Virginia, USA: Bulls-Eye for Operational Risks...

The Mid-Atlantic of the United States is experiencing the Operational Risks associated with two natural disasters within the span of one week. Virginia has been a bulls eye with an earthquake and a major hurricane.

bull's-eye

   [boolz-ahy] Show IPA

noun, plural -eyes.

1.

the circular spot, usually black or outlined in black, at the center of a target marked with concentric circles and usedin target practice.

2.

a shot that hits this.

3.

the center or central area of a military target, as of a town or factory, in a bombing raid.

4.

a missile that strikes the central area of a target.

5.

the coordinates or instance of aiming and firing a missile that results in its hitting the center of a target.

RICHMOND, Va. — Virginia Gov. Bob. McDonnell has declared a state of emergency for areas affected by Tuesday’s earthquake that shook people from Georgia to Canada.

McDonnell said Friday in a news release that damage from the 5.8 magnitude earthquake appears to be greater than initial reports. He says the damage has been exacerbated by aftershocks.

McDonnell also says damaged structures could be weakened further by high winds from Hurricane Irene, which is approaching the East Coast.

RICHMOND, Va., Aug. 25, 2011 /PRNewswire/ -- With Hurricane Irene approaching, Dominion Virginia Power and Dominion North Carolina Power are readying repair crews and preparing equipment for emergency restoration work over the next several days. The company is asking its customers, especially those in coastal areas, to take steps to brace for the storm.

"This storm has serious potential to cause widespread damage," said Rodney Blevins, vice president-Distribution Operations for Dominion Virginia Power and Dominion North Carolina Power. "We are geared up to handle any situation as quickly and safely as possible. We are treating Hurricane Irene seriously, and we urge our customers to monitor local weather forecasts for changing conditions in order to remain safe."

The Continuity of Operations Plans (COOP) and Business Continuity Plans (BCP) for the governments and businesses are in full force and it all began without notice. The 5.8 quake shook Washington, DC and many at the Pentagon were having deja vu moments from that morning on 9/11. What was that? How could it be an earthquake?

Soon there after, people began streaming out of buildings, into the metro stations or jumped in their cars to try and get out of the city. All the while on their Blackberry or PDA cell phones. One seemed to be working better than the other. BBM was not interrupted.

Hurricane Irene is still approaching the Washington, DC area at this moment, so we don't know the total impact yet. However, if your business runs on IT systems and most do, hopefully you have already been exercising your contingency plans. It could be days for some areas to have power fully restored.

The business resilience factor is something that can not be under estimated in these times of greater natural disasters and other increasing interruptions to business operations. The professionals associated with keeping your business running and the systems online should be several doors down from the CEO. Think about it. Where do you have the person(s) located who are responsible for the lifeblood and health of your enterprise? Far too often we find that the business leadership is still more than shouting range away from those they rely on to keep the operations running and the organization safe. How is that working for you?

The American Red Cross has a new site that may be more for the small to medium enterprise (SME), but that makes up the majority of businesses in the United States. It is worth a look to help you get your SME in ready for the next earthquake or hurricane:

The American Red Cross Ready Rating™ program is a free, self-paced program designed to help businesses, organizations and schools become better prepared for emergencies. When you join and become a member, you'll complete a 123-point self assessment of your level of preparedness, gain access to tips and best practices information, and commit to improving your score each year to maintain membership.

Members complete a 123-point self assessment of their level of preparedness, gain access to tips and best practices, and commit to improving their score each year to maintain membership. The 123 Assessment has been aligned with the federal government's private sector preparedness standards (PS-Prep).

If you are a business that wants to stay in business, these questions and assessment could save you from business failure. It determines your emergency preparedness efforts in terms of commitment, knowledge of hazard vulnerability, emergency planning, plan implementation and community resiliency. 40% of businesses never reopen after a disaster.

How quickly your company can get back to business after a terrorist attack, a tornado, a fire, or a flood often depends on emergency planning done today. While the Department of Homeland Security is working hard to prevent terrorist attacks, the lessons of the 1993 World Trade Center bombing, the 1995 Oklahoma City bombing and the September 11, 2001 terrorist attacks demonstrate the importance of being prepared.

When you also consider that the number of declared major disasters nearly doubled in the 1990's compared to the previous decade, preparedness becomes an even more critical issue. Though each situation is unique, any organization can be better prepared if it plans carefully, puts emergency procedures in place, and practices for emergencies of all kinds.

And when your organization has had a near miss, not out of business but severely impacted, then it is time to even move up to "The Standard on Disaster/Emergency Management and Business Continuity Programs - NFPA 1600.

operational risk

Energy Sector: Change Management Risk...

The Energy Sector has operated for years with an "Operations Integrity Management System" framework. The Operational Risk Factors are spelled out clearly:

Behavior-based processes for reducing risks of incidents, including personnel safety, process safety, security, and environmental considerations, are in place. It is expected that:

• employees and contractors consistently recognize and proactively mitigate operational, procedural, and physical hazards

• employees and contractors proactively and routinely identify and eliminate their at-risk behaviors and those of their co-workers

• Human Factors, workforce engagement, and leadership behaviors are addressed

• behaviors, at-risk conditions, and other precursors that can lead to incidents are recorded, analyzed, and addressed

The BP Macondo incident has brought to light several areas that will be more highly scrutinized by federal oversight going forward in the Energy Sector. It is inevitable that those companies operating with deep drilling operations will continue to focus on their decades of experience on a management system that instills both safety and security. This will not be enough however in these desperate times with so many new threats and hazards, in the search for new oil reserves hundreds of miles off shore.

In the U.S., the Workplace Safety Rule was published in the Federal Register on October 15, 2010 to incorporate lessons that have been learned from the Deepwater Horizon disaster. Under the rule, there are four relevant areas that are now covered that the previous regulation did not:

• Hazard Analysis
• Management of Change
• Operating Procedures
• Mechanical Integrity

We would like to emphasize "Management of Change" and the human factors that are a major challenge to regulate. All operators under U.S. regulation with the enactment of the Drilling Safety Rule and the Workplace Safety Rule, are now required to identify and document potential risks. This will directly impact the accountability for risk assessment and mitigation. These new prescriptive rules for deepwater drilling, directly impact those operators to implement a Safety and Environmental Management System (SEMS) per the law.

Now back to "Management of Change." Change Management is an Operational Risk that has been a continuous challenge. The exception is exemplified by those organizations that have dedicated themselves to a continuous Plan-Do-Check-Act (PDCA) life cycle, inherent to their corporate culture. What are some of the tools and standards that can be implemented in your management system that can assist you in getting to the next level?

Emergencies, crises and disasters like the tsunami in Japan or the recent riots in London, can happen at any time. Organizations around the world are increasingly implementing risk management processes to deal with uncertainty and ensure continuity. But if their suppliers are unable to deliver, or customers unable to purchase, the ability of an organization to achieve its objectives would be compromised. Security management systems for the supply chain to promote resilience at every step of the supply chain, ISO has developed a new standard, ISO 28002:2011, Security management system for the supply chain – Development of resilience in the supply chain.

This International Standard will not only incorporate the PDCA model for quality assurance and change management but also the security of the supply chain. Another area of concern for regulators going forward will be the number of contractors and sub-contractors relationships. A set of global international standards such as ISO 28000 series or ISO 31000 is the correct path for the operator and private sector organization to demonstrate to the U.S. regulators that they are already in the process of managing change effectively in their organization.

Operational Risk Management in the Energy Sector will remain a high priority for the simple fact that it is square one for being a good custodian of the environment and to perpetuate a safe and secure workplace for employees and contractors.

ISO 28002 can be applied to any organization including private, not-for-profit, non governmental, and public sector. Implemented within a management system, the standard enhances an organization’s capacity to manage and survive any disruptive event and take appropriate actions to help ensure its viability and continued operation.

Achieving a continuous change management framework that the regulators will recognize as global best practice and that is monitored consistently, is a prudent strategy for all the members of the Marine Well Containment Company (MWCC). We can only hope, that those who have not yet embarked on this important mission, will be doing so before they take on that next unexplored frontier beyond 5,000 feet below the surface of the ocean.

WASHINGTON — Washington announced on Friday (August 19th, 2011) it would resume the sale of offshore drilling licenses in the Gulf of Mexico, where the BP disaster 16 months ago unleashed the worst maritime oil spill in history.

operational risk

Legal Risk: General Counsel Digital Leadership...

Operational Risks continue to plague any senior manager with the title of "Corporate General Counsel". "Achieving a Defensible Standard of Care" remains ever so challenging. General Counsel digital leadership is required by the Board of Directors. A recent Corporate Executive Board Report outlined some of their top line issues in a recent Corporate Counsel article by Catherine Dunn:

1. Regulatory issues will converge, while regulation of issues will fragment.

What it means: Common issues—such as data privacy, executive compensation, anti-bribery, and antitrust—are gaining importance in the eyes of regulators the world over, says Lee. But countries and states are regulating those issues in different ways, which makes it more difficult for companies—and in-house legal teams—to harmonize their policies.

2. Information will grow exponentially.

What it means: E-discovery requests are getting bigger (think terabytes, not gigabytes) and the quality of meta-data that could be subpoenaed is getting better (like someone's location, as identified by GPS technology). As more and more information comes into play, the study finds, it "will increase the premium of how companies organize and manage their information."

3. Dueling demands for corporate transparency and consumer privacy will collide.

What it means: Consumer demands for privacy will place more emphasis on data security and how companies shore up their IT infrastructure. "The end result for legal departments is that, at the very least, they're going to need to become more [technologically] literate," says Lee. And again, legal teams will also have to deal with a variable set of regulations, depending on where companies operate.

While consumers want to protect their own information, they also want to to have more information about corporations, information about executive compensation packages, private conversations between executives, and company investments.

4. The legal department's center of gravity will shift.

What it means: As companies expand into emerging markets to capitalize on growth opportunities, risks will follow. "It's going to be more important for those risks to be managed locally," Lee says. The report hypothesizes, then, that in-house legal teams will become more decentralized, decamping from corporate headquarters for local terrain. "Culture is an often-underestimated factor with regard to risk," Lee adds. Seeing as how different countries identify, report, and react to misconduct in different ways, that will also add to the need for on-site legal teams.

Another facet of this shift is that in-house lawyers will take on additional responsibilities—such as auditing and keeping an eye on corporate integrity and employee behavior.

5. The legal services market will mature.

What it means: If five to 10 years ago companies wondered which law firm to partner with, today it's not just traditional firms that are competing for the work, Lee says. Legal- and business-processes outsourcers are "very good for discrete pieces of work," such as discovery and document review, he says, and that could "rival or surpass the quality of law firms."

How fast is fast enough these days to provide your members or customers notice that their bank account has been hacked and money has been transfered to transnational criminal syndicates across the globe? Six hours is too long according to this latest suit against Comerica Bank in Michigan, USA:

It started with a simple e-mail that landed in the inbox of Experi-Metal Inc.'s controller, Keith Maslowski, in January 2009. The message appeared to come from the company's bank, and Maslowski followed the directions to click on a link and enter confidential log-in data and other codes as part of routine maintenance. The details are laid out in a lawsuit that the small metal shop in Sterling Heights, Michigan, filed against Comerica. Scam artists used Maslow­ski's codes to initiate more than 85 wire transfers, moving $1.9 million out of the company's account to China, Estonia, Finland, Russia, and Scotland.

It took the bank only six hours to spot the unusual activity, notify the customer, and stop the transfers. But it wasn't good enough for the federal judge. Court documents show that the company had only two prior transfers in two years. On June 13 U.S. district court judge Patrick Duggan in Detroit ruled that Comerica was responsible for the $560,000 that remained unrecovered because the bank didn't act "in good faith." The judge ruled that "a bank dealing fairly with its customer, under these circumstances, would have detected and/or stopped the fraudulent wire activity earlier."

Yet another example of the Operational Risks that require more preventive measures for the savvy "General Counsel" (GC) of 2011 and beyond. To what degree are there other "Tripwires" in place for the GC to become a nerve center for detecting those incidents and behavior that is strange or not normal. After all, you can't be everywhere and no one can effectively work 24 x 7. So there remains only one answer. Automation working with Operational Risk experts.

How do the programmers know how many transfers are out of a normal range? In the case of Comerica, Judge Duggan ruled that six hours was too long to stop the fraudulent transfers. You see, the risk for establishing the right business rules can't lie completely with anyone who is doing the programming. Business management, consumers and risk management experts all need to be in the process of developing the triggers and alerts that allow faster response on incidents such as this one.

The number of data breaches and other cyber criminal activities will continue to rise as long as the General Counsel remains aloof or segmented from the departments and business units that can establish effective automated "Trip Wires" to get notified when something is "Not Normal".

Here are just few of the larger and most reported incidents in 2011 according to Law.com:

2011
April 1: Epsilon Inc., the world's largest e-mail marketer, reveals an unauthorized entry into Epsilon's e-mail system, exposing customer names and e-mail addresses.

April 26: Sony Network Entertainment America and Sony Computer Entertainment America disclose a "carefully planned, very professional, highly sophisticated criminal cyberattack designed to steal personal and credit card information." The intruders stole identity data from about 77 million PlayStation Network and Qriocity customer accounts.

May 10: Citigroup Inc. discovers a breach exposing more than 360,000 customer names, account numbers, and contact information. Citigroup waits almost a month before notifying its customers, and later says $2.7 million was stolen.

May 24: The Los Angeles Times reports that a Bank of America Corporation insider leaked detailed customer data to a ring of identity thieves resulting in $10 million in losses. The bank later confirmed the loss, which occurred sometime last year but came to light only recently, when the bank began informing customers.

June 15: Automatic Data Processing Inc., the world's largest payroll processor, says personal data of one of its 550,000 corporate clients was breached. It ­provided no details.

So what is the answer for the General Counsel? The "Plan-Do-Check-Act" lifecycle applies to the GC just as others in the corporate enterprise. Information Governance is no different for the legal department than it is for the CIO. The problem is, how much are both working in concert so that the holders and managers of digital information are working side by side the legal eagles of the company? Not enough in a world where transnational criminals, advanced persistent threat and insiders are testing your controls and the latency of your alert mechanisms on a daily basis.

The companies plagued with the incidents highlighted in the popular press are working hard to prevent the vulnerabilities exploited by those tasked with finding them. They have invested millions of dollars in technology and sophisticated tools for detection and defense. In todays world of 4 Billion devices connected to wireless networks and ultimately the Internet; working hard just will not suffice anymore.

The General Counsel working in concert with the Chief Information Security Officer (CISO), Chief Information Officer (CIO) and even the Chief Security Officer (CSO) along with outside contract consultants typically defines who is responsible for the ongoing defense of the corporate enterprise. The question now remains; "What is the single Management System that they are all using to manage risk in the organization?" Unfortunately, the answer may be that they are not using the same management system. When your organization has not agreed upon a single management system for risk management then there is no wonder that you have opened yourself up to the possibility of failure. Utilizing a single international standard such as ISO 27001: 2005 could be the beginning of a unified effort by the entire stakeholder community in your organization.

Certifying your Information Security Management System against ISO/IEC 27001 can bring the following benefits to your organization:

• Demonstrates the independent assurance of your internal controls and meets corporate governance and business continuity requirements
• Independently demonstrates that applicable laws and regulations are observed
• Provides a competitive edge by meeting contractual requirements and demonstrating to your customers that the security of their information is paramount
• Independently verifies that your organizational risks are properly identified, assessed and managed, while formalizing information security processes, procedures and documentation
• Proves your senior management’s commitment to the security of its information
• The regular assessment process helps you to continually monitor your performance and improve

operational risk

ISO 28000: Bankers Exposed to Supply Chain Risk...

The banking institutions of the globe are on high alert. The Operational Risk doctrine is finally getting beyond the historical threats of fraud and rogue traders to the "New Normal" of other significant business disruptions. It's been on the horizon for some time, yet now Basel is finally enhancing the rules that have so far been ignored or given little consideration:

Banks should bolster their defenses against losses caused by rogue traders, client fraud and other so-called operational risks, global regulators said.

The Basel Committee on Banking Supervision endorsed updated principles on how banks should protect themselves from risks not directly linked to lending or market movements, the group said today on its website.

The measures add to beefed up capital and liquidity rules to toughen regulation of banks following the worst financial crisis since the Great Depression. Rogue traders such as Jerome Kerviel at Societe Generale (GLE) SA and Nick Leeson at Barings Plc can also wreak havoc on individual institutions, said Nicolas Veron, a senior fellow at economics research group Bruegel.

“Barings was killed by operational risk, and Societe Generale came very close to a near-death experience in 2008,” Veron said in a phone interview from Brussels.

“Does operational risk generally cause systemic crises? No. But it can have a major impact on individual institutions when things go wrong,” said Veron.

Today’s changes build on rules from 2004 that require lenders to hold reserves against risks including natural disasters, computer hacking, systems failures, theft, fraud and unauthorized trading.

So where is the weakest link in the 63 "Principles for the Sound Management of Operational Risk"? We still think it is this one, number 54 under the Principle of Mitigation and Control:

54. Outsourcing is the use of a third party – either an affiliate within a corporate group or an unaffiliated external entity – to perform activities on behalf of the bank. Outsourcing can involve transaction processing or business processes. While outsourcing can help manage costs, provide expertise, expand product offerings, and improve services, it also introduces risks that management should address. The board and senior management are responsible for understanding the operational risks associated with outsourcing arrangements and ensuring that effective risk management policies and practices are in place to manage the risk in outsourcing activities.

The reason that we believe this to be a single-point-of-failure, is the tremendous number of outsourced services from the critical informations systems infrastructure in the banking industry to the supply chain risk of the major global firms who the banks themselves are investing in for the continued commerce of the world.

One key aspect of this area of Operational Risk has to do with the sense of risk mitigation that usually occurs with the use of a "Service Level Agreement" (SLA) with a vendor or service provider. The General Counsel and the legal team are responsible for the prudent review and drafting of outsourcing contracts. This (SLA) in many cases is never audited or tested to find out how a supplier would respond or behave, during a major incident that impacts their particular area of supply chain operations. This brings us to ISO 28000.

ISO 28000:2007 specifies the requirements for a security management system, including those aspects critical to security assurance of the supply chain. Security management is linked to many other aspects of business management. Aspects include all activities controlled or influenced by organizations that impact on supply chain security. These other aspects should be considered directly, where and when they have an impact on security management, including transporting these goods along the supply chain.

Regardless of the legal documents agreed upon with you and your Tier 1 suppliers, you can bet that they have their own supply chains that you have not done any due diligence on. Can you trust that all of your Tier 1 suppliers have gone down another layer or two to ensure their own survivability for a myriad of operational risks? Adopting an international management system such as ISO 28000, will send you on your way to a more adaptive enterprise and with improved business resilience.

Now the question might be, how many major banks or hedge funds are major investors in companies such as DP World? Are they ISO 28000 certified to be more business resilient at their respective supply chain points of failure?

DP World Cochin has announced that the International Container Transhipment Terminal (ICTT) at Vallarpadam has been certified under the ISO 28000 Standard for Supply Chain Security Management system, and has joined the other DP World terminals in India to be the only container terminal in the country to be certified in port security. Dubai: In 2007, Port operator DP World has raised $3.25 billion in Islamic and conventional bond sales to refinance existing debt and fund its expansion. The company said it exceeded its target of $3 billion for the two bond issues. Barclays Capital, Citi, Deutsche Bank and Lehman Brothers lead managed the two issues, helped by Dubai Islamic Bank for the sukuk. DP World, the world's third largest marine terminal operator, manages 42 terminals in 22 countries. Its investment commitments run into billions of dollars over the next few years in several countries, including India, Turkey, Britain, Senegal, Peru and China. Total capacity at DP World's ports was 48 million TEUs ((twenty-foot equivalent container units) in 2006 and is expected to increase to 84 million TEUs by 2016 when new terminals are built.

So the final analysis on Operational Risk Management in your particular supply chain, may very well be beyond the surface of the Service Level Agreement (SLA). The General Counsel and Legal team would be highly advised to dig deeper than their Tier I suppliers in "Achieving a Defensible Standard of Care." Barclays, Citi and Deutsche should be more confident that DP World is one of a few companies managing their Operational Risks with ISO 28000 at one port. Now your next step, may be to find out whether the precious semiconductors you need to manufacture your companies electronic products are in the hands of the DP World Dubai Port Jebel Ali, Terminal 1 or DP World Cochin.

You should not be alarmed that DP World has a vacancy for the SVP, Global Operations:

VAC2531 - Senior Vice President - Global Operations

Division: Operations

Location: Dubai, U.A.E.

Department: DPW FZE DUBAI PORT INTL - DEP

Closing Date: 11-Jul-2011

About the Role:

This position reports to Executive Vice President and Chief Operations Officer - DP World and the main purpose of the role is to develop, lead and assist in the implementation of DP World's standards in the management of Safety, Environment, Security, Operations and Engineering, in line with DP World business and Container Terminal Strategies.

FCPA Alert: Dodd-Frank vs. Powerball...

Board Directors are ever more tuned into the recent 2011 case settlements in Foreign Corrupt Practices Act (FCPA) violations. This is because Operational Risk Professionals are being much more proactive than years past on uncovering malfeasance in the supply chain operations of major global conglomerates:

• Notable 2011 FCPA Settlements. 2010 was a record year for FCPA enforcement, and thus far 2011 has been no different. In the first half of 2011, 10 notable FCPA enforcement actions have settled, resulting in a total of about $490 million in penalties, disgorgement and prejudgment interest:

1. Tenaris agreed to pay a $3.5 million criminal penalty and $5.4 million in disgorgement and prejudgment interest.

2. Rockwell Automation agreed to pay disgorgement of $1.7 million, prejudgment interest of $590,000 and a civil penalty of $400,000.

3. Johnson & Johnson agreed to pay a $21.4 million criminal fine and $48.6 million in disgorgement and prejudgment interest, as well as about $7.9 million in related United Kingdom Serious Fraud Office recovery.

4. Comverse agreed to pay a $1.2 million criminal fine and $1.6 million in disgorgement and prejudgment interest.

5. Ball Corporation agreed to pay a $300,000 civil penalty.

6. Jeffrey Tesler, a key member of the TSKJ-Bonny Island joint venture accused of being part of a scheme to bribe Nigerian officials in exchange for contracts related to the construction of liquefied natural gas facilities, forfeited nearly $149 million, the largest FCPA-related forfeiture imposed on an individual to date.

7. JGC Corporation of Japan agreed to pay $218.8 million in criminal fines.

8. IBM agreed to pay a $2 million civil penalty, disgorgement of $5.3 million and $2.7 million in prejudgment interest.

9. Tyson Foods, Inc. agreed to pay a $4 million criminal penalty and $1.2 million in disgorgement and prejudgment interest.

10. Maxwell Technologies agreed to pay $8 million in criminal penalties, as well as $6.4 million to settle SEC civil charges.

Are any Board Directors out there amazed that companies such as IBM are still being impacted by the FCPA risk to the enterprise? Maybe more importantly, why is a Japanese company paying a criminal fine of over two hundred million dollars?

JGC CORPORATION is a Japan-based company mainly engaged in the engineering business. The Company operates in two business segments. The Integrated Engineering segment is engaged in the planning, design, procurement, construction and testing of equipment, appliances and facilities for petroleum, petroleum processing, petrochemistry, gas, liquefied natural gas (LNG), general chemistry, nuclear energy, metal smelting, biotechnology, food, pharmaceutical, logistics, information technology, environment protection and pollution prevention industries. This segment is also engaged in the provision of related inspection, maintenance and information processing services, as well as water and power generation business, among others. The Catalyst and Chemical segment is involved in the manufacture and sale of catalyst agents, functional materials, deodorants and enzymatic filters, electronic materials and high-performance ceramic products, as well as next-generation energy related products.

The Board of Directors of any transnational organization should be doing their homework on the reasons why JGC Corporation has employed an independent compliance consultant for the next two years and paid the $200M. fine. Remember, your supply chain and your business partners may be the reason why you are sitting around the Board Room table negotiating with the U.S. Department of Justice.

The larger question is, could this have been prevented? Is this a risk that can be mitigated within the corporate enterprise? Has the company done everything in it's capacity to put the right controls in place and the tools to keep the possibility of FCPA ever finding its way back to the Board Room Agenda? Do you know all of your joint venture partners are from the U.S. and all of the projects that they are working on together?

JGC’s agreement to pay the fine brings to $1.5 billion the total penalties in a case against a joint venture known as TSKJ that included Houston-based Kellogg Brown & Root LLC, Paris- basedTechnip SA (TEC) and Dutch engineering firm Snamprogetti Netherlands BV, according to a Justice Department statement.

The joint venture’s prosecution represents one of the biggest foreign bribery cases undertaken by the Justice Department since it stepped up pursuit of such cases starting in 2008 when Munich-based Siemens, Germany’s largest engineering company, paid $1.6 billion to settle U.S. and German probes.

“Each of the four companies in the TSKJ joint venture, the former chairman of the U.S. joint venture partner, and several other individuals have now been held accountable for a massive conspiracy to bribe Nigerian government officials to obtain lucrative construction contracts,” Deputy Assistant Attorney General Mythili Raman said in the statement.

What is the cost of a FCPA investigation beyond the fine? Imagine for a moment the number of e-mail messages that have to be acquired, preserved and examined. Add up the billable hours for subject matter experts to review the remaining mountain of data to determine the final relevancy of a communication with the matter and the people associated with the project. As an example, what was the magnitude of the Siemens case?

According to court records, it was a vast undertaking spanning 34 countries, with private investigators conducting more than 1,750 interviews and gathering more than 100 million documents. They reviewed approximately 14 million of those documents and gave the Justice Department and the SEC a small subset, about 24,000, according to a Siemens tally.

So what is one of the answers or solutions to finding the "Red Flags" and to self-disclose the issue to the proper authorities early and often? First off, you need to develop your corporate "Human Intelligence" (HUMINT) capability, around your Corporate Intelligence Unit (CIU). Developing and building an awareness factor in a pervasive manner is one way to do this. In order to get your HUMINT working for you, the people on the front lines and in the middle of the corporate hierarchy need to understand and internalize these "Red Flags". If the monthly or quarterly bulletin from the CEO, discussing the integrity factor of the company supply chain partners raises the issue of ethical behavior around a particular scenario, this will educate and increase awareness with those people in the enterprise who comprise this HUMINT network.

Sticks and carrots or other methods for awarding compliance is so 1980's and 1990's. Wake up! In order to bring your global enterprise into the next decade of the 2000's, you have to start using the methods, processes and tools your deal makers use to run their business (SAP, Siebel CRM, Oracle). When was the last time the CEO visited the deal makers pipeline meeting to review and discuss the joint ventures or pending projects that the business developers are forecasting to close in the next quarter? This is the perfect time for the CEO to ask them to fire any partner, agent, consultant, contractor or vendor that does not meet the foundation for the companies "Corporate Integrity Standards." Does your CEO even know what Social CRM is all about?

And how quickly the lessons that should have been learned, are soon forgotten. Not any more. Under the Dodd-Frank Wall Street Reform and Consumer Protection Act, employees, partners and other persons who provide original information on an FCPA violation by a public company can receive between 10% and 30% of the resulting fines as a "Whistleblower" bounty.

We wonder whether the odds of winning the next "Powerball" Lottery in the U.S. might be more difficult than getting 20% of a $200 million dollar fine. Global corporations should be preparing their internal processes for Ethics and Integrity Management now. This Operational Risk will soon be more apparent as employees understand the odds of "Winning".

operational risk

OPSEC: TQM in the Defense Industrial Base...

OPSEC in the Defense Industrial Base (DIB) is on high alert since the RSA SecureID vulnerability was revealed several months ago. The Operational Risks Management discipline is now ever so pervasive in private sector companies who have outsourced national security programs. When top secret information is at risk, the game plan shifts from a single company incident to a federal priority.

By Jim Finkle and Andrea Shalal-Esa

BOSTON/WASHINGTON, May 27 (Reuters) - Unknown hackers have broken into the security networks of Lockheed Martin Corp (LMT.N: Quote, Profile, Research, Stock Buzz) and several other U.S. military contractors, a source with direct knowledge of the attacks told Reuters.

They breached security systems designed to keep out intruders by creating duplicates to "SecurID" electronic keys from EMC Corp's (EMC.N: Quote, Profile, Research, Stock Buzz) RSA security division, said the person who was not authorized to publicly discuss the matter.

It was not immediately clear what kind of data, if any, was stolen by the hackers. But Lockheed's and other military contractor networks house sensitive data on future weapons systems as well as military technology currently used in battles in Iraq and Afghanistan.

The SecureID hack has been an eye opening wake up call for those Operational Risk professionals who are charged with keeping information safe from foreign adversaries. The "One-Time-Password" (OTP) market place is gearing up for a dramatic shift. Organizations such as EMC the parent to RSA are still back pedaling from the crisis and cooperating with three letter U.S. agencies to determine the culprits. Not only do organizations such as Lockheed Martin hold the nations major weapons systems contracts they are also prime contractors for defending the cyber security networks across the government.

So what is the answer for keeping the nations states across the globe from continuously probing and successfully compromising secret systems networks by hacking tools like the SecureID?

The answer lies within the private sectors approach to quality assurance in software development. The vulnerability that all security-based companies and defense industrial based companies face is the flaws in software quality assurance practices. The known fact is that in any process for software development there is a testing phase to determine whether the product requirements have been satisfied. In the lifecycle of software development, the QA testing phase is still the most neglected and under staffed. Raising the bar on software quality testing is not the only answer, it is just a facet of the security mosaic that continues to be a major challenge.

Total Quality Management (TQM) initiatives not only should be mandated by software development organizations, the Defense Industrial Base needs to require new levels of software code testing by companies that are charged with securing the secrets of the company and the nation. As each new product or software version is launched into the marketplace it should have a label on it that discloses how diligent the vendor was in testing the software for defects. Reducing those defects before it lands in the hands of the consumer is one major path to reducing the vulnerabilities of such serious breaches of trade secret or national security information.

Like natural ecosystems, the cyber ecosystem comprises a variety of diverse participants – private firms, non‐profits, governments, individuals, processes, and cyber devices (computers, software, and communications technologies) – that interact for multiple purposes. Today in cyberspace, intelligent adversaries exploit vulnerabilities and create incidents that propagate at machine speeds to steal identities, resources, and advantage. The rising volume and virulence of these attacks have the potential to degrade our economic capacity and threaten basic services that underpin our modern way of life.

What will soon be the norm in the software development industry is the TQM mind-set that has been at the forefront of other manufacturers for decades. Once the regulators get the gears rolling the private sector will finally change and work towards "Six Sigma" in software in combination with more effective approaches to Operational Risk Management:

The approach to managing operational risk differs from that applied to other types of risk, because it is not used to generate profit. In contrast, credit risk is exploited by lending institutions to create profit,market risk is exploited by traders and fund managers, and insurance risk is exploited by insurers. They all however manage operational risk to keep losses within their risk appetite - the amount of risk they are prepared to accept in pursuit of their objectives. What this means in practical terms is that organisations accept that their people, processes and systems are imperfect, and that losses will arise from errors and ineffective operations. The size of the loss they are prepared to accept, because the cost of correcting the errors or improving the systems is disproportionate to the benefit they will receive, determines their appetite for operational risk. Events such as the September 11 terrorist attacks, rogue trading losses at Société Générale,Barings, AIB and National Australia Bank serve to highlight the fact that the scope of risk management extends beyond merely market and credit risk.

As OPSEC evolves in the Defense Industrial Base, the risk appetite and TQM conversation will continue to be on the agenda. The degree to which it makes it to the Board Rooms of EMC, still remains to be seen.

operational risk

Battle of Narratives: Fukushima to Abbottabad...

The U.S. Energy companies are getting ready for an audit report on their facilities after the Fukushima Daiichi nuclear plant disasters in Japan. The results will not be an Operational Risk Management executives favorite topic, across the Board Room table of Pacific Gas & Electric (PG&E), Entergy and Duke. In the aftermath of any disaster such as the earthquake in Japan, or the financial economic armageddon of 2008 spawned by greed and unregulated markets, the auditors reports will uncover the vulnerabilities in the mechanisms for industry oversight.

Vulnerabilities found at dozens of U.S. reactors

By PETER BEHR of ClimateWire

Something under one-third of the 104 U.S. reactors were found to have some vulnerabilities to extreme emergencies, according to the NRC, which is preparing a summary of its post-Fukushima findings.

The NRC says that all issues have been fixed or put on schedule for correction, and that the safety of the reactors was not compromised.

PG&E spokesman Paul Flake said issues reported by the NRC had been identified by the company's own review after Fukushima, and an inspection by the Institute for Nuclear Power Operations, the industry's confidential safety monitor.

Information and the transparency of information will continue to be at the center of investigations on wall street or the energy industry. "Who knew what when" is the mantra being repeated in various command posts and within task forces who are responsible now for insuring the safety and security of future employees of these firms but also the national security of the country. Insider Risk of leaked information is at an all time high whether you are in the "C" suite in Manhattan or the "Situation Room" on Pennsylvania Avenue. Josh Rogin of Foreign Policy explains the predicament in Washington over the raid on Usama Bin Laden's compound in Abbottabad, Pakistan:

The nation's top civilian and military defense officials are calling on their government colleagues to shut up about the details of the May 1 raid in Pakistan that killed Osama bin Laden.

Defense Secretary Robert Gates and Joint Chiefs Chairman Adm. Mike Mullen held their first press conference on Wednesday since the mission to kill bin Laden. Gates stood by a remark he made May 12 at Camp Lejeune, in which he said there was an agreement by top Obama officials in the Situation Room to not reveal details of the raid -- but that the agreement fell apart the next day.

"My concern is that there were too many people in too many places talking too much about this operation. And we had reached agreement that we would not talk about the operational details, and as I said at Camp Lejeune, that lasted about 15 hours," Gates said on Wednesday. "And so I just -- I'm very concerned about this because we -- we want to retain the capability to carry out these kinds of operations in the future. And when so much detail is available, it makes that both more difficult and riskier."

Neither Gates nor Mullen called out any Obama administration officials by name, but Mullen, sounding even more frustrated, implied that the breaches of security by administration officials are ongoing and still a problem to this day.

The energy industry in the U.S. is now under the magnifying glass just as the banks, mortgage companies, brokers and hedge funds have been scrutinized since the financial meltdown over mark to market and predatory lending practices. The Nuclear Regulatory Commission is akin to the Securities and Exchange Commission as the federal agency who has oversight and jurisdiction when it comes to keeping the country safe and secure from private industry misdeeds or mistakes.

Information is the lifeblood of any highly functioning organization whether in the private sector or government agencies. Protecting that information of leaks to third parties who do not have a need to know is the crux of the "Insider Trading" cases on Wall Street or even the comments made within the confines of the situation room during Bin Laden's operation. So why do people want to tell another person something that they know is forbidden? Why do they risk sharing information with the media or others who may not have a legitimate reason to know the information?

And what about the opposite? Withholding information from the public or others who have a need to know the information especially if it will save lives or keep the country out of harms way. The decisions to tell or withhold information has serious consequences in either case and requires a mechanism for making sure that humans know when it is right and wrong. Unfortunately, we live today in a world of information warfare and information operations that spans the globe from Hollywood to Kabul or London to Hong Kong.

The "Human Factors" motivation for withholding or sharing information has been studied for decades if not hundreds of years. The gratification one receives from telling another a secret only known to one person or a few provides the stimulus. Whether that human gratification is the result of seeing someone else in pain or suffering, surprise or elation doesn't really matter. Recognizing that humans thirst for information is relentless when it comes to being first, or to gain power can provide you with the understanding to better prepare your organization for "Information Operations" (IO):

"A Theory of Conflict and Cooperation Model" that describes how each actor is attempting to expand, protect, or exploit existing powerbases through cooperative or conflicting relationships with other local actors. Vol. 2 Issue 3 August 2010 IO Journal

Effective Operational Risk Management begins with understanding information and ends with protecting or sharing information. It's your challenge to determine what is real and what is just another narrative to influence your perception as a human being.

operational risk

Vigilance: Risk After Bin Laden...

Usama Bin Laden is no longer a risk to the operations of many high value targets across the globe. Yet, now that he is dead, the distributed network of followers may soon carry out his blueprints for destruction. Large U.S. conglomerates doing business overseas are on high alert announced from their 24 x 7 Crisis Operations and Security Risk Management centers.

By JANET ADAMY AND COREY BOLES

The raid on Osama bin Laden's compound yielded a trove of intelligence the size of a small college library, a top White House official said Sunday.

In a series of coordinated news-show appearances National Security Adviser Tom Donilon said information seized during last week's killing of the Al Qaeda leader represents the largest cache ever obtained from a terrorist. He said it indicates that in addition to being the group's symbolic leader, bin Laden was involved in strategic operations, including Al Qaeda's propaganda effort.

Al Qaeda's network is decentralized and therefore more resilient to defeat. It will not simply disappear by having one of it's founding leaders gone forever. Corporate institutions who have their American citizens in distant high risk countries such as Algeria, Pakistan, Philippines, Iraq, Mexico, Venezuela, Nigeria, Kenya, Sudan are on heightened alert. Kidnapping is now even more of a risk in these countries especially in rural areas.

At the speed of business in 2011, the infrastructure companies have found new opportunities to build out energy and telecommunications projects using the latest "Green" and "Wireless" technologies. The threat and risk to those who represent the enemy in the eyes of Al Qaeda include the U.K. and the growth of "Homegrown Violent Extremists" (HVE) in America:

To date, cells detected in the United States have lacked the level of sophistication, experience, and access to resources of terrorist cells overseas. Their efforts, when disrupted, largely have been in the nascent phase, and authorities often were able to take advantage of poor operational tradecraft. However, the growing use of the Internet to identify and connect with networks throughout the world offers opportunities to build relationships and gain expertise that previously were available only in overseas training camps. It is likely that such independent groups will use information on destructive tactics available on the Internet to boost their own capabilities.

Operational Risk Management professionals have watched the unfolding information in Abbottabod and realized one thing. Our vigilance is now more important than it has ever been in the past ten years. The preparation, training, exercises and intelligence collection is increasingly more justified and vital. These simple 4 steps in this continuous process shall be even more integrated into the fabric of our corporate and institutional landscapes:

• Deter
• Detect
• Defend
• Document

This "4D" strategy will provide your employees with the kind of mindset necessary to help keep them safe and secure from unknown future adversaries. They may be coming from the outside while on a foreign business trip overseas or within the confines of your own headquarters in Chicago, Illinois. Complacency is our largest and most active threat today. Let the death of Usama Bin Laden and the turmoil unfolding in the Middle East remind us to continue our Operational Risk Management missions.

Remember people like Pat Tillman, Michael P. Murphy, OP Restrepo, Jeremy Wise, Dane Paresi, Scott Roberson, Elizabeth Hanson, Tim Hetherington, and Lara Logan who continues the fight. Their courage and sacrifice will never be forgotten...

operational risk