To meet all your obligations at the speed of risk you must be proactive which is characterized by focusing more on: Forward Planning over Rear-view Planning Management Preview over Management Review Pre-incident Investigations over Post-incident Investigations Project Pre-mortems over Project Post-mortems Prevention over Mitigation Feed-forward control over Feed-back control Evaluate / improve cycles over Audit / fix cycles

NC State University each year publishes their research on the state of risk oversight. The latest version is available reflecting input from 563 respondents. Their findings suggest that significant room for improvement exists particularly in the area of effectiveness. Their conclusion is that organizations need to be more proactive with their risk management. Companies that have robust risk management capabilities are in a better position to address not only the COVID-19 pandemic, but also other threats to mission success. Key Findings from the report include: Most respondents perceive a much riskier business environment now compared to five years ago. COVID-19 has probably increased that perception exponentially for most business leaders. Even before COVID-19, respondents noted that a number of external parties were pressuring senior executives for more extensive information about risks. That will likely be even greater once the pandemic crisis is behind us. Few executives describe their organization’s risk management process as mature. COVID-19 has most likely highlighted even more limitations in their organization’s risk oversight capabilities than previously considered. More organizations are appointing a Chief Risk Officer or creating management-level risk committees to help lead the organization’s risk efforts. That leadership is critical if an organization wants to ensure the process is ongoing and value-adding. About half of the respondent organizations engage in formal risk identification and risk assessment processes. Hopefully more business leaders will see the value in engaging in those processes in the future so that they can be in a more proactive versus reactive risk management posture when the next big risk event emerges. Few respondents perceive their risk management process as providing important strategic value. The ongoing pandemic crisis is hopefully convincing more executives of the strategic importance of having rich insights about risks facing the organization as they make key strategic decisions. Boards tend to delegate responsibilities for risk oversight to a board level committee. More boards are likely to pull that back to the full board level given all individuals on the board need to be informed about the range of top risks for the organization. The process used to generate reports to the board about risks is often ad hoc. Executives may want to rethink how they identify and prioritize risk information to be discussed with the board, given many boards are likely to place even greater pressure on management for more timely and robust risk reporting. Organizations struggle to embed risk accountabilities as part of employee compensation. That is something executives may want to rethink so that risk owners feel greater accountability for overseeing risks assigned to them. Cultural barriers exist inside organizations that limit the strengthening of risk management processes. Business leaders need to focus on what barriers are present inside their organizations to determine what needs to be done to remove those barriers so progress can be realized. You can download the full report here .

Companies need effective risk & compliance systems to ensure they stay between the lines during normal operations and even more so during a crisis. The current conditions are not likely to return to normal any time soon or at all. Companies will need to adapt their current systems to remain operational under changed and changing conditions. That's why we are introducing a NEW compliance resiliency program which helps you rapidly assess, analyze and prioritize your efforts to adapt your existing systems to the new normal so you can continue to meet your stakeholder obligations and improve your resiliency to future changes. ​ Our systems-first approach takes a holistic and risk-based view to obligations to establish essential capabilities that you need right now and can improve over time. This new program covers quality, safety, security, environmental and regulatory objectives and is available on-line as part of The Proactive Certainty Program. Reach out to us today to find out more about this new program.

One of the ways we contend with uncertainty is by having reserves. These are additional resources that can be made available to address a crisis situation, or more generally to ensure mission outcomes are achieved. During the COVID-19 pandemic a loss of critical positions will put a strain on operations. To contend with this, companies may look to their reserves to provide continuity of essential services and functions. A hidden and untapped reserve are previously retired staff; those who still hold necessary certifications, experience, and knowledge. This group of people if mobilized can help you contend with the dragon of uncertainty. References: [1] https://www.itv.com/news/2020-03-01/doctors-and-nurses-could-be-brought-out-of-retirement-to-fight-coronavirus/

I was thinking this morning about all the ways that life is able to go on even in the midst and you might say in spite of the corona pandemic. In a culture of immediacy when you can have whatever you want when you want, the idea of a disruption is unthinkable and possibly even frightening to some. However, it is during times like these that we can see more clearly what was always there but we have, perhaps, taken for granted. In every part of life there are those who go largely unnoticed that without them life just stands still. These are folks that help to keep the lights on, the water flowing, the streets safe, the food supplies moving, and provide the goods and services we have come to expect. These are people that work on the front lines of health care, energy production, food supply, emergency services, and many more. People who work in these industries don't have the option to "stay at home" but are called on now to work more hours than they probably would like to make sure that life does go on for all of us. They too are worried for their families and how they will manage. But they go to work anyways so that the lights stay on for everyone. Thank you to all those that who work behind the scenes to keep life going on. May you and your families be kept safe.

In a previous webinar I was asked this question with respect to compliance: Question: What would be the one area of an organization to start the focus on transitioning from reactive to proactive compliance? Short answer : the area where the obligations are most at risk. Longer answer: organizational designs based on "Taylor-ism" structure themselves around the specialization of work. Each level of work will have a different time horizon. The first level of work is concerned with the here and now; what will I do today, this hour, this moment. The next layer of work focuses on what needs to be done this week and so on up the organization. The level of reactivity will be the highest at the bottom of the organization and should become more proactive as you move up the organization. What we have observed is that the transition between reactive and proactive occurs most often at the director level of the organization; those that direct or lead managers. They are concerned more with effectiveness rather than efficiency. They will have a time horizon (1-3 years) that requires that they set goals, identify strategies, and anticipate and contend with risk which are all proactive activities. However, in many organizations directors are not proactive and instead manage managers rather than direct them. So I would begin with the directors of quality, safety, environmental, and regulatory programs. If they are not proactive the company can never be. Lean Compliance has a program to help directors become more proactive with their compliance. More information can be found here .

Many companies apply linear thinking and steps when attempting to improve their risk and compliance systems. As a result they never reach program effectiveness leaving organizations at risk which threatens their mission success. That's why we recommend companies simultaneously establish the following essential operational processes that work together as a whole to achieve, sustain, and advance compliance performance and outcomes. Maturity of each process can be advanced to achieve higher performance and better outcomes while remaining aligned with each other and overall business objectives.

Balanced scorecards help companies track performance. In today's marketplace characterized by digital disruption you need to make sure that you track more than just performance along the value chain. You need to include areas of your business that are responsible for innovation and growth. These will have different measures and different management approaches. However, what you need most of all is to track progress against outcomes. Are we increasing value in the eyes of our customers? Are margins improving? Are we mitigating risks to ensure outcomes are advanced? Make sure your scorecard covers your entire business model.

The causality model chosen to describe a system often leads to specific methods and tools to address uncertainty and risk.  This may create blind spots when the causality model does not adequately reflect reality.  Make sure that your continuous improvement programs improve system models as well as processes.

With the increases in the number and severity of security breaches, digital factories could benefit from risk-based process safety management to protect against unexpected releases of private data, information, and insights. Process Safety is a combination of engineering and management skills focused on preventing catastrophic accidents, particularly explosions, fires, and toxic releases, associated with the use of chemicals and petroleum products. Process safety practices have evolved over decades of experience and many lessons learned. Process Safety is focused on the identification of hazards and their effective removal and or mitigation. Safety barriers (i.e. risk controls) are put in place to guard against unexpected releases and are designed into the process and then maintained for the life of the facility. A Management of Change (MOC) process is used to preserve the design of the facility along with existing safety barriers. Either one can be modified provided that risk is managed. In the case of an incident an emergency response system is used to minimize consequences and to restore safe operations.

Many of us participate in consumer platforms that collect and use data to improve their products, operations, and ultimately profits. This is often without consent although that is beginning to change. Nevertheless, what is clear is that having this information is an advantage. However, when it comes to collecting and using compliance data the story is very different. Companies for the most part must voluntarily participate in information sharing programs which often do not exist and where the use of their information is unclear. No wonder they are less willing to share information even within their own sectors. However, this comes at the expense of making needed improvements. Given the proposed voluntary information safety sharing program being considered will pipeline operators voluntarily participate knowing that pipeline safety is at stake? Even if they did do they have the IT infrastructure in place to collect and provide the data and how will this information be protected against misuse or cyber attack? For those who would like to learn more about the proposed voluntary information sharing (VIS) program can find the working group report here .

Safety is changing and with it regulations, standards, and strategies. This is particularly the case in the area of people or worker safety. In recent years there has been a growing debate and criticism with respect to safety outcomes, performance and the role of: Prescriptive compliance Safety measurements Lagging indicators Checklists "ZERO" goals Can't measure what didn't happen Quantitative metrics / reductive / reactive Leading indicators Safety management systems Heinrich's Safety Pyramid and others This has generated much discussion and debate along with new approaches to safety under names such as: Safety I & II Behavioral Based Safety Safety Differently Human and Organizational Performance It is too early to tell if these will converge into one unified approach to safety.  However, what we can say is that they are heading towards viewing safety more holistically as a system that can be improved over time through learning and continuous improvement. This will require new skills that include: risk-based and systems thinking, scientific methods, analytics, and continuous improvement. To prime the pump, so to speak, I have included the following video clip from the American Society of Safety Professionals ASSP (formerly ASSE) Safety 2017 conference. You will hear from leading experts in the field of BBS (Dr. E. Scott Geller) and HOP (Dr. Todd Conklin) along with companies such as GE discuss the merits of BBS and HOP based safety. The world of safety is changing and as some have said, "it's about time!"