Operational Risk: The Pursuit of Trusted Information...

Operational Risk is about Performance Management and Business Resilience. A few months ago the topic of "Compete or Die" was discussed here. Why revisit this topic?

CEO's and the Board of Directors realize the road to eliminating fear in their organization and the marketplace is through trusted information.

Being agile, ready and capable of a quick recovery is what competitiveness is all about, on the field, on stage or around the table in the Board Room.

Working towards control and protection while "Fear" builds in the back of your mind makes you stiff, depletes your energy and creates doubt. And when you are operating a business or standing on the tee of your first sudden death hole on any PGA weekend, you better have resilience.

The business equivalent to Homeland Security and Critical Infrastructure Protection is Operational Risk Management—a domain that many executives see as the most important emerging area of risk for their firms. Increasingly, failure to plan for Operational Resilience can have “bet the firm” results. 

There are numerous examples of how errors, omissions and glitches have brought down the reputations of many a Fortune 500 companies. What do they all have in common that led to their demise? A lack of economic and business resilience to remain competitive in the marketplace.

The threat of Tort Liability and the loss of reputation is top of mind these days with every major global company executive. The threat is real and increasing at a faster rate than many other real operational risks to the enterprise. Litigation from regulators, class actions and competitors has given the term Legal Risk new emphasis and meaning.

Once corporate management understands the need for a "resilience" mentality in place of a "protection" mental state, a new perspective is found. Investing in the vitality, agility and competitive capabilities of the organization sounds and is more positive.

It alleviates the fear of doom and gloom and inspires new found innovation. The future of your organizations longevity and in it's adaptability can be achieved with a new perspective. Compete or die.

Performance Management could be enabled or suppressed by the amount of power you give your leadership. Do they have the ability to make a $1M decision or $10K decisions when it comes to investing budgeted capital into their business unit growth?

Do they manage risk on a level where they are the most informed and the most knowledgeable about the business, or is the "Mother Ship" back at the home office dictating the way they spend or the way they invest?

The ability to know how to manage risk at the point of creating new information is the nexus of several disciplines and requires substantial training. Every minute that goes by with people not behaving correctly puts the enterprise at greater risk to lost performance opportunities.

All these issues can be summed up in a single concept: trusted information. Simply accessing data is no longer enough. Today's CEOs, CFOs and knowledge-workers must be able to reliably track the information they use for decisions back to the original source systems in order to ensure its timeliness, accuracy and credibility.

Over the last few decades, organizations have invested Billions of dollars in systems to collect, store and distribute information more effectively. Despite this, information users at all levels of the organization are often uncomfortable with the quality, reliability and transparency of the information they receive.

Today's organizations rarely have a "single view of the truth." Executives waste time in meetings debating whose figures are correct, rather than what to do about the company's issues.

Additionally, they worry about the AI consequences of making strategic decisions using the wrong information, directly impacting the long-term survival of the organization.

The search for trusted information is a continuous pursuit for commanders in the "Mission Ready Room" and the "Corporate Board Room".

So how do you achieve the level of assurance that's required to make the "bet the farm" risk management decisions in your enterprise?

TrustDecisions: Quality of Innovation...

When you approach a new problem-set in your start-up or emerging business there are several methods for your teams approach to solving it.

The methodology that you and your team use to solve your particular problem, will make all the difference in how fast the business grows and accelerates towards ultimate success.

Our team continues to utilize a SPRINT-based approach and a lean launchpad mindset to find the correct solutions to deliver with quality.

Over the course of many years of growth, the patience and the focus on staying true to the system, to the proven steps in the sequence has always provided results.

In so many cases, the results are not what we could have imagined at the beginning of our journey.

The original hypothesis we thought was going to lead us to a successful outcome turned 90 or 180 degrees.

The answers to our problem-set changed as we interviewed more people, dozens of others in the same industry with a similar set of issues in the past.

The story continues as we designed the new prototype solution. It would change after several more iterations navigating us towards true innovation.

“Innovation Navigators” don’t give up easily. We test, we try and we make changes. The pursuit of information assurance is vital.

The quality of the solution that is designed and tested to solve the problem is a direct result of the number of times you test and the information captured for analysis.

How might you hold off the business needs just a little more longer, to truly improve the quality of your deliverable?

The speed of business in many cases calls for new designs and solutions to be delivered long before the “Quality Assurance” process is fully complete.

We have witnessed too many times a solution implemented long before it was ready for production, for the playing field or for the customers roll out.

When was the last time you encountered someone who states: “Our servers have been overwhelmed by the response to our new “X” and we apologize for any delays.”

You see, problem-sets will be encountered on a more frequent basis and will take much longer to solve if “Quality Assurance” testing is not completed or compromised.

How trustworthy will you become with your clients or customers?

Consider these principles from “Achieving Digital Trust” by Jeffrey Ritter on page 35 and 36:

• Every transaction creating wealth first requires an affirmative decision to trust. 
• Building trust creates new wealth. Sustaining trust creates recurring wealth. 
• Achieving trust superior to your competition achieves market dominance. 
• Leadership rises (or falls) based on trust (or the absence of trust).

“Innovation Navigators” in 2023 and beyond shall study each one of these principles in their own organization.

They will utilize a proven methodology, that is centered on the science of “TrustDecisions”…

Intellectual Capital Risk: The Shamrock Organization…

What is the economic value of the Intellectual Capital(IC) in your organization? Where can you find your most valuable IC assets? Are they in the vault? Are they in the database?

Or are they sitting at the MacBook Pro at home or in the office next door? How do you know what assets are the most precious to the continuous continuity of your business?

These questions and more are at the heart of every "Shamrock" organization.

 A Three-Leaf concept originally coined by the author Charles Handy in his classic 1990 book, The Age of Unreason:

The Core
One leaf of the shamrock represents the core. These are the founders and thought leaders of the organization along with the most qualified professionals or technicians. The core is a flat hierarchy compensated purely on the results of the entire entity.

The Contractual Fringe
The second leaf is known as the contractual fringe. This is both individuals and organizations who may have their own shamrocks. These are paid for results, not for time. In fees, not wages. This leaf provides the core with intellectual assets that are essential to the organization yet are independent or even former members of the core.

The Flexible Labor Force
The third leaf of the shamrock is known as the flexible labor force. This is the flexible labor force that the core utilizes in a just-in-time talent or labor basis. Their specialized skills are tied to the intellectual assets these individuals possess to be efficient and effective for a set time period. They are treated by the core as a valuable component but realize that they will never have the commitment or the ambition of the core. They get fair pay for their contract labor.

What is Intellectual Capital?

Now with our 2021 U.S. economy changing and adapting for decades from a production-oriented economy towards a significant software driven knowledge-oriented economy, your intangible assets are becoming more and more digital. To make better products, to deliver better services or to perform better, as a company in general we need to accelerate the origination and analysis of new found knowledge and know-how.

In that perspective, we could say that our new real knowledge originates from our minds into some form of data, that has now become the key predecessor of any physical labor and financial capital.

To make your company relevant and even more valuable, you will not only need the digital data, computers, and production facilities, ...... you will also need the innovation drivers that makes your company evolve beyond your own imagination.

These “Core” innovation drivers are your “People” with their know-how and experience, your designers of internal processes to guide the business flow and also the proactive interaction with your Alliances/Partners and your key customers.

Without these “Innovation Drivers”, your company wouldn't function at all and therefore, they are of tremendous "Capital" importance. This is your real "Intellectual Capital".

The volume and speed of new “Intellectual Capital” production in your organization will determine how you will perform in an accelerating global arena of competition.

It is the difference between our success and our failure.

"No matter how good the Minimum Viable Product (MVP) or idea may be, without a consistent flow of new found Intellectual Capital, and the development of new tested prototypes, no outstanding and ground breaking results can be expected."

Now the question remains, how will you measure your organizational Intellectual Capital (IC)?

Without a way to measure it, how are you going to know what IC assets need to be managed and protected for the longevity and continuity of the business?

Where are they located? Which are most valuable? Who is the person or who are the people who own it?

People risk is one of the four major categories of Operational Risk Management.  How are you managing, measuring and protecting “Intellectual Capital” in your organization?

Enterprise Resilience: Compete or Die...

Enterprise Resilience is the road to competitiveness. It is the global answer to many of the Chief Security Officers (CSO) who have faced the troublesome battle of selling more "Fear and Doubt" to the CEO and Board of Directors.

The 34th Overseas Security Advisory Council event was held the week before Thanksgiving as usual.  Yet flashback to when Deborah Wince-Smith stood up on the stage at the 21st Annual Security Briefing at OSAC on November 16th, 2006, when her words were music to our ears:

"It is undeniable that the world has gotten more risky. Businesses now function in a global economy characterized by increasing uncertainty, complexity, connectivity and speed. Managing this rapidly changing risk landscape is an emerging competitiveness challenge—a challenge that demands resilience: the capability to survive, adapt, evolve and grow in the face of change. The Council on Competitiveness is proud to offer this report, which promotes a strategy of resilience for both the public and private sectors a strategy with clear benefits for our companies’ competitiveness and our nation’s homeland security."

On the doorstep of 2020, globalization, technological complexity, interdependence, and speed of digital information are fundamentally changing the kind of risks and competitive challenges that companies— and countries—face.

Failure, whether by attack or accident, can spread quickly and cascade across networks, borders and societies.

Increasingly, disruptions can come from unforeseen directions with unanticipated effects. Global information and transportation networks create interdependencies that magnify the impact of individual incidents. These new types of risk, demand new methods of Risk Management.

Was this a way for the Chief Security Officers of the Fortune 500 to finally shift their thinking from protection to something less macho? How could "Resilience" become a platform for a mind set shift to justify new funding?

After all, now we aren't trying to scare people into the "Low Probability - High Impact" incidents anymore and focusing in on the high probability incidents, that may have enough impact to cause a significant business disruption.

What are the incidents and areas of risk that insurance won't touch these days? If the insurance companies can write the policy to give you peace of mind, then is this necessarily an area that you can ignore, because you have transfered the risk to someone else?  Maybe not.

Being agile, ready and capable of a quick recovery is what competitiveness is all about, on the field, on stage or around the table in the Board Room. Working towards control and protection while fear builds in the back of your mind makes you stiff, depletes your energy and creates doubt.

And when you are operating a business or standing on the tee of your first sudden death hole on any PGA weekend, you better have resilience.

The business equivalent to Homeland Security and Critical Infrastructure Protection is Operational Risk Management (ORM)—a domain that many executives see as the most important emerging area of risk for their firms. Increasingly, failure to plan for operational resilience can have “bet the firm” results.

Back in 2000, the Meta Group (now owned by Gartner) did a study on the cost of "An hour of computer downtime by industry group". These numbers are now 19 years old:

INDUSTRY SECTOR (Millions)

• Energy - $2.8
• Telecommunications - $2.0
• Manufacturing - $1.6
• Financial Institutions - $1.4
• Information Technology - $1.3
• Insurance - $1.2
• Retail - $1.1
• Pharmaceuticals - $1.0
• Banking - $0.996

We all know that it costs lot of money to have any systems downtime, that's why so many dollars have been invested in Disaster Recovery (DRP) and other Business Continuity Planning (BCP).

Yet is this the kind of resilience that is going to make you more competitive, to seize more opportunities? The economics of resilience are more than investing for the likely or unlikely information systems incident (ransomware) that will attack your organization tomorrow.

The threat of Tort Liability and the loss of reputation is top of mind these days with every major global company executive. The threat is real and increasing at a faster rate than many other real operational risks to the enterprise. Litigation from regulators, class actions and competitors has given the term "Legal Risk" new emphasis and meaning.

Once corporate management understands the need for a "Resilience" mentality in place of a "Protection" mental state, a new perspective is found. Investing in the vitality, agility and competitive capabilities of the organization sounds and is more positive.

It alleviates the fear of doom and gloom and inspires new found innovation. The future of your organizations longevity and in its adaptability, can be achieved with a new perspective.

Compete or die.

"Enabling Global Enterprise Business Resilience" is just the beginning...

Performance Management: Risk on the Front Line...

As a leader in your particular organization, how often during your busy day do you think about culture.  The organizational pace.  The transparency and integrity that each key leader exemplifies, as they operate each hour with employees, partners and your most important community stakeholders.

Competent leaders who model peformance management processes to make Operational Risk Management (ORM) an enabling and growth oriented mechanism, truly understand that this requires a mind-set shift.

Executing on how to enable more risk taking and catalyst innovations to achieve superior growth, requires the ability to effectively incorporate risk management into your daily work products.

When you login to your APP, create a new document, start a new e-mail or enter new data into the database in the course of your daily work, you are playing the role of an information risk manager.  When you meet with, counsel, or coach another fellow employee, you have full control of how you are achieving new levels of trust.

The degree to which you follow protocols, procedures and training involved with corporate records management, information security and work place employment policies, creates the foundation for how much risk and trust, you will generate today.

Now think about how this, will impact your continuous ability to be innovative, competitive and productive, while building a trusted culture, that employees, partners and community stakeholders will quickly recognize as trustworthy and extraordinary:

So, what is trust?  

"Trust is the affirmative output of a disciplined, analytical decision process that measures and scores the suitability of the next actions taken by you, your team, your business, or your community. Trust is the calculation of the probability of outcomes. In every interaction with the world, you are identifying, measuring, and figuring out the likelihoods. When the results are positive, you move ahead, from here to there. When the results are negative, you rarely move ahead; you stay put or you find an alternate path."   Jeffrey Ritter- Achieving Digital Trust

Turning risk management into performance management, shall begin on the front line of the enterprise, with the ideal compensation strategy and the behaviors you are seeking from your front line customer service and field-based revenue generators.

Whether it's direct or in-direct channel personnel, you have to understand how to use the right mix of compensation and incentives, to drive a revenue risk appetite, that is appropriate for your organizaition.

Performance Management could also be enabled or supressed, by the amount of power you give your 2nd Tier leadership. Do they have the ability to make a $1M decision or just $10K decisions when it comes to investing budgeted capital into their particular business unit growth?

Do they manage risk on a field or geographic level where they are the most informed and the most knowledgeable about the business, or is the "Mother Ship" back at the home office, dictating the way they spend or the way they invest?

The ability to know how to manage operational risk, at the point of creating new information is the nexus of several disciplines and requires substantial situational awareness training.

Every minute that goes by, with derailed leadership or a negative culture, puts the enterprise at greater risk to lost performance opportunities. 

Your cultural trustworthiness depends on how effective you are as a leader, to communicate with those who you trust the most in your organization.

You need them to assist you, with perpetuating a culture that understands the relationship with operational risk and performance management simultaneously on the front line...

Business Resilience: Supply Chain Risk to National Security...

The Operational Risks associated with a major disruption is now again at the top of the Board of Directors agenda. Economic discussions inside the corporate risk management executives conference rooms, have been focused on the WEF Global Risks Report these past six months.

"The Global Risks Report 2019 is published against a backdrop of worrying geopolitical and geo-economic tensions. If unresolved, these tensions will hinder the world’s ability to deal with a growing range of collective challenges, from the mounting evidence of environmental degradation to the increasing disruptions of the Fourth Industrial Revolution."

The art of Risk Assessment and Vulnerability Management, extends far beyond the guards, gates and fire walls defending your global institutions. The risk of suppliers' "Supply Chain" disruption has grown significantly in the past few years as a result of just-in-time (JIT) inventory management.

This is further inflamed by the outsourcing momentum, as some economies continue their struggle with semiconductor trade wars or escalating natural disasters.

The implications and outcomes of a lack of effective supply chain resilience planning, can provide exposure beyond just a loss of sales. This myopic approach to effective Operational Risk Management (ORM) strategy, can extend to market share erosion and a tarnished brand image.

The risk assessment of suppliers' "Supply Chains" will not be overlooked any longer from the Board Room. More prudent audits of current supply chain exposures will take place and the corporate operations management will feel the pain for some time to come.

The independent and thorough review of the exposures to the institution are going to make some in procurement and accounting uncomfortable. The risk mitigation strategy going forward will invoke a third party review, of most supply chain strategy planning, to encompass the use of "Black Swan" scenarios and alternative thinking on the risk of volatility.

Even a survey of resilience professionals conducted by The Business Continuity Institute found that almost three quarters of supply chains had experienced significant disruption in the 12 months prior to the study.

With 28 per cent of those occurrences attributed to supplier insolvency and 20 per cent due to failure of outsource service provision, almost half of these supply chain disruptions were down to supplier or service provider failure - in other words, circumstances outside one’s own immediate control.

So how resilient is your supplier's "Supply Chain?" The security and safety of your private sector organizations supply chain is now back on the Board of Directors agenda, so how proactive is your organization?

Now think about this. What if the security and safety of your country depended upon a specialized semiconductor for an electronic component that was destined for Broadcom, Boeing, Raytheon or Cisco?

The risk of your supplier's "Supply Chain," may have significant consequences far beyond the bottom line, at the next shareholders meeting.

It could mean the difference between having a resilient economy, or even a devastating asymmetric attack on our Homeland.

Givers: The Master Plan for Grit...

"Of course, natural talent also matters, but once you have a pool of candidates above the threshold of necessary potential, grit is a major factor that predicts how close they get to achieving their potential. This is why givers focus on gritty people: it’s where givers have the greatest return on their investment, the most meaningful and lasting impact."  Grant Ph.D., Adam M.. Give and Take (p. 106). Penguin Publishing Group. Kindle Edition.

This quote is in chapter 4, Finding the Diamond in the Rough - The Fact and Fiction of Recognizing Potential.

Having passion and perseverance in any endeavor is worthwhile.  In this chapter of Adam Grant's book, he is talking about "Givers".  You will have to read the book to better understand the research of 30,000 people behind who you are and the difference between "Givers and Takers".

Flashback to your early years as a kid in elementary school.  Now think about all of the activities and endeavors your parent(s) had you involved with, in or outside the classroom.  Were you involved in the scouting or other after school activities?  What about your local church or synagogue?  Maybe your parents were even Boy or Girl Scouts themselves?  Did they achieve "Eagle" or the "Gold Award"?

Flashback to your years in Middle and High School.  Were you involved in Sports Teams or maybe the Marching Band?  Or perhaps the more academic or creative teams like "Debate" or the "Thespian Club".

What about in University or College?  Did your passion and perseverance for sports or other skill-building endeavors, keep you gaining more of what is called "Grit", a firmness of mind or spirit, unyielding courage in the face of hardship or danger.  Were you able to graduate within 4 years and then obtain a decent job or commission to start your career?

If you accomplished all of this and are now well on your way to discovering and building a life full of rewarding experiences, you probably need to say "Thank You".  To your Mother, Father, Teacher, Boy/Girl Scout Leader, Coach, Commander or Professor.  They are the ones that got you to where you are today.

Yet if someone ever calls you a "Diamond in the Rough" you should consider that a complement.

And you should also consider what they meant by that reference.  It means that they as a "Giver" who focus on gritty people, have found what they are always searching for.  They have recognized that you too are someone that stands out, that has the knowledge and the skills and that extra perseverance they are always in search of.

You may be wondering when your time will come.  When you will finally feel like you have "Made It" in life.  That you are truly happy.  Guess what, you are not there yet...

Why?

It is because you have not reached all of your potential, designed just for you.  The "Master Plan" for you is unique and you must realize that there is no visible finish line.  There are only more opportunities, tests, more challenges, significant success and substantial road blocks.

Being a "Giver" in your life means that you seek a path that puts you in pursuit of others just like you.  You know when you have found your Tribe, your calling and you know that they will be there to help you through the tough times and to persevere.

Now it is time, for you to contribute.  Your knowledge.  Your skills.  Your passion...yet do not fear asking for help.  The "Givers" in your community are searching for you now...

Godspeed!

Transparency: "Square One" in ORM...

Operational Risk Management (ORM) has been evolving for over a decade. There are new insights into why effective business process management coupled with Operational Risk architecture makes sense, through the lens of the Board of Directors. Transparency.

Still to this day, the questions remain:

• What can my organization do about the risk of loss resulting from inadequate processes, people, or systems?
• To what extent should my organization link employee compensation or job performance with operational risk management?
• How is operational risk taken into consideration when new products or technology solutions are designed or acquired, deployed, and executed?
• Does my organization have an inventory of its key business processes with documented controls and designated senior managers responsible?

Can these questions be answered in a book of 308 pages from 2008? It was a good start, to say the least. The authors understood, that to really embed a culture of (ORM) into the enterprise, you have to begin at the architecture level, the business process level.

This is far in advance of the governance of information and the business rules coded into software systems, even for such mundane corporate tasks as expense report or travel request review and sign-off.

You see, some companies still think that they are just doing fine with their Safety and Security Team, Continuity of Operations and Crisis Team, Chief Information Officer (CIO), General Counsel (GC), Chief Financial Officer (CFO) and in limited cases the Travel Risk Management department all working autonomously. They think that having a few dedicated investigators to look into corporate malfeasance, is all they require in a corporate population of tens of thousands.

What do we mean by autonomous? Not what you may think. There is no doubt that the leaders of these organizational departments are cooperating and coordinating functionally. They have each other on speed dial. They share high level red alert Intel with each other.

The question is, what is being done at the metadata level of the Operational Risk Enterprise Architecture (OREA)?

How are they designing Operational Risk Management systems to answer key questions at the speed of business? To continuously adapt to an organization’s changing global environment, executives must know about, keep in balance, and communicate several vital components:

• What are the organizational strategies (Strategic Intent) and how these should be implemented (Strategy Development and Organizational Change)
• What organizational processes are executed and why, how they are integrated, and how they contribute to the strategy of the organization (Business Process Management)
• How human resource utilization is working and whether there is optimum use of skills and resources available across processes and functions (Human Resource Management)
• To what extent the enterprise organizational chart is cognizant of appropriate roles and responsibilities, in order to effectively and efficiently carry out all work (Organization Management)
• What IT applications exist and how they interface with what processes and functions they support (IT Portfolio Management)
• How the performance of each process, each function and each individual adds up to the organization’s performance (Performance Management)
• What projects are currently underway, how they effect and impact change, what processes and IT applications they change and how this contributes to the strategy of the organization (Project & Program Management) 

Is Operational Risk Management (ORM) about "Big Data Analytics"?

Only if your organization values better transparency, governance and regulatory compliance. Ask the Board of Directors their answer on this question to determine whether ORM is a "Big Data Analytics" issue. How big is big?

The momentum for transparency is now at the U.S. government level of commitment.   It is the law. Big Data Analytics will mean nothing, without increased transparency. Now we can ask the questions that we all want answers to.

The Operational Risk Management (ORM) architecture of your enterprise will now begin with transparency, as the fundamental "Square One".

Risk Parity: Ideal Organizational Design...

Organizations across the globe are operating each day with Operational Risks. As a result, management is doing their best to implement a combination of Operational Risk Management (ORM) capabilities.

The strategy is to manage risk to the enterprise through a series of controls and modification of human behavior. Is it possible to create the most ideal organization from the start? Could you design it with the lowest possible Operational Risk exposure at every physical, process, virtual and human component?

What do we mean by this? Lets play a game. Or more importantly, lets imagine a workplace exercise to design the ideal professional services organization in one hour:

This organization will be in the private sector. The fictitious name for the organization is "Improvise, Inc." All of the legal entities have been created and it is registered as a U.S. Delaware company. It will have the following characteristics, capabilities, assets and purpose:

200 humans with advanced education between 25 and 65 years old. 50% Men & 50% Women
Global reach of professional services. (It sells intellectual capital and information)
Office hubs are physically located across four locations: Denver, Zurich, Abu Dhabi, and Singapore.
Language expertise includes English, German, French, Italian, Arabic and Mandarin.

Subject Matter Expertise of the Improvise associates is diversified. The core staff devoted to operational administrative processes is also diversified by physical location, 4 people each. Therefore, less than 10% core overhead.

Improvise, Inc. generates revenues by selling information, advisory services and subject matter expertise. The diversity of it's 200 humans and their Intellectual Capital provides professional services to Fortune Global 500 companies.

Now, to start the exercise you will have one hour to design the ideal mosaic of people, processes, systems and external factors to operate Improvise, Inc. on a daily basis. Begin.

How would you begin designing the ideal organization? Will you have a headquarters location? Will the offices have four leased corporate offices or utilize a virtual / shared space model? What will the facilities layout be with single offices, cubicles, conference rooms? Would you start with human resources and the hiring and selection process? What kind of systems and tools would you procure to issue to your new associates? How would you communicate and what vendor/providers will Improvise use outside its core? What organizational "Rule-sets" will be established?

Who will govern and what roles of power and influence will these employee-owners (Associates) have to make decisions for the good of Improvise? What countries across the globe will you dispatch your associates to do their work? How will you keep them safe and secure where and how they travel? What vendors and service providers will you contract with to provide digital communications and store your valuable intellectual property?

Will you locate your Associates across the four locations equally? Since you have 200 split into 100 men and 100 women, will you have 25 of each or 50 people in each office? Will they all be citizens of that native country only? Again, we are designing the ideal organization with Operational Risk Management (ORM), as our highest priority in the design. Is this even a valid consideration?

What about the use of digital assets? Will your associates at Improvise use PC or Mac, both? Microsoft or Linux-based? Android or iOS? Anti-virus scans daily or monthly. VPN, yes or no. Public or Private cloud? Encrypt data to remote sites? Retention and privacy policy? What happens when an associate goes home? When they leave the organization? Is there an "Acceptable Use" policy in place? And the list goes on.

Will Improvise standardize on a single travel agency, airline or hotel chain? What kind of training will occur with your associates on international customs, cultures, threats and vulnerabilities. Who will be accompanied by a buddy system or personal protection specialist when they travel? Will travelers receive intelligence briefings or reports in advance of their departure? Commercial or private carrier?

What processes are to be put in place for Improvise to follow, in the way it sells and delivers it's professional services? What autonomy does each associate have to make their own decisions on the price, scope and deliverable to a client? How do you interact, treat and question yourselves? Are your associates subject to any laws from the U.S. or the country they are operating in with regard to selling your professional services? Why are we doing all of this?

So when you are done with this first phase of the exercise after one hour, how could you improve Improvise, Inc. over your lifetime? Hopefully, this illustrates the breadth and depth of Operational Risk Management (ORM) and some of the key considerations. Your single points of potential failure. Your risk exposures and places to focus your design. Your decisions and how this shapes your culture and principles. Your trust and transparency.

One last thought. How would you currently judge your risk parity? In other words, how have you allocated risk effectively across the organization. Not in terms of assets, but in terms of volatility. Think about it. What kind of social contract do you have in place to operate together?

Is it true, that you are now on your way to achieving true "Business Resilience"...

Innovation: Investing in the Linchpins...

There are new innovation initiatives that have been launched across America and internationally over the past few years.  Each has a vertical or horizontal focus to attract a particular set of entrepreneurs, coders, researchers and founders or data scientists.

You may have seen the accelerators, the incubators, training boot camps or even the H4D class being offered in your particular U.S. city or university lately.  Behind these initiatives are leaders, executives and fellow startup founders/practitioners who have developed a combination of methodologies and strategies, to produce new products and problem-solving business platforms.

After several years of practicing and mentoring in this category and recently devoting 30+ hours of first hand observation, there are several insights that were discovered.

First off, the quality and experience of instructors, mentors and the support ecosystem is vital.  You must create a robust program to recruit, train and continuously facilitate the actual people who surround the accelerator, incubator or university class and are devoting their time and resources to volunteer.

The ecosystem itself requires tested and proven processes, business rules and significant buy-in by all contributors.  The volunteers need a set of program prerequisites, a framework and the coaching along the way, to make their experience just as valuable as the participants in the innovation entities program.  Many of the mature innovation programs do this already.

Second, the founders, subject matter experts, linchpins, content providers or problem-set sponsors should have their own meetings and live interactions before and after each iteration of the participants program.  As an example, if the incubator has a cohort that is in-residence over the course of 10 weeks, on Tuesday's from 4:30-7:30PM, then the volunteers should meet for 30 minutes before and 30 minutes afterwards.

Why?

During those 3 hours there are plenty of live interactions, new learning, comments and ideas generated with the actual program participants.  It is just as valuable for the volunteers to share and interact after each iteration or cohort meeting to prepare and to debrief.  Certainly some of the follow-up learning could be captured using Slack or other online tools, yet having those linchpins face-to-face and interacting live is ever so valuable.

So What?

The maturity of the systems and processes associated with the innovation initiative, will be a key factor in the long term success and longevity of a particular program.  Yet even a set of solid systems can be influenced and characterized simply by the combination and quality of people, who are interacting and supporting these systems.  The parallel effort and devotion of one-to-one development, training and post program-metrics of these instructors, mentors, problem-sponsors and facilities or resources donors is paramount.

If you are an innovation engine producing new entrepreneurs and business startups that utilizes an ecosystem of volunteers, your future success will be directly linked to these vital linchpins...

Inspired Outcomes: A Culture of Why...

Why does your organization exist?  Most people answer this question with the kinds of products or services provided.  This is "What you do".  Some people talk about how they provide the service or how the product works.  This is "How you do it".  This does not answer the question.

Most organizations have it backwards.  What >> How >> Why.  Now think, Why >> How >> What.

Why your organization exists, is paramount to understanding the real purpose and DNA of your culture.  It is vital to the people who show up every day, the core reason they perform their role or contribute to the measurable outcomes of the team.  True Operational Risk Management (ORM) professionals discover the "Why" at the beginning.  Without the truth behind "The Why", nothing after it, has enough context.

When you begin the journey to build a better product, or invent a new process you better know the answer to "Why".  Discovering this first, will provide the inspiration, the creativity and the fortitude to get you and your team out of bed the next day, to do it all over again.  Without the "Why", we as humans lose sight of our destined purpose.

Over seven years ago, Simon Sinek was advocating for "Why" in his book and on Ted Talks.  A few years later, he was helping the Air Force hone new leadership skills in it's pilots:

"I told the guys, it's not enough any more to be ace of the base," said Col. Richard "Tex" Coe, commandant of the United States Air Force Weapons School. "We have to bring others with us.

Coe believes the school's new leadership curriculum will translate to success in the global war on terrorism, particularly in the fight in Afghanistan.

"What we're going to be doing is purposely developing these innovative and creative leaders that will go out there and face problems," Coe said.
"We don't even know our problems yet, and we'll be able to put our pieces together and use resources and other people around us to get the mission accomplished."

Coe, a master navigator with more than 3,000 flight hours including 460 combat hours, left Afghanistan in 2002. Today, the country "is a new and different place" he said.

"It's a completely different problem than it was back then. It's ever changing, and we're preparing them for that ever-changing problem."

"What we believe" is not the same as "Why We Exist".  It is different and it could mean the difference to owners, employees, partners and external customers or clients.  Here is just one example from Palantir:

Why
We’re Here

"We believe in augmenting human intelligence, not replacing it.

With good data and the right technology, people and institutions today can still solve hard problems and change the world for the better."

How could you make this even more compelling?  More inspiring and motivating, so that you want to jump out of bed each day at the sound of the morning alarm.

Behind every process, product and service there are humans who must see, feel and smell the "Why".  If and when they do, now they are ready to endure the journey, the quest and the challenges ahead.  They are there for a purpose they can internalize and outcomes that they can pursue vigorously, each day.

Discover the "Why" from your clients and customers, if you have not already done so.  Understand deeply the reason why they are doing business with you.  You may be surprised to know that your clients are paying you more than your competitors, for the same product or service.  You may soon find out the real value of "Trust."

Making the "Decision to Trust" one product or service over another, can not be under estimated.  Yet so many organizations and companies fail to find the truth about "Why" in their ecosystems of followers.  Is it the location, the price, the ease of use, the color, the feel, the endurance, the speed, the intelligence?

Once you have discovered the truth on "Why", you must know "How".  Then the "What" will follow, with the name of your product or brand.  Isn't it interesting that when you are attending a networking or convention event, that when you meet someone new, they may ask:  "What do you do?"

What if you answered the question like this.  "I work with "X" and we exist to "Y".  The cause and reason for your organizations existence transcends everything.  It provides the foundation for why this person is going to trust you and your organization.  Now if they would only start the conversation with:  "Why does your organization exist?"

Once you have a solid foundation for "Why", then you must know "The How" and then "The What".  Here is another example:

SpaceX designs, manufactures and launches advanced rockets and spacecraft. The company was founded in 2002 to revolutionize space technology, with the ultimate goal of enabling people to live on other planets.

Or how about:

"SpaceX exists to enable people to live on other planets.  We manufacture rockets and launch them so that our customers can supply other spacecraft or travel to other destinations beyond Earth."

Now think about your organization.  Take a deep look at your culture.  What is the fuel that will propel it into the future to achieve extraordinary outcomes?  Exponential results...

Scrutiny: The Noun Missing From Your Culture...

The culture of your business or organization will continue to be the root cause of many of your most substantial successes.  Simultaneously, it will be one of the most significant factors in your potential downfall as a company.  Operational Risk Management (ORM) professionals at Wells Fargo and Booz Allen Hamilton, are still dissecting all of the evidence of their respective events.

"Managing Risk to Ensure Intelligence Advantage" is a theme that you may not have heard before, unless you are in the Intelligence Community.  There is one key principle that is worth emphasizing again at this point in time:

Ensure all work is subject to scrutiny.  Require conflict of interest-free peer review for all programs, projects and strategies.

This principle, that shall become pervasive across the culture of the organization, is imperative for several reasons.  The first is, that a culture really is a manifestation of the people and the behaviors that are normal in the organization.  The second is, that the culture shall strive to be a true mosaic of the best thinking and ideas from all the key stakeholders in the enterprise.  Not just one or two people from the top or a singular department.

Putting scrutiny to your work by others to review, is the beginning of new found discovery and transparency insight.  It is the foundation for building a more trusted operating environment, with as little bias as you can possibly have in a culture.  When an organization spins of out of control and becomes the latest case study on an Operational Risk failure event, you must learn from it.  Wells Fargo is just one recent example:

Some consumers may be shying away from Wells Fargo after learning that employees used customers’ information to open sham accounts, according to new figures reported by the bank.

The nation’s largest retail bank beat expectations when it reported more than $5.6 billion in profit for the past three months. But the bank’s earnings report also hinted that the Wells Fargo may have some trouble convincing people to open new accounts in the wake of the scandal.

The number of checking accounts the bank opened in September fell by 25 percent from the same time last year, the company reported Friday. Credit card applications filed during the month dropped by 20 percent from a year ago. And the number of visits customers had with branch bankers also fell by 10 percent from last year.  Washington Post

Whether you are in the international banking and finance business, the defense industrial base or any other set of critical infrastructure institutions that public citizens are counting on, there is no room for a runaway culture.  Consider this definition:

scrutiny

noun, plural scrutinies.

1. a searching examination or investigation; minute inquiry.

2. surveillance; close and continuous watching or guarding.

3. a close and searching look.

You see, the integrity and longevity of your "Trust Decisions" begins with the sharing of relevant information.  Sharing that information with your most trusted and significant partners is the start. The beginning of a dialogue with people in your culture who continuously review the information, the new strategy. This begins the ongoing process. It is now time for others to look at your idea, your strategy, your policy rule, from their perspective. From their knowledge-base. To scrutinize it. To analyze it. To make sense of it for them and those affected by it.

The truth is, you don't have all the understanding and you don't have all of the ecosystem knowledge. You don't have the entire data set, to know if the specific work you have been doing is sound and correct. That the new work you have designed, is culturally and morally acceptable. That the outcomes of your project will produce the results imagined. That the strategy and the work, is the right thing to do at this point in time.

So how do you change? It begins with your next management meeting and beyond. If you are the leader, the manager, the director, the Vice-President or the CxO start now. Ask for scrutiny on your proposed strategy. Gain new insight and understanding. Ask for feedback and changes to make it better. Your power in the culture and its impact is your greatest weakness. Your people will follow you, unless you challenge them to think differently...

November 11: Serving the United States by the Other 99%...

“As we express our gratitude,
we must never forget that the highest
appreciation is not to utter words,
but to live by them”
-John F. Kennedy-

The United States Veterans Day National Ceremony is held each year on November 11th at Arlington National Cemetery . The ceremony commences precisely at 11:00 a.m. with a wreath laying at the Tomb of the Unknowns and continues inside the Memorial Amphitheater with a parade of colors by veterans' organizations and remarks from dignitaries. The ceremony is intended to honor and thank all who served in the United States Armed Forces. This represents less than 1% of Americans.

How many Soldiers will be on active duty around the globe on Wednesday, November 11 working in their current role, task or assignment, to keep America safe and secure?  So those of us who call the United States their home, may exercise their freedoms and the citizens rights that our nations architects designed for us.

How may Airman will be walking the streets in parades remembering their flights over the Pacific, Vietnam, the Atlantic, Europe, South America, North Africa or the Middle East?  What about all those pilots that have flown at such a high altitude; never to be detected over Russia, North Korea or China?

How many Sailors and Marines will be cruising on, over or under our vast oceans to be present and ready, for our next mission to help others?  How many Submariners will never be detected on their 24 x 7 watch; or with SOF waiting patiently below deck for their next clandestine operation, anywhere in the world?

So on Wednesday, November 11 what will you be doing, John or Mary Citizen, in Anytown U.S.A.?

For some Veterans who experience this day of recognition, it is not easy.  It could be a day that is simultaneously bitter sweet.  There is certainly great pride, yet some within the 1% who are Veterans, look around the country and wonder why the other 99% are not serving their nation, in their full capacity as a U.S. citizen.

Service to your nation doesn't begin or end with a job in the military.  Service to your nation begins for everybody who becomes an American.  What does that mean?

It means that we stand up and believe in the U.S. Constitution.  We defend and negotiate all that it says and what it enables for us to accomplish for ourselves, our families and our fellow believers.  You see, the freedoms and the opportunity to prosper in the United States is there for anybody to grasp.  For anybody to achieve.

To honor and thank those who have served in the Military on Veterans Day, requires so much more:

• Will you "sleep in" on your day off or volunteer with the local church or non-profit to teach Veterans how to be more effective in the transition to a civilian private sector job?
• Will you design and code the next iPhone App to locate other Vets in your local town or city to assist each other and your community?
• Will you meet with local business owners to plan, raise funds and deploy vital programs for families of Veterans?
• Will you vote to fund and allocate adequate resources for the operations necessary and requested, by those forward deployed on the front lines, in uniform and also in the shadows?

The opportunities to serve our country and all of our Veterans November 11, requires a continuous cycle of thinking beyond just the Soldier, Airman, Sailor or Marine.  It also requires more proof, that a majority of the other 99%, are also serving their country and all that the United States stands for in the world.

Culture Risk: Charting a Course for Achieving the Mission...

"It's more fun to be a pirate than to join the Navy" - Steve Jobs

Think about the culture your organization has created, from inception to present day.  What is it about the current state, that draws the kind of new people to want to get on board?  Do you have people lining up behind the recruiting table, to join the Navy or to be a Pirate?

Competition for new talent and fresh perspectives, requires the continuous pursuit of new people to join the firm, company or government agency.  It's already a historical fact, on how many applications Apple or Google receives for every job opening.  Yet other companies are struggling to find anyone to fill the ranks of the new project teams they seek.

As these new recruits come through the doors of the organization, are they ready to work within the rules of the pirate ship or learn a more proven, consistent environment of certainty and longevity? Certainly you can sense what kind of ship you are on right now.  Will your company be around in 2 years or 5 years?  How will you sustain the mission and vision you set out to accomplish?

As you embark on your next voyage with an organization, you can bet that what you see early on, is what you will get for months and years to come.  What is it about the cultural environment and the way people behave within the enterprise that is so appealing to you?  Is it the product, the service or the purpose that gets you out of bed each day, to do the job and accomplish your tasks for the greater benefit of the team?

Enthusiasm is contagious and people who are "Waving the Flag" for their group, team or organization has a tendency to get others attention and it becomes viral.  They start to wonder why there is so much energy and so many people trying to join up and participate.  The "Crowd Effect" is a known marketing strategy that has worked in advertising for decades.

And then there is another strategy that might be counter intuitive and for good reason.  The opposite might be found in slogans such as "Only a Few Good Men" or an "elite community of professionals". Many may want to join, but only the best and the most resilient will achieve the goal of becoming part of the team.

What is it, that is the same about these two kinds of organizations?  Analyze the elements of what makes them both similar and how they are able to persist over time and you will begin to see, what really matters in effectiveness of organizational design and cultural development.  You will begin to understand the essential factors to enhance in order to achieve a long lasting and perpetual enterprise. Here are a few words that would describe and define both environments:

• Trust
• Innovation
• Adaptive
• Continuous Learning
• Empathy
• Belief

The factors you search for with your next organization, company or project team might have some or all of these attributes.  It is up to you to determine what is in your best interest long term, whether to be a pirate or join the Navy.  Once you have made the decision, it will forever define you and shape the way you think, act and behave for much of the rest of your life.

As an Operational Risk Management (ORM) professional, first it is your job to figure out what kind of ship you are on.  Second, it is your job to make sure that the Captain achieves their destination, today, tomorrow or next week.  Finally, you must decide if the ship you are on and the Captain both, will help you fulfill your life long goals and aspirations.

Now, think about your current cultural environment.  What is your organizational course?  Who is commanding the ship?  Are you ready for the next mission with your team?  Why?

Now you are well on your way to having a more clear picture of your destiny and contributing to achieving success of your next mission...

Trusting Women: The Future of Irregular Warfare...

The economic engine of successful countries and the single family household, is typically the result of a dedicated and conscientious woman.  If your organization is planning to be more resilient and capable of continued growth, then make sure you have women in the most strategic Operational Risk Management (ORM) roles possible.

You may already understand why and there is continuing evidence that men, are just not the ideal person to be in certain positions of decision-making and other skilled business professions of the future.  The stories and the examples flow from the most clandestine and remote regions of Africa, to the valley associated with Silicon.

Women are now breaking through new barriers in all types of roles and in places that traditionally they have been forbidden.  Here is just one example of a trend to grow rapidly from Dan Lamothe at the Washington Post:

Only the swamps of Florida stand between two female soldiers becoming the first women to ever graduate from the Army’s famously difficult Ranger School.  The women have completed the school’s Mountain Phase, and will move on to the third and final phase of training, Army officials said Friday.

The women are attending for the first time as part of an ongoing assessment by the military about how it should better integrate women into combat roles in the military. It follows a 2013 decision by Pentagon leaders to open all jobs in the military to women by 2016.

When you really think about what the future roles of the new 21st Century Army and the trends of our asymmetric threats, are not women our best strategic weapon?  Irregular warfare will be dominating most days of our human conflicts into the future and women are well equipped to be the leaders of this trend.

Yes, there is evidence that earning the "Ranger Tab" requires physical stamina.  Simultaneously, the elite Army course requires superior problem-solving skills and adaptive intuition involving teamwork, where women excel.  Now you are starting to see why, it is vital to have women on any high-performance team, whether in the Hindu Kush or on the Internet front lines of "Achieving Digital Trust" with the next generation of our youngest knowledge workers.

Irregular warfare is warfare in which one or more combatants are irregular military rather than regular forces. Guerrilla warfare is a form of irregular warfare, and so is asymmetric warfare.  Irregular warfare favors indirect and asymmetric warfare approaches, though it may employ the full range of military and other capabilities, in order to erode the adversary’s power, influence, and will. It is inherently a protracted struggle that will test the resolve of a state and its strategic partners.^{[1][2][3][4][5]} Concepts associated with irregular warfare are older than the term itself.^[6][7]

As the future conflicts evolve into our pervasive digital domains and require the collection and analysis of relevant information on the front lines, women are the strategic choice.  History tells us clearly, that this is the case.  It is this kind of intellect and patience for building and sustaining relationships, that so many policy makers have recognized, across both public and private sector operations.

So who is just one good example?  Our future strategy must include the development of armies of women with the skills and talents of leaders like Sheryl Sandberg:

Sheryl Kara Sandberg (/ˈsændbərɡ/; born August 28, 1969)^[3] is an American technology executive, activist, and author. She is the Chief Operating Officer of Facebook. In June 2012, she was elected to the board of directors by the existing board members,^[4] becoming the first woman to serve on Facebook's board. Before she joined Facebook as its COO, Sandberg was Vice President of Global Online Sales and Operations at Google and was involved in launching Google's philanthropic arm Google.org. Before Google, Sandberg served as chief of staff for the United States Secretary of the Treasury.

You see, the Fortune 500 is now starting to wake up, to the reality of the current state of corporate "Irregular Warfare".  The ability to erode the competitions power, influence and will, is just the beginning of the conversation in creating reliable and growing shareholder value.  When you really start to evaluate the entire success of the Silicon Valley ecosystem or even the future economic engines of unknown villages across our globe, you begin to realize how it is driven and continuously being improved, by the skills and superiority of women.

So what is just one good example?  Our future strategy must include the development of armies of women with the strategic foresight of Opportunity International:

Opportunity International Trust Groups help entrepreneurs break free from the limitations of poverty by promoting solidarity and maintaining accountability.  Trust Groups consist of 10-30 entrepreneurs, mostly women, who meet once a week to share personal and business advice, receive financial training, and vote on loan-related topics.  Trust Groups build a safety net by guaranteeing each other’s loans -- if one member defaults on a weekly payment, everyone else must cover the costs.  This method has led to a loan repayment rate of 98%.

Vicki Escarra joined Opportunity International in 2012 as US CEO. Previously she has led several major initiatives to create a long-term strategic plan, rebrand the organization, streamline operations and increase global fundraising by 30 percent in 2013 to expand the organization’s work around the world. Before joining Opportunity International, Escarra spent six years as president and chief executive officer of Feeding America, the nation’s largest domestic hunger relief organization. Prior to Feeding America, Escarra spent nearly 30 years at Delta Air Lines Inc., where she rose to chief marketing officer. As one of the highest-ranking women in the aviation industry at the time, she oversaw $15 billion in revenue and led a workforce of 52,000.

When you hear a woman like Vicki, Sheryl (or Cheryl) talk about providing our organizations large and small with the training, education and the "Trust Decisions" to create and sustain growth, you can only imagine what is really possible.  If you have ever had the lucky chance to work with a woman like these three for months or decades, you understand the multitude of advantages.  You understand the reasons, why having women on every high performance team is imperative.  You can see their outstanding results.

C²: Continuous Continuity in the Enterprise...

Many enterprises today understand the myriad of potential threats to its people, processes, systems and structures. It stands to be better equipped for sustained continuity.  Business Crisis and Continuity Management (BCCM) is a dynamic change management initiative that requires dedicated resources, funding and auditing.

Certainly the largest organizations realize that the risks are taking on different forms than the standard fire, flood, earthquake and hurricane/twister scenarios. These large catastrophic external loss events have been insured against and the premiums are substantial. What is less easy to analyze from a threat perspective, are the constantly changing landscapes and continuity postures of the many facets of the organization having to do with people, processes and systems.

The sources of significant loss events are changing as we speak. Here are a few that should not be overlooked in your Operational Risk Management (ORM) Programs:

· Public perception

· Unethical dealings

· Regulatory or civil action

· Failure to respond to market changes

· Failure to control industrial espionage

· Failure to take account of widespread disease or illness among the workforce

· Fraud

· Exploitation of the 3rd party suppliers

· Failure to establish a positive culture

· Failure in post employment process to quarantine information assets upon termination of employees

Frankly, corporate directors have their hands full, helping executives managing risk and continuity on behalf of the shareholders. The risk management process will someday have as big an impact on the enterprise, as other key functions because shareholders will be asking more questions about the changing landscape of managing risk for corporate governance.

Since effective BCCM analysis is a 24/7 operation, it takes a combination of factors across the organization to provide what one might call C², or “Continuous Continuity”. A one-time threat or risk assessment or even an annual look at what has changed across the enterprise is opening the door for a Board of Directors worst nightmare. These nightmares are “Loss Events” that could have been prevented or mitigated all together.

Most of the best practices talk about a BCCM plan that will be periodically updated. Periodic is not continuous. Change is the key factor here. What changes take place in your organization between these periodic updates? How could any organization accurately account for all the changes to the organization in between BCCM updates? The fact is that they can’t.

This will change over time as organizations figure out that this is now as vital a business component as Accounts Receivable. The BCCM will become a core process of the organization if it is not already, dynamically evolving by the minute as new change-based factors take place in the enterprise. As new or terminated employees, suppliers and partners come and go into the BCCM process, the threat profile is updated in real-time. This takes the operational management that much closer to C², or “Continuous Continuity”.

So what? Boards of Directors have the responsibility to insure the resiliency of the organization. The people, processes, systems and external events that are constantly changing the operational risk landscape become the greatest threat to an enterprise. It’s the shareholders duty to scrutinize which organizations are most adept at “Continuous Continuity” before they invest in their future.

Veterans Day 2014: Leading the Enterprise to Victory...

The 1% are soon to be recognized on Tuesday, November 11, Veterans Day.  CxO's across the country who have served in the military know all about "Operational Risk Management" (ORM). They understand that the safety and security of their personnel is paramount, if they are to achieve the mission assigned to them by the Board of Directors and the majority stakeholders.

It makes sense that if only 1% of the country serve in the military, and fewer make it to the rank of CxO in commercial industry, why ORM remains so esoteric.  Only an enlightened few truly understand the value of investing in continuous training, cultural and ethical development and the safety and security of not only employees, but also intellectual capital and information assets.

Indeed, this Veterans Day is a time to focus on our 1%.  Those who have served the United States of America in the Armed Forces.  At the top of each of these branches including the Army, Marine Corps, Navy, Air Force and Coast Guard are people that have seen, smelled, heard, felt and lived with the logic and the necessity for Operational Risk Management.  Why is the Navy leadership focused on ORM?

ORM is the guiding Navy instruction for implementing the ORM program. The naval vision is to develop an environment in which every individual (officer, enlisted and civilian) is trained and motivated to personally manage risk in everything they do on and off duty, both in peacetime and during conflict, thus enabling successful completion of all operations or activities with the minimum amount of risk. 

The most common idea of what ORM revolves around is a simple five-step process that is most frequently used in planning. These five steps are:

• Identify hazards

• Assess the hazards

• Make risk decisions

• Implement controls

• Supervise and watch for change

Another level of ORM is Time Critical Risk Management which involves a quick, committed-to-memory process and a set of skills that allow our people to manage risk when in the execution of a plan or event. The standard for the Navy is being developed, however it might be thought of in simple terms such as:

• What can go wrong or is changing

• How can I keep it from effecting the mission without hurting me

• Act to correct the situation

• Telling the right people if you are unable to take the right action

If you were retired from the Marine Corps and now the CxO of a Global 500 company, do you think that ORM would be a forgotten system?  Would you neglect to focus on this, if you were running FedEx?  Fred Smith is not a former pilot, but was vital as a "Forward Air Controller":

Frederick Wallace "Fred" Smith (born August 11, 1944), is the founder, chairman, president, and CEO of FedEx, originally known as Federal Express, the first overnight express delivery company in the world, and the largest in the world. The company is headquartered in Memphis, Tennessee. 

Smith was commissioned in the U.S. Marine Corps, serving for three years (from 1966 to 1969) as a platoon leader and a forward air controller (FAC), flying in the back seat of the OV-10. 

As a Marine, Smith had the opportunity to observe the military's logistics system first hand. He served two tours of duty in Vietnam, flying with pilots on over 200 combat missions. He was honorably discharged in 1969 with the rank of Captain, having received the Silver Star, the Bronze Star, and two Purple Hearts. While in the military, Smith carefully observed the procurement and delivery procedures, fine-tuning his dream for an overnight delivery service.[5] 

A primary function of a Forward Air Controller is ensuring the safety of friendly troops. Enemy targets in the Front line ("Forward Edge of the Battle Area" in US terminology) are often close to friendly forces and therefore friendly forces are at risk of friendly fire through proximity during air attack. The danger is twofold: the bombing pilot cannot identify the target clearly, and is not aware of the locations of friendly forces.

Fred Smith not only implemented the mindset of a "Forward Air Controller" running FedEx, he also has been able to build a culture focused on Operational Risk Management (ORM).

FedEx Corporation will produce superior financial returns for its shareowners by providing high value-added logistics, transportation and related business services through focused operating companies. Customer requirements will be met in the highest quality manner appropriate to each market segment served. FedEx will strive to develop mutually rewarding relationships with its employees, partners and suppliers. Safety will be the first consideration in all operations. Corporate activities will be conducted to the highest ethical and professional standards.

Now back to Veterans Day, November 11.  Are you starting to make the connection between the 1%, becoming a global CxO and the reason why ORM has such tremendous applications inside the global enterprise?

The opportunity now is for us to unleash our emerging and proactive "Vetrepreneurs," to take their years of knowledge and understanding of ORM and now apply it within the ranks of their new companies or new positions, just as Fred Smith has done at FedEx.  These veterans have the practical knowledge, skills and valuable use cases on how Operational Risk Management contributes to the overall mission.

If you are a 1% entrepreneur (Vetrepreneur) and have Co-founder or CxO as your title, then your proactive nature should allow you the opportunity to apply ORM within your organization.  Here are three places you can begin your program focus:

Inside:  Develop a culture of trust that begins by teaching employees how to find the truth.  A culture that promotes and teaches people how to apply the rules to the business that you are operating in.  A culture where no one can hide and that understanding our own vulnerabilities makes the overall organization more resilient each day.

Outside:  Architect the enterprise from the ground up to make more informed "Trust Decisions."  The architecture must first assemble and organize the rule-base and contextual framework associated with the environment that you will be operating in both physically and virtually.  The interdependencies of the automated machines developed to operate the enterprise, shall exist in a transparent and highly governed "system-of- systems". 

In-The-Middle:  Create new learning scenarios on a consistent but random basis.  Test the enterprise Inside and Outside with these exercise scenarios.  Determine how the humans and/or machines behave.  Establish what is normal and create your baseline. Continue to test and to measure the gaps of performance and make changes to improve the quality, accuracy or resiliency of the entire enterprise architecture.

On this Veterans Day 2014, scan the horizon for the organizations that stand out and are remarkable. With the 1% at the helm, in the cockpit or now the HQ Board Room, Operational Risk Management (ORM) is leading the enterprise to victory!

NewCo: Operational Risk Accelerators...

Operational Risk Management (ORM) is an essential component of any serious business.  These are the internal risks you take when you add people, processes and systems together and then operate in a specific industry or geography.  Innovation within the ranks of a new breed of business accelerator, has the opportunity to include "Operational Risk Strategy Execution" as a vital mechanism for the growth of the new born company.

Do you know about a start-up company that is building a product or solution to address one of these Operational Risk categories?  The following lists the official Basel II defined seven event types with some examples for each category:

1. Internal Fraud - misappropriation of assets, tax evasion, intentional mismarking of positions, bribery
2. External Fraud - theft of information, hacking damage, third-party theft and forgery
3. Employment Practices and Workplace Safety - discrimination, workers compensation, employee health and safety
4. Clients, Products, and Business Practice - market manipulation, antitrust, improper trade, product defects, fiduciary breaches, account churning
5. Damage to Physical Assets - natural disasters, terrorism, vandalism
6. Business Disruption and Systems Failures - utility disruptions, software failures, hardware failures
7. Execution, Delivery, and Process Management - data entry errors, accounting errors, failed mandatory reporting, negligent loss of client assets

The start-up phenomenon has taken many metro areas around the United States by surprise.  The typical centers of innovation in Seattle, San Francisco, Los Angeles, Austin, Boston and Washington, DC are now being joined by newcomers such as Cincinnati:

The entrepreneurial world is not an easy one to take on, but for those brave enough to do so, Cintrifuse is here to help. Located in the heart of downtown Cincinnati, Ohio, Cintrifuse acts as a connecter and supporter to create a global destination for entrepreneurial success. 

Cintrifuse connects the region’s high-potential, venture-backable startups to advice, talent, funding, and customers. With over 30 ecosystem partners, 30+ participating local corporations, 75+ mentors and advisors, Cintrifuse leverages the power of its network to serve over 100 startup members and improve their chances of success. 

To amplify the efforts and extend the reach of the entrepreneurial community, Cintrifuse operates a $56MM Fund of Funds, which invests in early-stage venture capital funds both regionally and nationally. The Fund of Funds provides an avenue for corporations and venture capitalists alike to gain further insights into and engagement with the Cincinnati startup community. 

Cintrifuse’s efforts are made possible through support from some of Cincinnati’s most prominent companies. 

To connect more than 100 startups with venture capital firms, corporations and service providers, Cintrifuse uses a proven membership model. Entrepreneurs gain access to like-minded, driven and engaged individuals, venture capitalists, business leaders and services providers are introduced to startups on the rise.  Grow your business with Cintrifuse by signing up for membership today.

As the focus on innovation continues and NewCo's are being formed across the country, these new entrepreneurs need a foundation in truly understanding "Operational Risk Management". Why?

If these new entrepreneurs are better able to understand the core reasons why a business must operate within a universe of Operational Risks, then their innovation may adapt.  The ideas they have for better managing cyber security, detecting the insider threat or automating the continuity of operations planning may change.

Building a new company with an innovative new product also means understanding the problem sets that a much larger enterprise is encountering on a daily basis.  Innovators today sometimes lose sight of the operational risks that can be addressed by their products, as they are installed and implemented into the larger enterprise.  The value proposition that addresses the decrease in loss events, will soon get the attention of senior management.

What can a business accelerator like "Cintrifuse" do to make sure that the 100+ new start-ups better understand Operational Risk Management?  Perhaps even more importantly, how can their hot new NewCo product fit into the ORM matrix for addressing Enterprise Risk at a Fortune 500 company?

To answer this, just look more deeply at the 75+ mentors and advisors that Cintrifuse has at their disposal.  Has Cintrifuse developed a diagnostic tool to better understand the subject matter expertise of each of those mentors?

• First,  create an inventory of the skill sets and knowledge of these mentors and develop a database for the start-up entrepreneurs, then they can query who is the best mentor for a specific subject or business problem they are encountering.
• Second, the mentors themselves would need an orientation on how to assist the start-ups in seeing the nexus with operational risk in their own business model.
• Third, the mentors would demonstrate how the innovations that the enterprise requires have a nexus with the start-ups products being developed for the mass market.

Remember, ORM is the oversight of operational risk, including the risk of loss resulting from inadequate or failed internal processes and systems; human factors; or external events.

When you scan the companies being accepted and graduated from all of the incubators and accelerators across the globe, many will have a product solution that impacts some facet of Operational Risk Management.  The mission now is to make sure that those new entrepreneurs discover how their inventions and patents may address real-world scenarios.  Just look at the current cohort companies at the MACH37 Accelerator in Herndon, Va as one example:

iAspire 
Eric Whittleton, Cofounder and CEO
Arash Nejadian, Cofounder and CTO 
iAspire is currently addressing the significant pent up demand for fully implemented email encryption in large enterprises by enabling end-to-end encryption that also addresses the need for real-time and in-volume secure email access for forensics, e-Discovery and compliance requirements. Aspire develops standards-based digital key management products that serve as material enablers of the “Trusted Web”. Future products will include additional store and forward applications such as a cloud-based Secure Drop-box as well as mobility solutions.

Virgil Security
Michael W. Wellman Cofounder and CEO
Dmitry Dain, Cofounder and CTO 
Virgil Security provides easy-to-deploy and easy-to-use cryptographic software and services for use by developers and end-users. Virgil Security’s encryption libraries and services, along with an accompanying public key management infrastructure, ease the pain of developing, deploying, and using strong cryptography. Virgil Security enables a new generation of enhanced privacy and security for applications, cloud services, and the Internet of Things.

FireDrillMe
Marcus Carey, Founder
FireDrillMe provides a SaaS platform that orchestrates cybersecurity “fire drills” on production networks by imitating attackers. FireDrillMe helps organizations train personnel, evaluate products, and refine procedures for incident response.

Syncurity Networks 
JP Bourget, Cofounder and CEO
Ray Davidson PhD, CoFounder
Mike Volo, CoFounder 
Syncurity Networks develops software for Information Security Process Management and Automation focused on Incident Response (IR) incorporating standard IR processes, automated artifact collection, and standardized report generation. Syncurity helps mid-size businesses respond to incidents faster, document lessons learned, and collect metrics for continuous improvement.

SecureDB
Karthik Bhat, Founder and CEO
SecureDB is an encrypted cloud database for storing sensitive customer information such as authentication credentials, PII, PHI and credit card numbers. SecureDB’s cloud based encrypted database and associated APIs will allow enterprises to secure their customer data by providing strong cryptographic protection against unauthorized access.

BiJoTi
Josh Marpet, Cofounder and CEO
Billy Boatright, Cofounder and CMO
Tim Krabec, Cofounder and CTO
Ben Huey, Cofounder and CRO
Compliance requirements are coming downhill to smaller companies, and the bad guys are going after data within companies of all sizes. BiJoTi's turnkey appliance packages the advanced compliance and security benefits that large enterprises enjoy from a dedicated security organization, but at a price that works for small and mid-market businesses.

Cyph
Ryan Lester, Cofounder and CEO
Josh Boehm, Cofounder and COO 
Cyph is a secure messaging app for Facebook users who aren't security experts, but demand a simple way to chat privately with their friends.

As Operational Risk Management is incorporated into the core capabilities of each new entrepreneurs business plan it will benefit their own launch and better serve their intended customers.