Driving Out Unnecessary Risk

RISK DRIVING OUT UNNECESSARY

6

LOCKING IN VALUE:

THINGS EVERY BUSINESS OWNER AND LEADER MUST KNOW ABOUT RISK

1 | Driving Out Unnecessary Risk

ABOUT ME My story is simple.

I first encountered crime at age 9; and my first emergency response occurred when I was 13 years old.

These events and others paved the way for a career of managing risks to people and their assets that’s over three Decades long (and counting ).

☺

I am a protector by nature and have done this my entire life.

My mission is to help as many organizations and individuals as possible execute on their plans without being attacked or victimized.

2 | Driving Out Unnecessary Risk

Simply put, I am a warrior for good…

I’m here to help you Find Your Risks before they Find You.

PROACTIVE VERSUS REACTIVE RISK MANAGEMENT The primary benefit of learning to swim is being prepared to avoid drowning – it’s a proactive step that we all agree helps to avoid risk.

A simple, unprepared reaction to an adverse business event is similar to falling in the water and expecting to survive – without knowing how to swim.

Proactive risk management provides the mindset and tools to engage risks before they become emergencies – AND it assures greater success when bad things happen – it’s certainty you can survive a fall into the water because you know how to swim.

Risks are formidable in today’s world!

The good news?

You only have to avoid one big event or successfully engage one emergency to maximize ROI in the world of proactive risk management…

In extreme cases, this can literally make the difference in a thriving business versus one that no longer exists.

Let’s get you a quick education on some of the most important areas of risk currently – and what you can do right now!

3 | Driving Out Unnecessary Risk

CYBERSECURITY & INFORMATION RISK Company owners and leaders consistently rank this as one of the most significant areas of risk faced by their organizations.

Start here and move quickly if you have major gaps. ģ Identify and Protect Your Most Important Information Assets ģ Control Points of Internet Ingress and Egress ģ Control Devices Inside Your Network ģ Use Strong Passwords and Never Permit “Recycling” – Bad people cross-reference compromised passwords from other sources ģ Multi-Factor Authentication is a MUST for Critical Assets (unless you have something even better) ģ Drive Cybersecurity Awareness into your Culture and Test Employee Readiness: People are the Weakest Link ģ Install Important Software Updates & Patches (and only use supported software versions) ģ Be Vigilant & Prepared for Rapid Event Response ģ Don’t Open Unexpected Emails or Links ģ Backup Data, Keep it Safe (offline is best) and Test

Ever wonder when cybercriminals (especially ransomware crews) are most likely to hit?

At the worst possible time for you – M&A Activity, Earnings Announcements, Major Upgrades/Changes, Peak Season, New Product/Service, Other Major Changes or Announcements.

You’re most vulnerable during these times – because you’re under maximum stress!

If you don’t know the status of your cybersecurity and information protection capabilities – or your company isn’t performing these and other basic measures, there is a serious gap that may have already been exploited…

Compromises often go on for months or longer before they’re recognized.

This could be your highest priority when it comes to managing individual risks!

4 | Driving Out Unnecessary Risk

FRAUD AVOIDANCE Companies are defrauded in countless ways – sometimes using schemes you can’t imagine.

It’s usually too late when you realize you’re a fraud victim…The money or assets are gone and you have nowhere to turn.

Begin by looking at these areas: ģ Know Your Most Valuable Assets ģ Develop & Enforce Internal Controls – Starting with Cash, Inventory and Separating AR and AP ģ Think through the ways Someone can Steal from You – Physically and Virtually AND Internally and Externally ģ Train Employees on How to Spot Anomalies ģ Know Your Employees – Starting with Interviews & Pre-Employment Screening ģ Develop and Enforce a Company Code of Ethics – Including the Responsibility for Everyone to Report Suspicions – and an Anonymous Tip Line to make Reports, if needed.

A single fraud case can seriously damage your business reputation or literally close your doors…

And it can originate from anywhere internally or externally, including from long-term, highly trusted employees.

The Association of Certified Fraud Examiners reports some of the most significant fraud losses are attributed to trustworthy, long-term employees…

Don’t let a fraud attempt catch you unprepared!

5 | Driving Out Unnecessary Risk

PHYSICAL SECURITY There are serious physical risks in the workplace. And risks for the company extend to every location your employees work…

Employers have responsibility to provide a safe work environment AND it’s in the company’s best interest to keep employees and visitors safe.

It’s also vital to protect your company’s assets.

Start with these basics: ģ Develop and Strictly Enforce a Comprehensive Workplace Violence Program ģ Inspect the Exterior of Your Facilities from the Perspective of a Criminal ģ Upgrade Door Locks and Control Keys ģ Install & Maintain an Alarm System for Burglary, Panic and Environmental Monitoring ģ Install & Maintain a Surveillance System for Employee and Customer Safety ģ Develop Procedures for Opening/Closing & Screening Visitors into Non-Public Spaces ģ Regularly Test all Systems ģ Develop Written Safety & Security Protocols and Regularly Train Team Members

Some industries have stringent physical security requirements and others have none: But every organization from the “solo-preneur” to major companies has some form of physical security need.

You don’t want to be the company that did a great job managing complex risks across the spectrum but then left the front door open and had trouble walk in…

Protecting Physical And Information Assets Is Incredibly Important – BUT PROTECTING PEOPLE IS A CHALLENGE And RESPONSIBILITY LIKE NO OTHER! One more potential concern (for some organizations): Unauthorized technical surveillance of companies and their key employees happens way more than many people realize – If you run a public company, are considered to be part of the critical infrastructure or key resources or are in another high-target area of work – give this some thought.

☺

6 | Driving Out Unnecessary Risk

BUSINESS RESILIENCE Today’s dynamic environment presents all kinds of natural and manmade challenges.

Business resilience is the end result of strong and integrated business continuity planning and disaster recovery capabilities.

This is an absolute requirement for all businesses.

Identify Your Most Valuable Assets – Facilities, Equipment, Employees, Systems and more Prioritize Assets for Protection & Recovery Document Written Resilience Plans for Places, People, Processes & Technology

Exercise the Plans – Tabletop Exercises & Event Simulations Incorporate Lessons Learned into Plans Repeat at Least Annually or with Major Business Changes

It’s often an overlooked area of proactive risk management – but Business Resilience is a vital element of a well-run organization.

Having Business Resilience plans can unquestionably make the difference in business survival or failure…

Don’t take the chance!

7 | Driving Out Unnecessary Risk

THIRD-PARTY RISK MANAGEMENT Business practices are continually evolving in many industries …

Greater complexity necessitates more specialization.

This creates growing reliance on third parties for key services.

Third-Party Risk Management is one of a handful of emerging risk categories that deserve attention...

These are some of the initial steps to take: ģ Identify all Vendors ģ Develop and Enforce Strong Contracts and NonDisclosure Agreements ģ Prioritize Due Diligence based on Vendor Criticality and Access (virtual and physical)

ģ Require and Review Statement of Controls (SOC) Reports for Important Vendors ģ Take Extra Steps to Assess and Oversee Critical Vendors ģ Monitor Activities of Third-Party Providers

You can and in many cases should outsource vital business systems and processes – but the risk continues to reside in your company.

A number of high-profile data breaches have been accomplished by exploiting supplier weaknesses – and this isn’t the only risk introduced by third parties.

Rank third-parties and focus most of your attention on critical providers.

8 | Driving Out Unnecessary Risk

ENTERPRISE RISK MANAGEMENT Enterprise Risk Management ties together your entire risk management program – it’s the Hallmark of Solid Organizations!

Here are a few foundational elements of a comprehensive Enterprise Risk Management Program: ģ Treat Risk Management as a Business Essential

ģ Train Employees in all Risk Areas

ģ Determine how much Risk to Take in Pursuit of Revenue and Convey that to Your Team

ģ Develop and Report on Key Risk Indicators (KRIs) ģ Build a Risk-Aware Culture

ģ Incorporate Insurance Coverage and other Risk Treatment Options into the Program Get help early so you develop a productive and sustainable program – at the correct pace and customized for your unique organization.

What is The MOST DISTURBING PIECE of these risks? That’s the best question of all…

MANY of the MAJOR RISK CATEGORIES OFTEN COLLIDE: Cyber events (like ransomware) become fraud incidents which cause business resilience perils…

Physical security weaknesses are exploited to create resource damage or customer and employee safety issues which in turn present business resilience challenges…

Weaknesses of third-parties (your vendors) are exploited to gain privileged access to your network or systems to steal, alter, encrypt or destroy data which – well, you get the point.

The bad guys have lots of tools and human resources – and they have time…

Criminals only have to be right once – but honest players like you have to get risk management right and keep it right continuously…

Business owners and leaders are literally faced with organized crime today – specialists in every aspect of chicanery and networks of people developing and sharing crime tools, selling access to companies, creating diversions to maximize success and so much more…

These guys run their businesses just like honest organizations – information sharing, subject matter experts, outsourcing, tools and techniques.

Also, federal agencies aren’t here to get your money or systems back if they’re compromised – their mission is prosecuting criminals.

And we all know natural disasters have no bounds – serious business disruption can happen without notice.

So – the stakes are Very High when Major Risks become Intertwined.

9 | Driving Out Unnecessary Risk

BRINGING IT ALL TOGETHER This guide provides a lot of information – yet it only scratches the surface in each area…

Each category of risks is important and they all hold unique challenges for your business.

We know it’s impractical to completely protect against every potential risk.

The best long-term goal is to develop a unified enterprise risk management program.

But it can take some time to get there...

Your goal is to become a “Hard Target.”

This is a company that’s substantially more difficult to compromise than most of its peers.

Why? Because most criminals are lazy.

They would rather attack the best available target with the least amount of work required – a company that is not hardened.

Being better prepared also helps tremendously in natural disasters where victims are random…

Not sure where to start?

Begin Here: 1.

Set Simple Goals: Focus on risks you can address quickly.

2.

Get at least one thing done Quickly to Break Inertia and Gain Momentum!

3.

Accomplish something simple now – RIGHT NOW: Tell someone about your ideas, set a meeting to discuss with top leaders, send an email to the team on the importance of managing risks and/or your cultural expectations for risk management – don’t waste time – if you wait, the energy and opportunity will fade rapidly…

4.

Commit to long-term, incremental improvement: successful risk management is a journey.

5.

Contact me for more help: This is an important process and you need professional risk managers in your corner!

10 | Driving Out Unnecessary Risk

THE CHALLENGE

You CAN PROACTIVELY MANAGE risk.

You MUST identify and manage your greatest risks.

And I’m HERE to HELP YOU along the way…

This is YOUR opportunity for SERIOUS GROWTH! Treat Risk Management as a Business Leadership Imperative – this puts you well ahead of the competition!

Make Effective Risk Management a Main Ingredient for Business Success – and know that in dire circumstances it may Determine Your Company’s Survival!

11 | Driving Out Unnecessary Risk

MY FREE OFFER FOR YOU TO LEARN MORE What are you going to do as an organizational leader – stick your head in the sand and

“hope for the best,” or proactively lead to greater success?

You’ve taken the time to review this material so we already know the answer:

THIS is for YOU! Book Your FREE 30-Minute Strategy Session with me here: https://calendly.com/riskhelp/30min OR message me here to schedule https://www.linkedin.com/in/clark-cummings-66043b15/

This isn’t a sales call – it’s designed for me to learn a little about you and your company and Help You Identify Areas of Potential Weakness.

Don’t leave here without knowing: Invest a Few Minutes Now.

12 | Driving Out Unnecessary Risk