Active shooter incidents have become a new normal in our society. As of Sept 24, 2019, there had been an average of 1.24 mass shootings per day in 2019, killing 377 people and injuring another 1,347 victims.

“Run. Hide. Fight®” has been the mantra of training set down by the Department of Homeland Security. We are instructed to run and escape if possible; hide if escape is not possible, and fight as an absolute last resort. While this run, hide, fight mantra offers a lot of value to give people a course of action and to help them feel more confident and prepared in the event of an active shooter scenario, there is more to the equation when it comes to prevention and preparation. It’s time to face this fact.

Here, we look at three recent incidents that should serve to remind organizations that there is much more to consider.

Historic District in Dayton, Ohio

In the early hours of August 4, 2019, a 24-year old gunman with an AR-15-style assault rifle and 250 rounds of ammunition killed nine people and injured another 27 in the Oregon Historic District of Dayton, Ohio. The perpetrator was killed by police within 32 seconds of the first shots. A search of the shooter’s home uncovered evidence of his obsession with violence and that he had expressed a desire to commit a mass shooting.

The organization Childhood Preparedness, which provides resources for early childhood professionals with emergency preparedness planning, response, and recovery, formed the following takeaways from both the Dayton shooting and the El Paso shooting, which happened in the same weekend.

Lessons Learned:

Active Threat Training Saved Lives: Dayton law enforcement agencies received previous training in active shooter response, and their quick action saved countless lives.

Citizen Training Is Important: The key to citizen survival in both the Dayton event and other mass shootings was to quickly identify the sound of gunshots.

Running Is Always an Option: In this situation, running was, in fact, a good idea. Running from the gunfire to a safe location away from the shooter helped save some lives. However, some individuals froze and needed to be prompted by others to run. Individuals who chose to lay on the floor suffered multiple injuries and were trampled by others running from the area.

Stop The Bleed Training Can Help: Participants at the scene aided first responders by treating the wounded with basic first aid, CPR, and even applying tourniquets, such as belts, to the wounded. Tourniquet use is a crucial element of Stop The Bleed Training, which teaches bystanders how to stop severe bleeding before professional medical help arrives on the scene.

Townville Elementary School

On September 28, 2016, in a small town 40 miles outside of Greenville, South Carolina, a fourteen-year-old opened fire at Townville Elementary School playground, shooting three students and a teacher. One of the students, a six-year-old boy, later died, as did the shooter’s father, who had been killed earlier in the day by his son. The suspect was apprehended by a volunteer firefighter after his gun jammed on the playground, just 12 seconds after he first pulled the trigger.

Dr. Joanne Avery, Superintendent of the district, candidly shared her experiences in dealing with the immediate response to the shooting and its aftermath, in a School Safety Webinar sponsored by Raptor entitled, Lessons Learned and Changes We Made After an Active Shooting.

Lessons Learned:

Quick Response is Crucial:  The majority of active shooter events, 69%, end in five minutes or less and 67% are over before the first police arrive. “Speedily moving towards engagement with the shooter should be the primary guideline when teaching active shooter response tactics,” according to the FBI’s report, A Study of Active Shooter Incidents in the US Between 2000 and 2013.

Shooters Do Their Research:  Active shooters study and learn from past events in order to inflict the largest amount of damage. “They want their events to be deadlier” and that “they’re on the clock…so they try to get as much damage done as quickly as they can.”

Rural Areas Are Not Immune:  The majority of school shootings have occurred in semi-rural and rural areas, which means it can take between 12 and 15 minutes for first responders to arrive.  Dr. Avery says this is one of the reasons her school was chosen by the shooter.

Create a Drill Calendar:  Have regular active shooter response training with employees and (in the case of schools) students. Create different types of scenarios (e.g., lockdowns, times of day, types of weapons used, outside vs inside).

Know How to Lock Down: You need to be able to have things in place to inform people within the building about the shooter’s whereabouts and a clear evacuation plan. In some situations, training on how to confront the shooter may be warranted.

Dr. Avery stresses that “the first action that anybody should make if they see an active shooter on campus is…to shout ‘lockdown’, call the front office, and then call 911.”

Las Vegas Country Music Festival

On October 1, 2017, between 10:05 and 10:15 p.m., a shooter opened fire from his suite on the 32nd floor of the Mandalay Bay Hotel on a crowd of 22,000 concertgoers at an outdoor music festival. Firing more than 1,100 rounds of ammunition, he killed 58 people and wounded 422; a total of 851 people were injured during the panic that ensued. The shooter, a 64-year-old man, was found dead in his room from a self-inflicted gunshot wound. His motive remains officially undetermined.

In July 2019, the Las Vegas Metropolitan Police Department released a comprehensive After Action Review report about the event, which included a set of 93 recommendations to prepare for the future.

Lessons Learned:

Plan Ahead with Partners: Work with local government and community organizations, including neighboring police, fire, hospital, and coroner officials, to be better prepared and have a more coordinated response.

Become Less of a Target: Responding officers should remove reflective vests so that they are less of a target to shooters.

Have Trauma Kits On-Hand: For large scale events, have more trauma kits on hand available to paramedics and other responders.

Secure High-Rise Buildings: Secure high-rise buildings that oversee open-air crowds and train more officers to stop a shooter in an elevated position.

If we’ve learned one thing from these devastating incidents, it’s that preparation is key. Whether it’s understanding the sounds of gunfire, having trauma kits on hand, or even being prepared to attack and take down a gunman, these actions save lives. Acting quickly and decisively means all the difference.

Every active shooter scenario will be different, but the point is that organizations must have some level of preparedness for each phase of a shooting event – before, during, and after. Those strategies should include:

• reducing the likelihood of a workplace shooting through comprehensive risk mitigation (e.g., threat assessments, training, physical security);
• having response plans in place in the event of an active shooter scenario (e.g., evacuation routes, communication with law enforcement); and
• managing the aftermath of an event (e.g., employee support, public communications).

Once in place, plans must be continually updated, drills practiced, and changes communicated regularly.

Keeping your employees, customers and other stakeholders safe and your business protected is a 24/7/365 endeavor. To learn more, download our latest whitepaper, “Coming to Grips with the Known-Known of Active Shooter Incidents.”

A perfect storm of human errors — six of them to be exact — caused the biggest nuclear accident to date, the Chernobyl disaster in 1986. An IT mistake prompted 425 million Microsoft Azure users to experience 10.5 hours of downtime. Lack of communication between maintenance crews caused what would have been a simple fix to, instead, lead to the crash of a 1.4 billion dollar stealth bomber.

While there are many sources of enterprise risk, probably the most dynamic and difficult to contend with are those driven by or otherwise impacted by human capital — that is, people. The fact is, most risks start and end with people. The decisions people make, how they perceive situations, how closely they follow policies and procedures… these and other human-driven factors can significantly influence how risks are identified, managed, and addressed.

In our work in the realm of human capital risk, we see many areas where people have the potential to positively or negatively impact the organization from a risk management standpoint. Unfortunately, when people fail, they sometimes fail in big ways. Here are some of the places where human capital risk can rear its head, causing damage to people, brands, and profits:

1. Cybersecurity

Staying secure goes beyond technology (think servers, network, firewalls, etc.); it requires the aid of humans to maintain that secure digital environment. And while most employees get some degree of IT security awareness training in the course of their jobs, mistakes still happen.

IBM estimates the average number of records lost to data breaches annually to be 25,575, and the average cost per breach of USD $3.92 million. Social engineering, malware, and phishing attempts continue to pay dividends for the fraudsters who deploy them. We all know we’re not supposed to click on that link or divulge sensitive information over the phone, but still, people do it. Lapses in judgment, failure to follow a process, having a sense of overconfidence or the feeling that it won’t happen to them, whatever the reason, humans have the ability to sidestep even the strongest cybersecurity protocols.

2. Occupational Fraud

Risk doesn’t always stem from human error; sometimes it’s the result of deliberate actions by employees. Common types of occupational fraud include asset misappropriation, corruption, and financial statement fraud. In 2017, these types of fraudulent activities resulted in $7 billion in losses, according to ACFE’s 2018 Report to the Nations.

When the workplace lacks internal controls, fails to have separation of duties, or neglects to invest in data monitoring and technologies that could flag anomalies, unscrupulous employees see their opening.  Bookkeepers set up fictitious employees in payroll systems in order to cut checks, executives find ways to alter records and financial statements, and line workers take home company property for personal use. These incidents have a median per-loss cost of $114,000, as noted in the ACFE Report.

3. Physical Security

Check with most workplaces and you’ll find they have certain security protocols in place or at least policies that address physical security. Visitors may be asked to check-in at a front desk, employees might be required to wear ID badges, and doors might be required to be locked at all times.

Unfortunately, over time, employees become complacent and policies become outdated. People forget, or simply choose to ignore, the basics they’ve been taught. They leave doors propped open, inviting strangers to come in the building. They neglect to report a broken lock or missing lightbulb. They forget to keep up their annual emergency exit drill schedule. Or, they fail to log off a computer just as someone else decides it’s okay to let a guest circumvent the front desk sign-in because they “know this person.”

These small, but meaningful, errors in judgment often mean the difference between a workplace that remains physically secure and one that opens itself to the risks of theft, data breaches, or even active shooter situations.

4. Workplace Violence

Workplace assaults resulted in 18,400 injuries and illnesses and 458 fatalities in 2017. Assaults range in severity from threats and verbal assault to stabbings, rape, and intentional shootings. In fact, mass shootings at workplaces, schools, and public venues have become the new norm with an average of at least one happening per day in the United States.

We can’t always know which employees are at high risk for engaging in workplace violence, but experts have begun to identify the behaviors that often precede events like these. They include the inability to focus, crying, social isolation, threatening behavior, concerning posts on social media, or complaints of unfair personal treatment. A sudden change in behavioral patterns, or in the frequency or intensity of these behaviors, is also a red flag.

5. Negligent Hiring and Retention

Exercising due diligence in hiring is the best line of defense against negligent hiring and retention lawsuits. Background checks, of course, are the first course of action in rooting out applicants who might disproportionately introduce risk into the workplace. Gathering criminal background records, doing drug testing (as appropriate), and verifying references and credentials are all critical to mitigating your hiring risks.

Beyond background checks, organizations need to have effective fraud detection methods in place. This is particularly relevant considering 96 percent of fraud perpetrators had no prior fraud conviction, and fraudsters who were employed for more than five years stole twice as much, $200,000 vs $100,000 for newer employees! They need to understand the elements of human risk that can be an early indicator of fraudulent activity, including employees who live beyond their means, are experiencing financial difficulties, or have an unwillingness to share job duties.

Manage Your People, Manage Your Risk

Humans are, well, human. They introduce a spectrum of risk into any workplace, from purposeful criminal behavior on one side to unintentional, garden-variety mistakes on the other.

Managing those risks is an ongoing challenge, particularly when it’s difficult to pinpoint the precise human factors that contribute to failures. If you’d like help identifying those areas in your organization that are most susceptible to the human element of risk – whether it’s your cybersecurity program or your hiring processes — request a meeting with a risk management professional.

“Complacency is the last hurdle standing between any team and its potential greatness.”

Pat Riley, former NBA Coach and Player

You’ve done the important legwork to protect your business against undue risk. You’ve conducted a threat assessment, reviewed security measures, fortified your IT infrastructure, put controls into place, built a business continuity plan, and trained your people. So now what?

Though you’ve taken great measures to prevent and/or mitigate losses, if people fail to consistently follow through with the day-in day-out responsibilities required to keep risks in check, it is all in jeopardy.

Complacency – that sense of quiet pleasure or security, usually accompanied by a lack of awareness of potential dangers or deficiencies – is the enemy of excellence and can be the single largest threat to any business.

Complacency can lead to massive failure. Consider the now infamous example of the Deepwater Horizon explosion which killed 11 people, injured another 126, and caused an oil spill that took three months to get under control. The catastrophe was “the result of poor risk management, last-minute changes to plans, failure to observe and respond to critical indicators, inadequate well control response, and insufficient emergency bridge response training,” according to a federal report. In a nutshell, complacency.

Once complacency takes root in an organization, it’s hard to change course. In this blog, we’ll explore four common causes of complacency and show you how to steer clear of them.

1. Foregoing a “Moment of Insight”

Insights, or those “eureka moments,” abound in our personal lives, in society, and in the workplace. We experience a sudden understanding of something that was previously unknown or incomprehensible. The answer to a puzzle abruptly becomes obvious. A series of seemingly unrelated incidents suddenly reveals a clear pattern.

In the context of risk mitigation these “aha moments” happen all the time. Businesses connect the dots between the events happening around them (e.g., wide area disasters, data hacking incidents) and make the adjustments they need to make in their own operations to stay protected (e.g., creation of disaster recovery plans, beefed up cybersecurity).

So why, then, do some people fail to act despite a clear moment of insight? It often comes down to a lack of leadership or sense of urgency. Often, they are focused on what’s in front of them – the objectives, processes, and budgets before them – rather than presenting a compelling vision for the company. This is especially true during times of change, the thinking being, “The crisis isn’t imminent, and we already have so much on our plates.”

Brent Gleeson, the author of TakingPoint, says, “Most organizations that continue to succeed and innovate have a culture poised for positive change and taking a risk. They don’t wait for the ship to spring a leak. They proactively and constantly set aggressive goals. They sometimes even intentionally develop a sense of urgency.”

2. Maintaining a Sense of Overconfidence

Another reason why organizations stay in a state of complacency is due to an excessive sense of self-confidence, which can express itself in different ways.

Sometimes overconfidence stems from a false sense of security or well-being. “We’ve never had anything bad happen before, and the probability is so small that we can let our guards down.”

Whether it’s a statistical calculation, the illusion of preparedness, or outright arrogance, people operating with this mindset are inviting problems.

Someone leaves the door propped open while they run an errand, crisis communication plans become outdated, or passwords aren’t decommissioned when an employee leaves the company. Teams might even take their cue from management and begin letting practices and policies slide.

3. Having a False Sense of Reality

It’s human nature to be lulled into complacency, especially if you’ve lived the same basic existence in the same company for years on end. You come to believe you’ve lived pretty much every scenario and can reliably predict the outcome of most situations. When we believe we know the answers, our creativity and ability to proactively plan for potential threats become stagnant.

The key in these situations is key to have a learning mindset, to be curious, ask questions and think more deeply. Jeffrey Simmons, President and CEO of Elanco, says it’s helpful to “find people who make you feel uncomfortable, who help you learn a new skill or broaden your perspective.”

4. The Tendency to Make Excuses

Similar to having a false sense of reality, complacency thrives with people and in environments where excuses are made and accepted. Some of the common excuses that lead to inaction, for example are, the failure to conduct quarterly safety trainings, the absence of consistent background checks, or the failure to conduct due diligence with a new business partner.

• The likelihood of a disruptive event (e.g., tornado, data breach, active shooter, embezzlement) happening is so low it’s not worth our time to protect against it.
• We’ve done business with this company for a dozen years, so we don’t need to investigate them as a part of this merger.
• We’ve been very successful so far, so we must be doing something right.
• Our team has very little turnover, so even if something were to occur, most of us were trained at one time on what to do in the event of an emergency or major incident.
• We’re already doing all we can to protect our business from risk, we don’t have the bandwidth to do more.

How to Avoid Complacency

The military has a mantra that “complacency kills.” In fact, signs with this message are often posted at their bases and outposts. They know that complacency in combat may mean the difference between life and death.

In the business world, companies that fail to continuously evolve face obsolescence, at worst, and significant financial or reputational loss, at best.

Here are seven strategies recommended by American Express for warding off business complacency:

1. Be clear on your long-term vision (no more than two years out) and your short-term goals needed to make that vision a reality.
2. Have a specific plan for each day.
3. Give yourself specific time each week—no more than one hour—to think strategically and evaluate where you are and if you are heading in the right direction.
4. Challenge your team to think.
5. Encourage and reward innovation.
6. Create a formal process to learn from mistakes.
7. Invest time and money to improve your skills and knowledge.

Lowers & Associates works with a wide range of industries, helping organizations with a full range of solutions, from assessments to loss mitigation to recovery. Contact us for a consultation to understand what unknown threats you might be facing and how to address them, so that you don’t become a victim of the four culprits of complacency.

Demand is on the rise for cold storage vault services for cryptocurrency. As CIT and vault providers work to meet the demand, they are facing risks that are at once similar and very different from those they encounter with their cash services.

As a vault or transport provider, how well do you understand the risks of cold storage?

Our latest slideshow highlights 7 components of a risk assessment for cold storage providers of cryptocurrency. It looks at the following:

1. The right safe for the job
2. Control of digital threats
3. Control of physical threats
4. Identity verification
5. Dual controls
6. Access logs
7. Procedural integrity

Flip through the slideshow here:

To learn more about custodial crypto transportation and storage, we invite you to download our whitepaper, Custodial Crypto Transportation and Storage: Understanding and Mitigating the Risks.

Cryptocurrencies such as Bitcoin and Ethereum are emerging from the dark side of the web. These currencies have multiplied in number and increased tremendously in value despite their volatility.

However, sad experience has taught storing crypto safely in online exchanges is risky at best. In the infamous case of Mt. Gox, almost $500 million worth of bitcoin was hacked. Some of it seems to have emerged in the hands of potential thieves, but there’s still mystery surrounding the incident. Many other hacks of exchanges have occurred since Mt. Gox, leading to a scramble to find more secure ways to manage cryptocurrency.

The super-hacks have shined a spotlight on the issue of custody. As Philip Martin of Coinbase, a large cryptocurrency exchange, stated in a recent Wired Magazine interview,

“Cryptocurrencies have a threat model that’s fundamentally different from what’s come before. We’re taking the lessons from the past about physical security and blending them with well-structured cryptography.”

Crypto investors are understanding that a diversified approach to storage is wise. They are turning to cold storage (offline storage) for at least a percentage of their coin as a way of managing their risks of loss.

Many are finding that the simplest way to avoid the threat of losing digital coin to a hacker is to move it to an offline storage device, called a “cold wallet”. At the same time, the 128-bit encryption codes that permit access to the currency (especially the private key) have to be securely stored where they can be retrieved.

The moment digital files or keys are transferred to a physical medium, whether it’s a device or plain paper (which may be a legitimate way to store an encryption key), custody is the crucial issue. Many of the same risks exist for offline cryptocurrency as apply to other easily transported high-value items like gems.

The encryption keys add a layer of complexity. There are two high-value items, the currency and the key that accesses it, that must be transported and stored separately in a way that they can be rejoined when the legitimate owner wants access.

Our latest white paper plots a path to security in the storage and transportation of cryptocurrency. Carefully managing the risks involved with the activity is necessary to make cryptocurrency insurable. Get your copy of Custodial Crypto Transportation and Storage: Understanding the Risks.