Proactive Communication: The Human Algorithm for Managing Risk

By Lowers & Associates,

Until recently, Continuous Monitoring was, at best, theoretical.  Why?  Because true Continuous Monitoring required real-time access to court records in order to make actionable, informed decisions on employees involved in legal matters.  Arrest record data and other sources were ok, but to truly get the whole picture, court records were required.  Thanks to progressive advances in automation, true Continuous Monitoring is now very real and can, today, provide organizations the opportunity to actively manage employees that operate in high-risk, high-compliance environments.

True Continuous Monitoring is crucial in the modern workplace because it brings efficiencies to risk mitigation immediately after an event occurs, especially if it’s non-jailable or an unreported offense.  With businesses right now running lean and looking for any advantage as they right-size, re-strategize and build towards a post-COVID-19 economy, they need their people to be who they say they are.  True continuous monitoring enables this.

But what about before something bad happens?  That, as they say, is where the rubber meets the road.

Predictive technology absolutely exists in the mainstream already – it drives the engines powering social media, music streaming, news feeds and online retail, to name a few.  But these insights are typically gleaned from prior activity or stated preferences to predict what a person might next want.  Whether you subscribe to Maslow’s ‘Hierarchy of Needs’ or any other human behavior model derivative, when a need is unmet in a person’s life, it’s true that the behaviors that follow are also (usually) predictive; but the technology that works for Spotify playlists and Amazon purchases doesn’t quite meet the litmus test required to anticipate (and mitigate) workplace violence, fraud or other activities that can profoundly impact a business and the people that work there.

Businesses need predictive insight to identify when a behavior pattern becomes a concern, or at the very least, be able to alert a managing authority to deviations that are outside what’s considered “normal and safe” behavior by an employee in order to mitigate the risk exposure.  The algorithm to perform said task does exist, but it’s still very much analog.

What is this old-fashioned engine that can help predict and manage risk-related behaviors, you ask?

Simply put, it’s communication.  More specifically, it’s employees in high-risk or high-compliance environments at all levels using standardized processes to communicate proactively about, well, anything and everything.  When it comes to mitigating risk, proactive communication’s predictive capacity is less about mind-reading and more about behavior-reading.  It enables a framework that employees can use to identify and communicate red flags before those red flags turn into bad behavior and a court case, or worse, yellow caution tape.

In the final entry of #OurStory series, Jon Groussman crystalizes the ’before and after of risk‘ using an example of a client that took a massive hit to employee morale and reputation that, had proactive communication and continuous monitoring been options, might have been avoidable.

This particular incident occurred at a research and manufacturing facility and involved a supervisor and an employee.  Can you tell us what happened?

Jon Groussman: I remember I’d gotten to the office a little bit early that day to do some catching-up.  My phone rang right around 830, it was an executive from a client’s facility letting me know that they had an incident the night before at around 11pm.  A supervisor on the overnight shift had brought a handgun into the facility, put the handgun to the head of one of the workers and threatened to blow the co-worker’s head off if he ever spoke to the supervisor again.  The police were called, the supervisor was arrested for aggravated assault and possession of a firearm, banned from the property and then, of course, taken into custody.

Clearly, the executives were rattled and couldn’t understand how this could happen at their facility.  I was able to get over to the facility the same afternoon that I received the call, walked through the facility and met with the executives.  Unfortunately, the executives didn’t really know much about what actually went on during this 3rd shift which, for all intents and purposes, was an overnight shift. A lot of times, not only in this environment, but in other environments that have shift workers or that are open 24 hours, the more senior management doesn’t know what’s actually happening during those hours.  What develops then is a communication gap.  From a safety and security standpoint, that gap can become a real vulnerability because you’re not getting tipped off to issues that may be occurring in situations like this one.  So, I started to interview people.

Of the 16 or so people I spoke with, a common theme started to emerge. The primary one was that they were understaffed. They had a hard time finding employees with the skill set to meet their demands and so they were more tolerant of, not something like this incident, but we’ll say, inappropriate behavior.  The second was that being understaffed, the demands of the business had put them in a position where ignorance was bliss until reality hit – the lack of awareness and how to report inappropriate behavior was a huge issue.

You mentioned a pattern began to emerge.  Were there red flags that went overlooked?

Jon Groussman: There are almost always red flags; this kind of thing generally doesn’t happen out of the blue.  In speaking with people working that 3rd shift, I was told that the assailant took longer breaks than everybody else.  As he was a supervisor, people didn’t question it because he also got his job done.  The problem was, we found out he was leaving the site – using the only camera that was well-positioned and functioning – to visit a neighboring community that was very well known for selling drugs.  We could see his car come and go at the times when his colleagues said he would be on longer breaks, and this began happening more frequently in the months prior to the attack.

With that revelation, we went to law enforcement to see if he had a record or had any weapons issues beforehand.  It turned out he’d been in court numerous times within that past year for purchasing drugs in the community I mentioned, but this client and facility didn’t have a system in place to know that. Now remember, this was a person in a supervisory role with access to assets within this facility that a loss or accident could have been very bad.  The materials and trade secrets were also very valuable on the secondary market, had he been desperate enough to need money for drugs or been coerced into stealing them.  Had this client and facility utilized some type of continuous monitoring and had a disciplinary policy, this incident would have likely never happened because he would have been gone long before it happened.

You mentioned that even with continuous monitoring in place, there wasn’t a mechanism to be able to report that information, let alone red flag behavior.  Was this a lapse in SOPs or a culture problem?

Jon Groussman: Everyone on that 3rd shift acknowledged the assailant was unusual – he would go and dance on the roof, for example.  But, to your point, the environment at the facility was one where security and minimizing conflict was not part of the culture.  They didn’t have SOPs that addressed ways to communicate any perceived efficiencies, let alone any threats that somebody may perceive against the people or physical assets at the facility.  There was no standardized method to report much of anything.

So, it was clear we had to implement better access control measures.  We wanted to know when people were coming in and going out, and adding physical security equipment like CCTV to compliment it.  But one of the biggest things we had to do was change the culture.  In the security world, it’s sometimes easy to talk about standard operating procedures and physical security equipment, but all those things are only as good as if people are willing to follow it and buy into the program.

The other piece of culture change is that it requires people that are accountable. This facility didn’t have anybody responsible for security.  They didn’t have a threat assessment team. They didn’t have a facility security manager.  Their primary focus for security was that of the machines that did the manufacturing and research.  It was a deadline driven environment.  To get the work done, there was a willingness to overlook certain human capital elements when it didn’t have to do with occupational safety.  As long as the machines were running properly, the place was considered very safe.  But when it came to a potential insider threat, that wasn’t part of the culture. And that’s why I think it took everybody by surprise.  But that 3rd shift was an island unto itself.  Nobody had eyes on it, and they didn’t have the protocols in place to try to capture the red flags.

You’ve seen a lot of things in your career.  Did anything about this experience shock you?

Jon Groussman: Unfortunately, no.  Most of the calls I get are when things are going well until they’re not.  The comparisons that always come to mind are insurance and lawyers – nobody wants to pay for either until they need it.  I think it absolutely surprised the executive team within this particular company that this happened.

The problem was that it wasn’t just the guy who had the gun held to his head that experienced the trauma; it was all the co-workers who witnessed the event.  They were fearing for their lives in that moment.  If that gun went off, even accidentally, who’s to say he wouldn’t have kept shooting?  And this was long before there was such heightened awareness about active shooters.

But this scenario still happens, and it happens because of a lack of communication that, had their communication been better, could have been prevented.

Besides more proactive communication, how did this experience become a teachable moment for you?

Jon Groussman: Most of what I do, and much of what security professionals do when they do assessments, whether it’s a post-event assessment or pre-event, is understanding what the threats are and understanding where the vulnerabilities are, and how you can operationalize the mitigation efforts. And for me to help a business change its culture to become more proactive around its security, I have to have an understanding of the way that business operates before making recommendations on how to minimize those risks.  In the process, you have to prioritize the risks.  And then you have to make sure that the business can still function with the recommendations that you’re putting in place, because you’re not there to create a prison.  You’re also not there to spend money unnecessarily that a company doesn’t have.  And, you’re not there to reduce the efficiency of their business.

In this case, there were some very simple things that we were able to do through an awareness campaign, through a 24-hour anonymous call center – which is very simple to do.  Improved access controls, new cameras.  We instituted continuous monitoring for those employees that had certain access to materials and information, and created oversight protocols for management.  We designed a reporting structure and also a disciplinary structure together so that, if somebody wasn’t doing their job or was behaving in an unusual way, you could address those issues.

We basically just connected the dots.  It took a long time for morale to improve, but it eventually did and proactive communication was really the driver of it all.

  Category: Risk Management
  Comments: Comments Off on Proactive Communication: The Human Algorithm for Managing Risk

Active Shooter Incidents: Have You Come to Grips?

By Lowers & Associates,

Active Shooter Incidents: Have You Come to Grips?

A recent CentralSquare Technologies study revealed that one in three people surveyed are worried about having an active shooter incident in their community. This feeling is not surprising when you consider mass shootings (events involving the shooting of three or more people) are now a part of everyday life in the U.S. As of Sept 24, 2019, there had been an average of 1.24 mass shootings per day, killing 377 people and injuring another 1,347 victims.

While, statistically speaking, there is a low probability of this happening to you personally, organizations must come to grips with active shooter incidents as a complicated yet foreseeable event. It’s a known-known, so to speak. And this means if you are turning a blind eye or continuing to believe it won’t happen within the boundaries of your organizational control, you could be held responsible for the outcome.

This was shown to be true for the company that owns the Las Vegas hotel where a gunman opened fire from his room onto a country music festival two years ago. The company agreed to pay up to $800 million to settle lawsuits filed by victims. The New York Times reported that the settlement “appears to resolve litigation that had raised novel and significant issues of law, including how culpable large companies and property owners are in mass-casualty attacks.”

If an active shooter incident does arise in an environment where your organization is wholly or even partially responsible for ensuring the safety of others, you need to have done the hard work ahead of time. Organizations must have measures in place to reduce the likelihood of firearm violence, know how to respond if an incident does occur, and have a plan to deal with the aftermath.

We invite you to learn more by downloading a copy of our latest whitepaper, Coming to Grips with the Known-Known of Active Shooter Incidents, we lay out the case for proactively preparing your workplace to mitigate risks and have a response plan at the ready.

 

Top 10 Risk Management Articles from 2016

By Lowers & Associates,

The end of the year is a great time to reflect and with that, we like to share our most-read articles of the year. This year’s top articles highlight a strong focus on workplace violence risk management, including active assailant concerns. More than ever, prediction, preparation, and prevention measures are needed to keep each workplace safe. Take some time to read through our top risk management articles from 2016 and plan for a safer and more productive 2017.

1. [Infographic] How to Address the Threat of an Active Assailant Incident in Your Organization

Each and every employee and community member deserves to feel safe. OSHA requires it, labeling it as an organization’s responsibility to provide a safe workplace. Tragically, with a growing number of active assailant incidents happening all around the country, this threat is more relevant than ever before. Over a two-year span, 26 states experienced 40 active assailant incidents, resulting in more than 230 casualties.

Read the full post >

2. Building a Culture of Compliance around BSA/AML – Guidance from FinCEN

In simpler times, the Bank Secrecy Act (BSA) regulated the Anti-Money Laundering (AML) activities of banks, as the name implies. In our globalized and networked world, it has expanded to cover financial institutions ranging from the biggest banks to mom and pop check cashing, or money transfer operations running out of storefronts in a mall. The Financial Crimes Enforcement Network (FinCEN) has launched actions against businesses across this spectrum for violations of BSA/AML requirements.

Read the full post > … Continue reading

  Category: Risk Management
  Comments: Comments Off on Top 10 Risk Management Articles from 2016

[Infographic] The Impact of Workplace Violence

By Lowers & Associates,

workplace violence infographic

Violence in the workplace undeniably affects the individuals who are directly attacked. But the impact also extends far beyond these direct victims to co-workers, clients, executives, shareholders and even out to the community. There are direct losses related to medical bills, workers’ comp and legal fees, as well as indirect losses reflected in diminished productivity, low morale and negative publicity – all of which can damage a company’s reputation long-term. The impact is extensive and can carry a tremendous cost.

“It is not just the victims, who are injured… the workplace also pays a price with disengaged performance and increased health risks… It is imperative, to the business bottom-line, that employees are protected…” — The Roadmap to Mental Health and Excellence at Work, 2005

Prevention is key.

Learn about what constitutes workplace violence, who is at the greatest risk, and what can be done to proactively predict, prevent, and quickly recover from incidents in our latest infographic.

… Continue reading

Why Hope is Not a Risk Management Strategy

By Lowers & Associates,

Low-probability, high-impact events are something that most individuals and organizations would rather ignore. After all, chances are it won’t happen to you. Serious workplace violence events, active shooter incidents, and other unsavory threats are on the rise but it’s easier to assume it will happen to someone else. We don’t want to think about our own mortality or that of our organizations. Instead, we hope it won’t happen to us, to our employees, to our customers, or to our communities.

But then there are these facts:

  • 18% of all crimes committed occur in the workplace
  • Jury awards in workplace violence cases typically run in the millions of dollars
  • 70% of active shooter incidents occur in business or educational environments
  • Workplace violence is the number one cause of workplace fatalities for women

… Continue reading