit with no guarantee that the hammer is big or small enough to be helpful.

Nonetheless, a well-conceived BCP provides peace of mind, like insurance does, with the added satisfaction that only authorship (or ownership?) brings.  The rub, of course, is that every BCP is, at the end of the day, still just a plan.  As boxer, actor, felon, playwright and corporate strategist ’Iron‘ Mike Tyson once famously said, “Everyone has a plan until they get punched in the mouth.”

Indeed.  Because sometimes pipes break in the 2^nd floor ceiling of your office and leak antifreeze everywhere.  And because, other times, there’s COVID-19.

The benefit of having a BCP plan in place to manage either situation is that, well, there is at least a plan.  And despite what Kid Dynamite says, the real truth is that any company with a plan retains, at the very least, a fighting chance to get back up after they’ve been hit.

For Lowers Risk Group, like many others, COVID hit our industry, our business – our people.  We were fortunate, though: our Business Continuity Plan was 5 years in the making.  It didn’t matter, until it did.

Back in 2015, CTO David Lowers, Chief Security Officer Joe Labrozzi and Director of IT and Security Chris Sosnoski recognized the need for our growing staff to have partially, if not fully, remote capabilities.  What was initially driven by space concerns evolved with the access to and the ability of new technology to support fully secure, remote work that reduced cost, increased efficiency and enabled greater flexibility that could support new business opportunities within Lowers Risk Group.  With this foundation in place, Lowers, Sosnoski and Labrozzi were able to take the organization’s global footprint of over 550 people (spread over 3 continents) to fully remote in less than 2 weeks with zero business interruption when COVID hit.

And though Facilities might disagree, being fully remote due to COVID made the impact of that leaky pipe one less headache to manage when stress levels are already elevated.

We asked Labrozzi and Sosnoski to tell #OurStory of transition to a fully remote work environment.  We asked them what made it possible and to share a few insights that could help other organizations with the creation and implementation of their own BCPs to author their future resilience.  Below is a transcript of our conversation.

On behalf of the entire organization – thank you both for your efforts and keeping the organization on its feet as COVID hit.  How did your teams manage this transition?

Sosnoski
Our ability to go remote during COVID was strategic and began 5 years go.  Wholesale Screening Solutions, our largest division at Lowers Risk Group, was beginning to test our space limitations.  At that time, the VA HQ had about 400 people on-site.  Additionally, the Wholesale team recognized a need that they had to hire in different areas, not just in VA HQ.  We were tasked with how to support that, and it was clear we had to embrace the cloud.  Buy-in from David and other executive leadership there was the first step.

Labrozzi
What really drove the process was what was happening in Wholesale’s Georgia office, our first off-site campus.  We needed a base to get our people into the courts to do research.  That organically began to create resiliency in our operations – rather than rent out trailers, for example, in the event of something happening, our second location offered redundancies as technology matured.  As we gained more experience managing this remote location in GA from our VA HQ, we saw it was possible to have and manage a remote workforce while still doing secure work.  We then built a series of processes around this concept that laid the foundation for more remote work, and we’ve been working at that ever since.

Sosnoski
Right before COVID hit, for example, we launched phase 1 a Unified Communications as a Service (UCaaS) initiative with plans to roll-out Phases 2 and 3 in the coming months.  What would have been a much more measured roll-out was accelerated by COVID.  But, had we not been building towards that – not just with the UCaaS launch, but all the work leading up to the launch – it would not have been as easy or seamless.  However, we had our BCP in place and were able to activate it,.  Our teams stepped up and, again, the full support of leadership helped make it happen.

What were the steps you were taking to build that initial foundation over 5 years?

Sosnoski
The goal was always to keep the working experience as secure and as available as possible, so it was about taking small bites at the apple.  Exploring, testing, and implementing remote training, for example.  Cloud-based email.  Our UCaaS environment.  We were able to leverage cloud resources like Microsoft, Adobe, Salesforce, AWS and Zscaler to achieve this.

The complicating factor was the cost associated with it – we had to be willing and able to spend monthly on subscription services.  For a while, that was a barrier, but we continued to make the business case while moving from a hybrid environment to a cloud environment.  Transitioning the phone system to UCaaS, for example, was a two-and-a-half-year effort to make happen and now our teams are loving the flexibility it offers.  Our teams can do remote assessments and maintain contact with each other and clients easily.

How did you each manage the workload during the COVID transition to remote work?

Labrozzi
Teamwork.  At VA HQ, Chris and I have sat next to each other for years, so we have a great working relationship – that’s part of the culture at LRG, which is probably also a reason the transition was smooth.  But it’s about the quality of who you work with.  Chris’ IT team knows what needs to get done – they’re reliable and fast.  I focused on the human capital element, making sure that we were dealing effectively with any productivity concerns, making sure teams were staying connected.  We all operate from a leadership mindset and depend on each other to play our parts.

Sosnoski
The real risk in remote work is not technology, it’s management process.  My team trusts each other to get things done.  When COVID hit, we found a useful strategy was to use quick, daily stand-up meetings.  For the most part, these types of meetings continue in some capacity across all departments; I know upper management remains committed to finding one-on-one time for their direct reports.  Process is super important in all this, but equally so is everyone’s ability to do their job.

Any key takeaways to offer other organizations from your experience?

Sosnoski – I think there’s really three that worked for us:

• We started planning early and had already explored the risk environment, developed the processes that would provide us a path of least resistance to continuity and had leadership buy-in.
• We identified the right digital tools and had assessed, budgeted for and tested them as part of the plan strategically; having to do this during COVID would have been very difficult.
• We were all aligned on the work that had to be done to achieve the vision; for us that was finding a secure, scalable and available environment to perform our risk mitigation work.

Lowers Risk Group provides comprehensive enterprise risk management solutions to organizations operating in high-risk, highly regulated environments and organizations that value risk mitigation.  Our human capital and specialized industry enterprise risk management solutions protect people, brands, and profits from avoidable loss and harm.  With Lowers Risk Group you can expect a strategic, focused approach to risk assessment, compliance, and mitigation to help drive your organization forward with confidence.  Contact us.

As discussed in our most recent LinkedIn post, COVID 19 has forced companies to review and amend their operations top to bottom. And whether these changes are temporary or long-term, one thing is certain: the impact on both business and employee culture is permanent.

The best businesses right now are doing two things: 1) finding ways to stay open and 2) evaluating the future. And the best leaders of these businesses understand the value of employee training, especially in times like these: a safe, secure environment creates well-being for employees and customers, which enables more innovation with less interference. Given the current circumstances, employees want to be sure that their employer is looking out for them. The first step in achieving this (while also keeping the cash registers ringing so that your strategic plan has a future) begins with a wholistic understanding of the business risks. That is, surveying.

While traditional consulting and surveying is simply not plausible right now, recent advancements in technology and encrypted video have made virtual surveying a viable option.  For businesses considering a virtual survey, the team at Lowers & Associates has compiled a list of insights and considerations that may be helpful in your discovery process:

• The primary benefit of virtual surveying is that it can be conducted anytime, anywhere. With no travel, virtual surveying is one of the best ways forward-thinking businesses can control costs.
• Virtual surveys are less disruptive to the organization and provide quicker report-in-hand turn around. This can be a massive advantage for organizations pressed for time or with reduced staff capacity.
• Always a collaborative exercise and NEVER the “lesser of two evils,” virtual surveys can often provide deeper insights than those conducted in-person (sometimes business owners feel more at ease with a physical distance between themselves and the surveyor).
• Rapid advances in technology come with a learning curve. Leading risk mitigation consultants should be versed in a suite of technology applications to successfully execute a virtual survey.
• Information is information, right? Sort of.  Asking the right questions matters, knowing how to analyze the answers makes all the difference, and consistency is king.  Virtual or not, surveyors reviewing requested documentation and/or an audio/visual recording of the survey should be able to turn around the same exact results.
• Consistency is key in both business and surveying. Virtual surveyors should be able to hand over responsibilities to another surveyor if one should fall ill or become unavailable. Process can be both a businesses’ arrow and its Achilles Heel!
• Virtual surveying should include an ability to perform the following:
  • Pre- survey meetings
  • Staff competency and interviews
  • Reviews of:
    • Day to day operations
    • Site physical security
    • Insurance
    • Fiduciary Controls
    • Policy & Procedure
    • Vault construction
    • Crime and illegal activity (Local and Countrywide)
  • Facility Design Consultation
  • Follow up consultation meetings

Adaptation is crucial for businesses during this real-time reinvention of the workplace, and for 30 years, Lowers & Associates has pushed the boundaries of technology to keep those workplaces safe (this includes virtual surveying). #OurWork #Together has also always been collaborative, and so we encourage you to view and share the insights, stories and applicable tips that our team has been publishing at the Lowers & Associates LinkedIn page. If you have any questions, please contact us.

Even before COVID-19 created the social and economic challenges we are currently working through, brick and mortar business owners large and small understood a basic concept that most of the world wasn’t thinking much about: whenever people gather in close proximity, risk is present. The duality here, of course, is that human nature craves connection, but it also endeavors to avoid risk. Or it chooses to ignore it.

Unfortunately, many of the risks business owners face can be unseen, both for themselves and their customers, and those risks can’t be ignored. Regardless of the type of business, the moment the doors open, unique security-related policy and procedure challenges await. The best businesses implement their security-related policy and procedure measures seamlessly – they become part of the experience. This experience is created by design to ensure the health and safety of those both rendering services (staff) and those transacting payments (customers). If insurance teaches us anything, though, it’s that too often ignorance is bliss until reality hits. And if the security design is bad, the claim is worse.

As restrictions are slowly lifted and businesses around the world contemplate re-opening, every owner – from the small neighborhood grocery store with one door to the 100-floor commercial city building with 15 exits – should be using their time right now to examine what re-opening in the current normal looks like. Any measures that have been developed previously to keep customers, employees and visitors safe may need to be re-established or, at a minimum, revisited to conform with current recommendations from both scientific and governmental authorities.

It can’t be stressed enough, though: revisiting (or in some cases rethinking) security-related policy or procedure isn’t something that happens just because a huge reality event like COVID-19 creates global upheaval.  Practicing good habits requires consistency, and it’s with that in mind that our team is currently sharing a series of insights, stories and applicable tips on security that any industry can use over on the Lowers & Associates LinkedIn page.

To provide some guidance for those reevaluating their security measures or that are specifically focused on re-opening, I’ve created a list of 10 suggested actions ANY business can take to remove risk and eliminate potential for loss at any time.

1. Reassess security resource allocation based on operational need and risk.

If you have a business portfolio with multiple locations, consideration should be given to the specific business environment, nature of the threats, existence of any unusual circumstances, and the capacity of local law enforcement to respond.

2.Limit the number of entry/exit points for employees and visitors.

Tightly control ingress and egress for safety and security optimization. Examine operational feasibility before implementation.

3. Consider the reception area.

If security personnel are employed at the location, what role will they now play at the reception area to assist in the enforcement of new practices?

4. Access control measures and mechanisms dependent on fingerprint or a punch code require new safety protocols to be implemented.

This includes visitor management software and the use of tablets for registration.

5. CCTV coverage designed for cash handling or robbery identification should have expanded focal points to include more than just a face shot.

With the use of face masks becoming more frequent for the foreseeable future, at least one camera angle should include the entire body, including shoes. (criminals typically do not ditch their shoes after committing a robbery)

6. Re-evaluate security post orders.

The post orders must reflect any new duties performed and have a sound rationale for deviations. It is possible that actual security posts change based on organizational necessity. Examine any vulnerabilities that exist and how to overcome the risks.

7. Provide written notice to all employees if the security policies or procedures are being altered.

Even if these changes are temporary, this is necessary to ensure expectations are clear.

8. Initiate and document COVID-19 safety training.

Specifically, for security personnel and/or designated employees working the “front lines” of your business. This can expand to all staff as a general safety bulletin and acknowledgement.

9. Expand workplace violence policy (e.g. domestic violence prevention and response) to include all employees working from home.

Work with the Human Resources Department to provide “hotlines” or other resources available should assistance be required. In addition, identify and assess potential insider threats, as more employees and contractors are working remote.

10. Develop a brief but informative training program on basic techniques to de-escalate aggressive behavior in the workplace.

This is especially important for those business that are “customer facing” (e.g. retail/hospitality) or for businesses with a large number of on-site staff and visitors.

Active shooter incidents have become a new normal in our society. As of Sept 24, 2019, there had been an average of 1.24 mass shootings per day in 2019, killing 377 people and injuring another 1,347 victims.

“Run. Hide. Fight®” has been the mantra of training set down by the Department of Homeland Security. We are instructed to run and escape if possible; hide if escape is not possible, and fight as an absolute last resort. While this run, hide, fight mantra offers a lot of value to give people a course of action and to help them feel more confident and prepared in the event of an active shooter scenario, there is more to the equation when it comes to prevention and preparation. It’s time to face this fact.

Here, we look at three recent incidents that should serve to remind organizations that there is much more to consider.

Historic District in Dayton, Ohio

In the early hours of August 4, 2019, a 24-year old gunman with an AR-15-style assault rifle and 250 rounds of ammunition killed nine people and injured another 27 in the Oregon Historic District of Dayton, Ohio. The perpetrator was killed by police within 32 seconds of the first shots. A search of the shooter’s home uncovered evidence of his obsession with violence and that he had expressed a desire to commit a mass shooting.

The organization Childhood Preparedness, which provides resources for early childhood professionals with emergency preparedness planning, response, and recovery, formed the following takeaways from both the Dayton shooting and the El Paso shooting, which happened in the same weekend.

Lessons Learned:

Active Threat Training Saved Lives: Dayton law enforcement agencies received previous training in active shooter response, and their quick action saved countless lives.

Citizen Training Is Important: The key to citizen survival in both the Dayton event and other mass shootings was to quickly identify the sound of gunshots.

Running Is Always an Option: In this situation, running was, in fact, a good idea. Running from the gunfire to a safe location away from the shooter helped save some lives. However, some individuals froze and needed to be prompted by others to run. Individuals who chose to lay on the floor suffered multiple injuries and were trampled by others running from the area.

Stop The Bleed Training Can Help: Participants at the scene aided first responders by treating the wounded with basic first aid, CPR, and even applying tourniquets, such as belts, to the wounded. Tourniquet use is a crucial element of Stop The Bleed Training, which teaches bystanders how to stop severe bleeding before professional medical help arrives on the scene.

Townville Elementary School

On September 28, 2016, in a small town 40 miles outside of Greenville, South Carolina, a fourteen-year-old opened fire at Townville Elementary School playground, shooting three students and a teacher. One of the students, a six-year-old boy, later died, as did the shooter’s father, who had been killed earlier in the day by his son. The suspect was apprehended by a volunteer firefighter after his gun jammed on the playground, just 12 seconds after he first pulled the trigger.

Dr. Joanne Avery, Superintendent of the district, candidly shared her experiences in dealing with the immediate response to the shooting and its aftermath, in a School Safety Webinar sponsored by Raptor entitled, Lessons Learned and Changes We Made After an Active Shooting.

Lessons Learned:

Quick Response is Crucial:  The majority of active shooter events, 69%, end in five minutes or less and 67% are over before the first police arrive. “Speedily moving towards engagement with the shooter should be the primary guideline when teaching active shooter response tactics,” according to the FBI’s report, A Study of Active Shooter Incidents in the US Between 2000 and 2013.

Shooters Do Their Research:  Active shooters study and learn from past events in order to inflict the largest amount of damage. “They want their events to be deadlier” and that “they’re on the clock…so they try to get as much damage done as quickly as they can.”

Rural Areas Are Not Immune:  The majority of school shootings have occurred in semi-rural and rural areas, which means it can take between 12 and 15 minutes for first responders to arrive.  Dr. Avery says this is one of the reasons her school was chosen by the shooter.

Create a Drill Calendar:  Have regular active shooter response training with employees and (in the case of schools) students. Create different types of scenarios (e.g., lockdowns, times of day, types of weapons used, outside vs inside).

Know How to Lock Down: You need to be able to have things in place to inform people within the building about the shooter’s whereabouts and a clear evacuation plan. In some situations, training on how to confront the shooter may be warranted.

Dr. Avery stresses that “the first action that anybody should make if they see an active shooter on campus is…to shout ‘lockdown’, call the front office, and then call 911.”

Las Vegas Country Music Festival

On October 1, 2017, between 10:05 and 10:15 p.m., a shooter opened fire from his suite on the 32nd floor of the Mandalay Bay Hotel on a crowd of 22,000 concertgoers at an outdoor music festival. Firing more than 1,100 rounds of ammunition, he killed 58 people and wounded 422; a total of 851 people were injured during the panic that ensued. The shooter, a 64-year-old man, was found dead in his room from a self-inflicted gunshot wound. His motive remains officially undetermined.

In July 2019, the Las Vegas Metropolitan Police Department released a comprehensive After Action Review report about the event, which included a set of 93 recommendations to prepare for the future.

Lessons Learned:

Plan Ahead with Partners: Work with local government and community organizations, including neighboring police, fire, hospital, and coroner officials, to be better prepared and have a more coordinated response.

Become Less of a Target: Responding officers should remove reflective vests so that they are less of a target to shooters.

Have Trauma Kits On-Hand: For large scale events, have more trauma kits on hand available to paramedics and other responders.

Secure High-Rise Buildings: Secure high-rise buildings that oversee open-air crowds and train more officers to stop a shooter in an elevated position.

If we’ve learned one thing from these devastating incidents, it’s that preparation is key. Whether it’s understanding the sounds of gunfire, having trauma kits on hand, or even being prepared to attack and take down a gunman, these actions save lives. Acting quickly and decisively means all the difference.

Every active shooter scenario will be different, but the point is that organizations must have some level of preparedness for each phase of a shooting event – before, during, and after. Those strategies should include:

• reducing the likelihood of a workplace shooting through comprehensive risk mitigation (e.g., threat assessments, training, physical security);
• having response plans in place in the event of an active shooter scenario (e.g., evacuation routes, communication with law enforcement); and
• managing the aftermath of an event (e.g., employee support, public communications).

Once in place, plans must be continually updated, drills practiced, and changes communicated regularly.

Keeping your employees, customers and other stakeholders safe and your business protected is a 24/7/365 endeavor. To learn more, download our latest whitepaper, “Coming to Grips with the Known-Known of Active Shooter Incidents.”