Cyber security risk is among the most critical risks to the supply chain:

“Cyber and data privacy breaches are perceived to be the largest threat to the stability of transport and logistics, with the sector facing potential breaches of $2 trillion by 2019.”[i]

The reality of a cyber-crime is not if, but when, and how damaging it will  be.  The inevitability of a cyber-attack has forced end-product manufacturers to reassess every element of the end-product manufacturer from product design, outsourcing, and servicing the product. [Read more…]

Lessons Learned: Seldom Remembered: Soon Forgotten

Guest Post by Malcolm Peart (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Something on the Project goes wrong and is fixed – “Let’s put this down for lessons learned” goes the management mantra.  But was this experience just a failing that should not have happened in the first place and relearning a previously taught, but now forgotten, ‘lesson’?

If we don’t learn then the same mistakes will be made and possible opportunities will be missed and, as Edmund Burke the 18th Century Irish Statesman said, “Those who don’t know history are destined to repeat it“.  But why do we forget our lessons?  Abe Lincoln said “Lessons not learned in blood are soon forgotten” reflecting that loss in some form such as money, property, or reputation, not necessarily blood, is needed to ensure that memory is ingrained and can be recalled.

Lessons that are remembered after the fact tend to add insult to injury; when you’re up to your neck in alligators you then remember that distant lesson about draining the swamp! [Read more…]

Guest Post by James Kline (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Recently, Lloyd’s of London in conjunction with the University of Cambridge Center for Risk Studies, published the results of their global risk analysis.  Lloyd’s document is entitled “Lloyd’s City Risk Index: Executive Summary”.  Cambridge has entitled theirs “Cambridge Global Risk Outlook 2017”.   This is their second risk assessment.  The first was published in 2004.

The index is a ten-year projection based on twenty-two threats to 300 hundred of the world’s leading cities.  The 300 cities account for half of the world’s Gross Domestic Product (GDP).  This piece discusses the results of the study and its implication for the application of Enterprise Risk Management (ERM). [Read more…]

General Electric (GE) for many years was the go-to company for competitiveness, efficiency, and innovation. General Electric’s  tagline was ‘Imagination at work.’

GE more recently has had a number of troubles.  GE’s profitability tanked. GE is selling many of its assets and divisions. GE was also taken off the Dow after 110 years. [Read more…]

Guest Post by John Ayers (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

This story is about risk at the enterprise program/project level.  It is an example of centering your design around a high-tech solution to a problem when a low risk proven technology would have more than sufficed.   Technical expertise ego got in the way of a practical low-cost approach resulting in unplanned schedule and cost growth. [Read more…]

Using IOT Intelligent Things to Monitor Risk in Real-time

Although in ISO 31000 monitoring risk is another of its key tenets, I again see little monitoring in most risk management systems. Periodic review, dashboards, heat maps, and KRI reports are all Review (a different ISO 31000 tenet) not monitoring. IoT technology can deliver real-time monitoring of risk for more than just physical environmental metrics.

To monitor means to supervise and continually check and critically observe. It means to determine the current status and to assess whether or not the required or expected performance levels are actually being achieved. [Read more…]

Guest Post by Geary Sikich (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Awareness of risk can lead to unforeseen risk behaviors based on knowledge that is sufficiently convincing to lead to false positives.

“The more you know, the more you know you don’t know.”

― attributed to Aristotle

[Read more…]

Guest Post by Greg Caroll (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Probably one of the most recognized but least understood disruptive technologies for Risk Management in the 2020’s is Big Data. [Read more…]

Guest Post by Greg Caroll (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

The 2009 release of ISO 31000 was the first step across the threshold into 21^st century risk management. Unfortunately the industry that has developed around it has firmly grabbed the doorway and won’t let go.  Although the latest revisions make references to decision making and integration into functional purpose, it totally misses the point of risk management, which is to assist navigating a complex world. [Read more…]

Guest Post by Malcolm Peart (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Firstly, what is ‘good communication’?  Many people have views, but my definition is “the effective and efficient transfer and receipt of information by the right people, at the right time, in the right medium, at the right place and in the right amount”. [Read more…]

Guest Post by Malcolm Peart (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

We all use our work experience to a greater or lesser extent and often the most recent project is recalled as it is at the forefront of our minds.  However, is it the most relevant if we try to adapt our most recent, and hopefully successful, experience to meet the current situation? [Read more…]

Guest Post by James Kline (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Houston Texas is one of the few local governments in the United States with an Enterprise Risk Management (ERM) based risk assessment approach. This policy was reviewed and updated in 2016.  This was the latest step in the city’s use of risk assessment.

From 1996 to 2004, the city outsourced risk assessment.  The assessment was performed every five years.  Beginning in 2009, the city’s audit department took over the assessment.  This article discusses the risk assessment process used by the City of Houston.

[Read more…]

Guest Post by Malcolm Peart (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

You’ve started a new project; or joined one that’s up and running or it’s nearing closure – and it’s going well.  With no problems to speak of, it’s business as usual; so stick to the plan and it will be all right in the end ‘cos nothing can go wrong.

Or perhaps there are problems; but all projects have problems!  It’s not your problem as the bid team, planning team, or those awkward stakeholders and ever present over demanding clients can be blamed.

The project will eventually get finished if it’s on, or off, the rails.  The project is ‘just a job’ and management just carry on clocking-in and clocking-out regardless of the situation. [Read more…]

Guest Post by James Kline (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

The 2012 Moving Ahead for Progress in the 21^st Century Transportation Act (MAP 21) requires state departments of transportation to develop a Transportation Asset Management Plan (TAMP). The TAMP is to include a Risk Based Asset Management Plan (RBAMP). The two plans must be certified by the Federal Highway Administration (FHWA) by June 30, 2019.  Certification failure will result in National Highway Performance Program funds being reduced by thirty-five percent.  As a carrot, federal funds can be used to cover the cost of developing these plans. This article discusses the FHWA’s approach to risk management.  It also shows that the FHWA approach will filter down to local governments. [Read more…]