Adapt & Overcome: The Case for Virtual Surveying

By Daniel Cootes,

As discussed in our most recent LinkedIn post, COVID 19 has forced companies to review and amend their operations top to bottom. And whether these changes are temporary or long-term, one thing is certain: the impact on both business and employee culture is permanent.

The best businesses right now are doing two things: 1) finding ways to stay open and 2) evaluating the future. And the best leaders of these businesses understand the value of employee training, especially in times like these: a safe, secure environment creates well-being for employees and customers, which enables more innovation with less interference. Given the current circumstances, employees want to be sure that their employer is looking out for them. The first step in achieving this (while also keeping the cash registers ringing so that your strategic plan has a future) begins with a wholistic understanding of the business risks. That is, surveying.

While traditional consulting and surveying is simply not plausible right now, recent advancements in technology and encrypted video have made virtual surveying a viable option.  For businesses considering a virtual survey, the team at Lowers & Associates has compiled a list of insights and considerations that may be helpful in your discovery process:

  • The primary benefit of virtual surveying is that it can be conducted anytime, anywhere. With no travel, virtual surveying is one of the best ways forward-thinking businesses can control costs.
  • Virtual surveys are less disruptive to the organization and provide quicker report-in-hand turn around. This can be a massive advantage for organizations pressed for time or with reduced staff capacity.
  • Always a collaborative exercise and NEVER the “lesser of two evils,” virtual surveys can often provide deeper insights than those conducted in-person (sometimes business owners feel more at ease with a physical distance between themselves and the surveyor).
  • Rapid advances in technology come with a learning curve. Leading risk mitigation consultants should be versed in a suite of technology applications to successfully execute a virtual survey.
  • Information is information, right? Sort of.  Asking the right questions matters, knowing how to analyze the answers makes all the difference, and consistency is king.  Virtual or not, surveyors reviewing requested documentation and/or an audio/visual recording of the survey should be able to turn around the same exact results.
  • Consistency is key in both business and surveying. Virtual surveyors should be able to hand over responsibilities to another surveyor if one should fall ill or become unavailable. Process can be both a businesses’ arrow and its Achilles Heel!
  • Virtual surveying should include an ability to perform the following:
    • Pre- survey meetings
    • Staff competency and interviews
    • Reviews of:
      • Day to day operations
      • Site physical security
      • Insurance
      • Fiduciary Controls
      • Policy & Procedure
      • Vault construction
      • Crime and illegal activity (Local and Countrywide)
    • Facility Design Consultation
    • Follow up consultation meetings

 

Adaptation is crucial for businesses during this real-time reinvention of the workplace, and for 30 years, Lowers & Associates has pushed the boundaries of technology to keep those workplaces safe (this includes virtual surveying). #OurWork #Together has also always been collaborative, and so we encourage you to view and share the insights, stories and applicable tips that our team has been publishing at the Lowers & Associates LinkedIn page. If you have any questions, please contact us.

Loss and the Cannabis Industry: Layers of Risk

By Lowers & Associates,

Loss and the Cannabis Industry: Layers of Risk

Emerging markets tend to fall into that riskiest of strategic planning quadrants: Unknown-Unknown territory. They bring with them both tremendous opportunity and enormous risk.

The cannabis industry is one such market.

While medicinal marijuana has been legal in Canada since 2001, and in select states in the U.S. since 1996, only recently has cannabis transitioned into a full-blown commercial enterprise in both countries.

We spoke with Joe Scarlato, President of Emerging Markets & Technology R&D at Lowers Risk Group, to understand just what risks the cannabis industry poses.

Layer by Layer, the Risks Add Up

Understanding risk is an important first step for any business to take to mitigate the possibility of loss. Risks in the cannabis industry run the gamut from catastrophic loss, business interruption, physical security, and cyber losses to a changing regulatory environment.

Cannabis facilities generally fall into one of three different business models which provide a rough framework for understanding their associated risks.

Grow Only Facilities

Facilities that focus on growing plants or producing their distillates have the most clear-cut risk: the catastrophic loss of their plants. Without plants, the business has no raw materials with which to manufacture its products. It can’t sell the cannabis or its distillates (i.e., concentrates such as raw hemp, flour, CBD oil, THC oil that is separated from the cannabis plant matter through a refinement process).

Integrated Facilities

Many cannabis facilities grow the plant and do wholesale operations, for example producing packaged flours, vapes, or edibles. The products then go straight to distribution to dispensaries or retail channels through a regional product distributor.

Here both the plants and the packaging processes represent the largest areas of financial risk. The facility itself could have a catastrophic event, such as a fire. Not only are the plants lost, but the business must re-tool its original packaging machinery to return to full operations. Or, the dispensary industry might encounter a regulatory shift that prevents them from continuing to use the business’s product.

“Massachusetts just banned vapes from being distributed to dispensaries in the state. So, if you’re a vape producer, and all of sudden you have no one to sell vapes to, your entire distribution network gets taken away from beneath you,” says Scarlato.

These added risks introduce the need for expanded business interruption or contingent business impact coverage.

Vertically-Integrated Facilities

At the highest level of complexity are facilities that integrate multiple aspects of manufacturing and distribution. They grow, process, package, distribute, and sell products, increasing value every step of the way. “As you add more integration, you add in more perils that could impact the bottom line,” notes Scarlato.

A Sampling of Added Risk:

  • Trucking distribution (e.g., accidents, delays, explosions)
  • Product recalls (e.g, tainted flour)
  • Regulatory changes (e.g., shifts in state or federal laws)
  • Catastrophic loss (e.g., theft, drought, plant disease)
  • Product liability (e.g., THC oil used in vapes)
  • Property damage (e.g., for each facility)
  • Personal liability, auto insurance, crop insurance

Fully-integrated verticals like these pose an extremely complex insurance program and aggravated financial risks. These businesses have the most to lose.

The Role of Regulatory Compliance

Cannabis facilities in both Canada and the U.S. have another level of risk to navigate: changing laws. One area where this can be seen is in licensing. Right now, cannabis operations in California predominantly use temporary licensing. Many Canadian dispensaries buy products from these U.S.-based manufacturers.

So, if there’s a dispensary in Canada buying their flour from a farm in a California facility that’s working under a temporary license, and the State of California decides tomorrow to have a cessation date for all temporary licenses, it creates a real problem. Even if the California grower qualifies for the permanent license, they’re likely going to be out of flour for a couple of weeks as they go through the certification process. That leaves the Canadian company holding the (empty) bag.

Many of Canada’s publicly-traded cannabis companies look to the U.S. to buy up privately-held facilities, yet the risk of having a licensing problem in the U.S. potentially impacts their Canadian license. Because of these regulatory concerns, Canadian companies are shying away from such investments.

Now, add in the multitude of other regulatory bodies that oversee the industry – the United States FDA, state product safety boards, the U.S. federal bank – and the complexity is exponentially amplified.

“The logistics in cannabis are challenging to understand, which is one of the reasons insurance is so difficult,” explains Scarlato.

Assessing Risks

In order to avoid the perils of operating in the cannabis sector, the risk solutions team at Lowers Risk Group can help businesses assess potential risk – from security to business processes, to supply chain logistics. We’ll help you create a strong business continuity plan that will minimize the financial impact of these vulnerabilities. Please contact us if you’d like to get started.

  Category: Risk Management
  Comments: Comments Off on Loss and the Cannabis Industry: Layers of Risk

Beyond Run, Hide, Fight: What 3 Recent Active Shooter Incidents Taught Us About Being Prepared

By Lowers & Associates,

Beyond Run, Hide, Fight

Active shooter incidents have become a new normal in our society. As of Sept 24, 2019, there had been an average of 1.24 mass shootings per day in 2019, killing 377 people and injuring another 1,347 victims.

“Run. Hide. Fight®” has been the mantra of training set down by the Department of Homeland Security. We are instructed to run and escape if possible; hide if escape is not possible, and fight as an absolute last resort. While this run, hide, fight mantra offers a lot of value to give people a course of action and to help them feel more confident and prepared in the event of an active shooter scenario, there is more to the equation when it comes to prevention and preparation. It’s time to face this fact.

Here, we look at three recent incidents that should serve to remind organizations that there is much more to consider.

Historic District in Dayton, Ohio

In the early hours of August 4, 2019, a 24-year old gunman with an AR-15-style assault rifle and 250 rounds of ammunition killed nine people and injured another 27 in the Oregon Historic District of Dayton, Ohio. The perpetrator was killed by police within 32 seconds of the first shots. A search of the shooter’s home uncovered evidence of his obsession with violence and that he had expressed a desire to commit a mass shooting.

The organization Childhood Preparedness, which provides resources for early childhood professionals with emergency preparedness planning, response, and recovery, formed the following takeaways from both the Dayton shooting and the El Paso shooting, which happened in the same weekend.

Lessons Learned:

Active Threat Training Saved Lives: Dayton law enforcement agencies received previous training in active shooter response, and their quick action saved countless lives.

Citizen Training Is Important: The key to citizen survival in both the Dayton event and other mass shootings was to quickly identify the sound of gunshots.

Running Is Always an Option: In this situation, running was, in fact, a good idea. Running from the gunfire to a safe location away from the shooter helped save some lives. However, some individuals froze and needed to be prompted by others to run. Individuals who chose to lay on the floor suffered multiple injuries and were trampled by others running from the area.

Stop The Bleed Training Can Help: Participants at the scene aided first responders by treating the wounded with basic first aid, CPR, and even applying tourniquets, such as belts, to the wounded. Tourniquet use is a crucial element of Stop The Bleed Training, which teaches bystanders how to stop severe bleeding before professional medical help arrives on the scene.

Townville Elementary School

On September 28, 2016, in a small town 40 miles outside of Greenville, South Carolina, a fourteen-year-old opened fire at Townville Elementary School playground, shooting three students and a teacher. One of the students, a six-year-old boy, later died, as did the shooter’s father, who had been killed earlier in the day by his son. The suspect was apprehended by a volunteer firefighter after his gun jammed on the playground, just 12 seconds after he first pulled the trigger.

Dr. Joanne Avery, Superintendent of the district, candidly shared her experiences in dealing with the immediate response to the shooting and its aftermath, in a School Safety Webinar sponsored by Raptor entitled, Lessons Learned and Changes We Made After an Active Shooting.

Lessons Learned:

Quick Response is Crucial:  The majority of active shooter events, 69%, end in five minutes or less and 67% are over before the first police arrive. “Speedily moving towards engagement with the shooter should be the primary guideline when teaching active shooter response tactics,” according to the FBI’s report, A Study of Active Shooter Incidents in the US Between 2000 and 2013.

Shooters Do Their Research:  Active shooters study and learn from past events in order to inflict the largest amount of damage. “They want their events to be deadlier” and that “they’re on the clock…so they try to get as much damage done as quickly as they can.”

Rural Areas Are Not Immune:  The majority of school shootings have occurred in semi-rural and rural areas, which means it can take between 12 and 15 minutes for first responders to arrive.  Dr. Avery says this is one of the reasons her school was chosen by the shooter.

Create a Drill Calendar:  Have regular active shooter response training with employees and (in the case of schools) students. Create different types of scenarios (e.g., lockdowns, times of day, types of weapons used, outside vs inside).

Know How to Lock Down: You need to be able to have things in place to inform people within the building about the shooter’s whereabouts and a clear evacuation plan. In some situations, training on how to confront the shooter may be warranted.

Dr. Avery stresses that “the first action that anybody should make if they see an active shooter on campus is…to shout ‘lockdown’, call the front office, and then call 911.”

Las Vegas Country Music Festival

On October 1, 2017, between 10:05 and 10:15 p.m., a shooter opened fire from his suite on the 32nd floor of the Mandalay Bay Hotel on a crowd of 22,000 concertgoers at an outdoor music festival. Firing more than 1,100 rounds of ammunition, he killed 58 people and wounded 422; a total of 851 people were injured during the panic that ensued. The shooter, a 64-year-old man, was found dead in his room from a self-inflicted gunshot wound. His motive remains officially undetermined.

In July 2019, the Las Vegas Metropolitan Police Department released a comprehensive After Action Review report about the event, which included a set of 93 recommendations to prepare for the future.

Lessons Learned:

Plan Ahead with Partners: Work with local government and community organizations, including neighboring police, fire, hospital, and coroner officials, to be better prepared and have a more coordinated response.

Become Less of a Target: Responding officers should remove reflective vests so that they are less of a target to shooters.

Have Trauma Kits On-Hand: For large scale events, have more trauma kits on hand available to paramedics and other responders.

Secure High-Rise Buildings: Secure high-rise buildings that oversee open-air crowds and train more officers to stop a shooter in an elevated position.

If we’ve learned one thing from these devastating incidents, it’s that preparation is key. Whether it’s understanding the sounds of gunfire, having trauma kits on hand, or even being prepared to attack and take down a gunman, these actions save lives. Acting quickly and decisively means all the difference.

Every active shooter scenario will be different, but the point is that organizations must have some level of preparedness for each phase of a shooting event – before, during, and after. Those strategies should include:

  • reducing the likelihood of a workplace shooting through comprehensive risk mitigation (e.g., threat assessments, training, physical security);
  • having response plans in place in the event of an active shooter scenario (e.g., evacuation routes, communication with law enforcement); and
  • managing the aftermath of an event (e.g., employee support, public communications).

Once in place, plans must be continually updated, drills practiced, and changes communicated regularly.

Keeping your employees, customers and other stakeholders safe and your business protected is a 24/7/365 endeavor. To learn more, download our latest whitepaper, “Coming to Grips with the Known-Known of Active Shooter Incidents.”

4 Key Sources of Cryptocurrency Exchange Risk

By Lowers & Associates,

It is no secret that cryptocurrency is captivating audiences and opportunists on a global scale. By utilizing the cryptocurrency model of block chain technology, users can perform transactions more quickly and anonymously. As such, many believe cryptocurrency was initially created to facilitate illicit activity such as human trafficking and narcotics. That impression has since been replaced as more and more people discover the ability to purchase goods and services without bank fees and potentially a higher gain on the amount of currency invested in the blockchain system.

Still, many risks remain. And the crypto exchanges are looking for new ways to mitigate these risks, which include:

Dispersed Risk:

Spreading risk is a widely accepted way to succeed in the financial market. But the complex way in which certain risks are dispersed across anonymous networks or computers in a crypto exchange makes is difficult to pinpoint the exact source of a threat or risk in the system.

Anonymity:

The anonymous, digital nature of cryptocurrency transactions means there is a natural lack of control and physical security. This allows new opportunities for someone with malicious intent.

Lack of Control:

Typically, network administrators and advanced computer engineers can develop robust controls to ensure the cryptocurrency is able to be stored and used as appropriate. But what happens if the device is stored on a thumb drive and is stolen or damaged? What happens if someone performs a tiger kidnap and forces transactions to take place?

Potential for Significant Loss:

Unlike in a vault robbery where millions of dollars in bulky and heavy currency takes multiple trips to remove from a vault, the same amount can be removed in seconds with a thumb drive into an anonymous sea of computers.

These and many other areas of risk are driving the cryptocurrency exchanges to invest in insurance. Insurance syndicates and others are responding by addressing how to validate the actual quantum of the currency and how to define the policies and exclusions that will protect these growing networks.

Meanwhile, the cryptocurrency exchanges will continue their efforts to identify and mitigate current and future threats to the trust and safety of their networks.

  Category: Risk Management
  Comments: Comments Off on 4 Key Sources of Cryptocurrency Exchange Risk

7 Components of Risk Assessment for Crypto Cold Storage Service Providers

By Lowers & Associates,

Cryptocurrencies have two faces that present two different sets of custodial issues. One face of these digital assets is that they are weightless strings of binary code that can be flashed around the globe instantaneously. They are accessed through a network of servers with heavy encryption at every step the main custodial tactic.

The other face is physical. Cryptocurrency investors have become highly aware of the fact that “hot” storage of digital assets (storage in an online encrypted file) is more risky than “cold” storage in an offline “wallet” because the online storage methods have proven vulnerable to hacks of different kinds (phishing, social engineering, etc.). The custodial risks of offline cold storage have a lot in common with the physical risks of other small but highly valuable items, but they include some digital risks as well.

A growing number of firms ranging from startups (like Bitgo) to financial giants (like Fidelity) have devised or are in the process of devising cold storage services—a kind of vault for digital assets—for the growing number of investors who want better protection for their crypto assets. A cold storage vault provider has to assess the risks of digital assets in offline storage and devise methods to mitigate them. Note that these risks exist in a largely unregulated system where normal fiat currency controls do not exist.

Here are seven risks providers need to assess and address:

1. Is the safe or vault the right kind for the level of risk, for the value of the asset?

The physical security of the vault must be strong enough to match the value of the asset. Since literally billions of dollars in value can reside on a tiny device, physical resistance to penetration is not a trivial matter.

2. Are digital threats adequately controlled through electronic and physical means?

Digital assets are vulnerable to magnetic or radio radiation, by malicious intent or by accident. Storage areas should be shielded, including all access routes on the premises. No devices capable of memory or carrying magnetic fields can be allowed in the vicinity of the asset.

3. Is physical access to the vault properly controlled?

Almost every armored car robbery begins with the thieves evaluating the access route. To generalize, cold storage providers have to do the same kind of assessment and control the risks. CCTV coverage of access areas is essential, and recordings should be kept 30 to 45 days. Guard presence is required, with escorts for people asking to access the vault.

4. Do procedures sufficiently check the identity of individuals seeking access?

The absence of a legal system of Know Your Customer controls means that storage providers have to develop other means for identifying the people who seek access. This includes every person involved in the chain of custody, such as drivers, guards, and managers. The level of control established by the entities in the chain of custody will vary, and could introduce risks during hand-offs.

5. Are dual control procedures in place at each step in the access process?

Every hand-off and every episode of access to the asset should be under dual control, with appropriate segregation of duties.

6. Are logs maintained to document access and hand-offs of assets, either in or out?

In addition to the CCTV record, every event in the vault that includes access to an asset should be logged according to an established procedure. Personnel on the ground should make the entries and sign off on them.These records should maintain an audit trail including the nature and value (if known!) of the digital asset.

7. Is every member of the staff researched for security and trained in all procedures for control?

Training and understanding of the mission of the vault, as well as job-specific duties, must be verified for every vault employee. Again, outside individuals in the chain of custody may present unknown risks, so efforts should be made to determine the level of control they are under.

Many of these risks are familiar to vault service providers in the cash management industry. For some risks, the addition of digital cold storage is a matter of extension of policies that already exist. However, the addition of the digital issues, especially since cryptocurrencies do not have an external source of control like a fiat currency has, raise the level of risk and the related need to mitigate risk for cryptocurrency.

Download and read Lowers & Associates new white paper, Custodial Crypto: Transportation and Storage, to get a broader understanding about how crypto affects custody.