monthly newsletter issue 8/ february 2019 · 2019-04-11 · 1 the ierp® monthly newsletter...

CORPORATE MEMBERS:

Monthly Newsletter Issue 8/ February 2019

1 The IERP® Monthly Newsletter February 2019

CHAIRMAN'S MESSAGE

Dear readers, I would like to take this opportunity to wish ourChinese members, supporters and readers a veryhappy Lunar New Year. According to The Deloitte Millennial Survey2018, millennials will make up 75% of ourmodern workplace by 2025.

RAMESH PILLAIChairman of the Boardof Governors, IERP®

The survey indicated very negative feedback in relation to millennials’ feelingsabout business and ethics. According to The Deloitte Millennial Survey 2018, millennials will make up 75%of our modern workplace by 2025. The survey indicated very negative feedbackin relation to millennials’ feelings about business and ethics. We had a few discussions this month about Virtual Risk being a nightmare with anuptick in the frequency of such cases and incidents. This increasing global trendof data theft and cyber-attacks is something Risk professionals and Organisationsshould track and remain vigilant over. At our Tea Talk on 25th January, Mr. AllanLee, Director of Consulting Services at Friday Concepts (International) as well asHead of BCM Faculty at IERP, briefed participants on the value of business continuitymanagement (BCM) through the lens of Value on Investment (VOI). He also sharedinsights on the most important takeaways from BCM Programs, the current stateof BCM locally and internationally, and how it will continue developing in the future. As we look forward towards the encroaching end of the first quarter of 2019 andthe rest of the year ahead, significant uncertainty is still the order of the day.Geopolitical tensions and risk, international trade and protectionism, cybersecurityrisk (to name a few) all remain high with little sign of any significant abatement.The key word for Risk managers and organisations remains “vigilance”.Organisations still need to move forward with their strategies and plans as stayingstill is never a viable long term commercial option. In doing so, care must beexercised in ensuring that the organisation’s sustainability, agility and resilienceare always properly safeguarded and enhanced.

TABLE OF CONTENTSTABLE OF CONTENTS

The True Value of Business Continuity - A Paradigm Shiftfrom ROI to VOI Interview with Mr. Allan Lee, Head of the BCM Faculty atIERP Virtual Risks Can Be A Real Nightmare Millennials and Ethics 4 Signs Another Recession is Coming - And What ItMeans For You Global Conference 2019 Refresher-Accelerator Program (RAP™) Training Calendar 2018-2019

3 5 7 9 11 14 15 16

The IERP® Monthly Newsletter January 2019 2

We jumpstarted 2019 with our first tea talk of the year by Mr. Allan Lee, Director ofConsulting Services at Friday Concepts (International) as well as Head of the BCM Facultyat IERP, who spoke on the value of business continuity management (BCM) through the lensof Value on Investment (VOI). VOI helps measure the total value of ‘soft ‘or intangiblebenefits derived from continuity initiatives in addition to those “hard” benefits measuredby ROI. Its approach is critical to allow funding for continuity planning efforts that providethe competitive differentiation necessary in today’s dynamic business landscape.

Business continuity is defined as getting your business up and running at the quickesttime possible, with minimal losses to your business. Mr. Allan highlighted currentperceptions concerning BCM. According to The Resilience Gap Report 2017, even though96% of those surveyed believed that business resilience SHOULD BE a core element oftheir company’s overall business strategy, only 54% claim that business resilience is afocus. This statistic proves that although BCM is recognized among businesses it is notcomprehensively integrated and practiced by organisations as intended because BCM doesnot support a strong ROI.

In Malaysia, there is a need to raise awareness on BCM among organisations. It is anongoing effort to make our companies more competitive. Leaders play an essential role inensuring BCMs are comprehensive and tailored towards their organisation’s uniquerequirements as every organisation has different unique strengths, weaknesses,opportunities, threats and critical infrastructures. Adopting BCM by using a template foundon the internet may defeat its purpose.

Mr. Allan shared how there is no perfect BCM plan. Threats and landscapes regularly

change - from personnel, technology, regulations and others. Therefore BCM is a continuallyevolving process for an organisation. Mr. Allan also provided insights in determining whena BCM plan is “fit for purpose” for an organisation. He explained that it depended on anorganization’s risk appetite and criticality of its operations.


Misconceptions on business continuity need to be addressed in our effort to improveBCM integration in organisations. Misconceptions that insurance alone is sufficientmitigation to cover losses can prove disastrous. Whilst Insurance may provide somefinancial protection, it does not contribute to protecting employees’ lives, resumingoperations or managing brand value and reputation.

Framing BCM in VOI terms in comparison to ROI can send a message on the real value

of BCM to senior management and demonstrate that its effective implementation canbenefit the organisation as a whole. Among VOI of business continuity is:

• Increased resilience against disasters and incidents.• Effective staff deployment during an emergency• Competitive advantage - proper certification would present more business

opportunities.• More thoughtful business process – as BCM helps to create a more comprehensive

business process. Mr. Allan concluded the talk after an interesting sharing session between

participants. In a nutshell, with the current risk landscape, BCM is an essential tool tosafeguard an organisation. He also has encouraged organisations to use standards likeISO 22301 – ‘Business Continuity Management’ which can assist the organisation to designand implement effective and efficient BCM.


What is your role as a business continuity professional?I conduct feasibility studies and gap analyses, design and develop programs, implementand coach project teams, and provide certifications for competency. I came to this field ofwork through my many years working abroad and seeing how a comprehensive programcan protect businesses from being affected by unforeseen operational disruptions. What do you enjoy most about your job?Being able to build things from scratch in organizations by helping companies turn theirconcepts into reality through a pragmatic implementation approach. What are your biggest challenges?Convincing organizations of the importance of business continuity to their business. Why do you think they are resisting?Presently, having a business continuity is not mandatory and is the furthest away fromthe pulse of many management teams. Many companies look at the short-term, i.e. theROI of implementing business continuity, instead of how a business continuity canprevent huge losses in times of disruption. What does professional development look like to you?A never-ending journey of learning! No one can have enough knowledge, and in anyspecialist field it’s important to keep abreast of new developments. What are the key attributes every successful BCM practitioners possesses?Passion in helping organizations prevent disasters from crippling their businesses; it ismore than just a routine job. Any advice for other risk practitioners?Be vigilant and always put on a learning hat; stay humble. Remember that BCM is acritical risk mitigation under ERM.


What is the current state of BCM Internationally?BCM needs to be pushed from the legislators and policy makers as organizations tend tobe passive when approached. Organizations put too much focus on the consequences(generating revenue) of having business continuity rather than the cause (taking awaythe risks that could potentially operationally disrupt the business). Internationally,organizations are putting a lot of emphasis on business continuity so as not to allow theirsupply chain affect their brand/ reputation. In Europe and the US, it is becomingmandatory for their supply chain to have a business continuity certification and evidencethat it is practiced. How do you see it continuing to develop in the future? The requirement is being pushed from OEMs in Europe and the US. The bulk of thesupply chain is in Asia and they will be compelled to be certified to remain as part of thesupply chain to these OEMs. It will become more of a ‘must-have’ than a ‘good to have’. How do you view the relationship between BCM and Supply Chain Management?Supply chain management is the conscious approach and effective management ofactivities within the chain that optimizes customer value. Supply chain managementmust be seen from an end-to-end perspective and not through the perspective oflogistics and warehousing. BCM should permeate all parts of the supply chain. It is aboutminimizing the impact of disruption on a supply chain and keeping the supply chainworking through any operationally disruptive event. How do you see the differences between ERM risk and BCM risk?ERM typically focuses on achieving organisational objectives and improving the qualityof decision making, while BCM focuses on identifying and prioritizing the criticalprocesses and resources supporting the delivery of key products/services of anorganization so that the organisation can continue to operate to established agreed metrics and benchmarks in the event of any operational disruption.

As a faculty member at the IERP, what do you thinkare the most important takeaways from the BCMprograms you teach?Experiential learning, real-life sharing, and casestudies. Real-life examples are shared from anexperienced implementer and not justtheoretical concepts, and we share thesuccesses and failures of each implementationand how to overcome them. We also discuss thecultural and governance issues surrounding ERMand BCM and their inter-relationship.


VIRTUAL RISKS CAN BE A REAL NIGHTMARE

A local university was recently threatened with the potential leakage of personal detailsof more than 1 million students and alumni if they failed to improve the security of theirportals. This threat came after a number of banks online system reportedly suffered databreaches at the end of 2018. In the last quarter of 2018, an attack on Facebook’s computernetwork exposed personal information of nearly 50 million users. All these cases show aworrying global trend of data theft and cyber-attacks - and the global outlook lookingforward is no different. The Global Risks Report 2019 lists data fraud/ theft and cyber-attackamong the top 5 risks in terms of likelihood. From uploading your travel photos, ordering lunch and booking transport, technology iscontinuously evolving to meet the demands of the digitally savvy, to provide better productsand services and subsequently a better quality of life. We are increasingly embracing thedigital lifestyle and show no sign of slowing down. Global internet penetration has risenin 2018 and continues to rise. This trend has influenced businesses and organisations toadopt and integrate digital technology into their processes and engagements – eventransforming their products and services! While we cannot deny the benefit of digitaltechnology, we should devote the same attention and resources in managing risks as weare investing in its development. A number of recent studies all point towards the increasing economic cost, losses and impactdue to cybersecurity incidents. In addition to any financial impact, customer confidenceand brand reputation will also take a hit.

‘Cybersecurity is no longer just a technology issue; it is a business one too’ (Neil Campbell, Director of Security Solutions of Australia’s leading telecommunication

company - Telstra).

DON’T THROW MONEY AT SECURITY. Whilst continuously improving cybersecurity requires resources, pumping in money andhoping it’s enough to deter constantly evolving attacks does not solve the problem. So,what can businesses or organisations do?


1. Cultivate a culture that supports cybersecurity risk managementIt is extremely important for leaders of an organisation to recognise cybersecurity risk asa priority and to develop holistic measures or policies for the organisation. This is to ensurethe response systems created are not incompatible with other response systems in thesame organisation. In addition, the cybersecurity policy needs to be aligned withmanagement policy so that organisation-wide measures can be designed/co-ordinated.Measures and procedures created must be communicated effectively to internal andexternal stakeholders - including supply chain partners and outsourcing companies toensure effective implementation. 2. Be proactive, not reactiveIt is impossible to create an impervious system that denies any cyber-attack, indefinitely.An organisation may choose to invest as the need arises. A more proactive or holisticapproach sees organisations deploy a comprehensive monitoring and response processthat always help an existing system to evolve as a whole. This approach needs to besupported by data on emerging threats, feedback from all levels of management withimplementation of necessary policies and processes. 3. Prepare for responseAn organisation needs to prepare against cyber-attacks. Preparation includes setting anemergency response system and drilling exercises that involve IT personnel anddepartments which will be directly or indirectly impacted by an attack. An effectiveresponse system promptly identifies the areas that are involved in the attack and rolls outnecessary measures to prevent further damage. An effective response also helps reducethe impact on the brand, reduce losses and improve the recovery time of critical processes.Organisations are not impervious to cyber-attacks. However, they can take the necessarysteps to minimise the impact of the loss. As the world and processes continue to evolvewith digital integration, it is time for organisations and leaders to invest and makecybersecurity one of their primary areas of focus.


By 2025, millennials will make up 75% of our modern workplace. According to The DeloitteMillennial Survey 2018, millennials’ opinions about the motivation and ethics of businesshas spiraled downward. Their expectation on what businesses should achieve does notmatch with what they perceive businesses’ actual priorities are. Millennials believe thatbusinesses should not only focus on profits but also consider other stakeholders’ interests.In other words, they want employers to prioritize their workers, society and theenvironment above the company’s bottom line. As a result, Company ethics has become,increasingly, one of the most important factors in any organization’s effort to attract andyoung retain workers.

How do organizations create a strong ethicalculture that can be identified by all stakeholders?

The framework of social responsibility isn’t an option for organizations today. TheDeloitte’s survey also claims companies that are fixated on profits do not encourageloyalty among young workers. Prioritization on societal improvement is stronglyperceived among young workers who wish to stay beyond five years in a company. Theshift in workforce has compelled organizations to push for social responsibilityprograms that are more established and inclusive. Young workers today are attemptingto add value in their career equations by assessing an organization’s reputation forsocial responsibility as well as how the organisation contributes to society, theenvironment and employees’ well-being.


2. Create products and services that resonate with younger generationtoday. Millennials as consumers and the workforce are pushing for change in the waybusinesses do things. Products and services are expected to safeguard theenvironment, protect labour rights and promote sustainability for future generations.In addition, research shows consumers are expecting brands to support a cause.Creating these added values in products and services is a “must” to increase brandappeal to millennials today. 3. Value of workplace culture. Young workers today have high expectations fortheir organizations, such as working for a cause, flexibility in hours, no micromanagingand others. This is a significant change from past generations, who typically valuesalary as main criteria in choosing a job. Workplace culture can be a powerful tool inattracting and retaining top talents in an organization. Millennials are transforming organizations and supporting start-ups with Visions andMissions that makes the world a better place to live in. It is time for leaders andorganization to integrate a strong ethical culture that serves both our workforce andcustomers. It is true that creating a strong culture will not be easy, but achieving it willhelp in strengthening brand position and create added value in their product andservices. Reference:The Deloitte Millennial Survey, 2018https://www2.deloitte.com/global/en/pages/about-deloitte/articles/millennialsurvey.html


Here's how to prepare for the inevitable economic downturn.


By Casey Bond

Are We Headed For A Recession Soon? Here’s the thing: There’s essentially always a recession on the horizon. That’s becauserecessions, which are often defined as periods of significant economic decline that last atleast two consecutive quarters, are a natural part of the economic cycle, according to Zhi Li,owner and financial planner at Twelve Two Capital. “It is reasonable to anticipate that arecession will happen sometime in the future and reasonable to think one might happensoon given the long expansionary period that we are in,” he said. But as far as predictingwhen, exactly, a recession will happen, you might as well consult your magic eight ball.Although there are a few data points we can look to when predicting an approaching recession,nailing down a specific time frame isn’t possible. Even so, plenty try. According to Li, mosteconomists don’t predict a recession will happen this year, but they do think one is likelyto happen within the next two. Here’s why.Signs A Recession Is Coming Whether or not a recession will occur soon depends on who you ask. Take the ConferenceBoard’s Leading Economic Index, for instance. It examines 10 leading economic indicatorsto arrive at a growth or decline rate for the economy, and it helps predict recessions in themonths leading up to the downturn. In November, the LEI grew by 0.2, which signals thatour economy is still humming along though growth has slowed a bit.

4 Signs Another Recession Is ComingAnd What It Means For You

Then again, other common economic measures say otherwise. Here are a few reasons whywe might actually experience a recession soon. 1. Stock MarketStock market performance is often considered a strong indicator of overall economichealth. And historically, stock market peaks have preceded economic downturns by anaverage of seven to eight months (the actual range is a lot wider). On Oct. 3, the DowJones hit its highest closing record for the 15th time in 2018 at 26,828.39, following therecord-setting day prior.Less than three months later, the stock market experienced the worst December sincethe height of the Great Depression.Even so, you should take these “signs” with a grain of salt. As the late Nobel Prize-winningeconomist Paul Samuelson joked decades ago, “the stock market has predicted nine ofthe last five recessions.” Certain stock market behavior can signify a recession is coming,but by no means heralds one. 2. Yield CurveA somewhat more reliable indicator is the yield curve on U.S. Treasury securities.“Historically, when the yield curve inverts the interest rate on shorter-term treasurybonds is higher than the interest rate on longer-term Treasury bonds a recession cansometimes follow,” said Rockie Zeigler III, a certified financial planner and owner of RPZeigler Investment Services.How closely are the two correlated? Let’s just say the curve was inverted prior to the pastseven recessions. In early December, the front-end of the yield curve inverted for the firsttime in more than a decade, meaning the yield on 5-year Treasury notes dropped belowthe 2- and 3-year notes. 3. Job MarketAnother major number that could point to an imminent recession is unemployment. Andcounterintuitively, it’s a low rate of unemployment that often signals a slowdown.Recently, unemployment dropped to 3.7 percent a nearly 50-year low. Wages are alsogrowing at the fastest rate since 2009. According to Forbes, strong job market statisticslike these indicate that we’re reaching the end of the latest economic cycle rather thanthe beginning. In fact, an unemployment rate below 4 percent which is quite rare hasoften immediately proceeded past recessions. 4. TimingFinally, as mentioned above, recessions are a normal part of the economic cycle. “Whileit’s not a very technical indicator, a long run of economic expansion can tell us something,too,” Zeigler said. “We haven’t had a recession or bear market since 2008-2009. Theeconomy has been expanding (albeit slowly) since then. So have the stock markets.” For these reasons, Zeigler said, we might actually be overdue for slowing economic growth,if not a recession.


What Does This Mean For You? Zeigler added recessions impact the average person in two major ways. The first isunemployment: “When a recession hits, generally it’s accompanied by risingunemployment,” he said. The second is spending. “If a person is able to keep their job, they probably won’t becompletely confident in spending their money on things like TVs, cars, homes and servicesbecause of all the negativity that accompanies a recession,” Zeigler said. “Our economy isvery dependent on consumer consumption of goods and services and folks tend to ‘hunkerdown’ during recessions because they fear losing their job.” That means regardless of when the next recession hits, it pays to be prepared. Build up your emergency fund. According to Bradley Nelson, president of Lyon ParkAdvisors, your top concern during a recession should be staying on top of your bills andensuring you have a reliable source of income. “Everyone should have an emergency fund of three to nine months of mandatory expenses,depending upon their circumstances,” Nelson said. “A money market account is a goodplace to have this stashed.” He also suggested thinking about what skills and resourcesyou have at your disposal in case that fund isn’t enough, including spouse employment,side hustles and part-time jobs. Know your risk tolerance. Though it can be difficult to predict your own behavior duringcertain situations, you should ask yourself what you’d do if the market were to drop by 10,20 or even 50 percent. “If the answer sounds like ‘I’d sell everything to preserve what’sleft,’ alarm bells should go off,” Nelson said. “It’s a sign your portfolio doesn’t match [your]risk tolerance.” If that’s the case, you should reexamine your asset allocation. “Better to come up with anallocation you can live with through thick and thin now, rather than wait for markets todrop and sell your assets at fire sale prices,” Nelson said. Take advantage of rock-bottom prices . Even though continuing to invest during amajor market downturn might feel like lighting money on fire, it’s actually the smart thingto do in most cases. “Investors should have a shopper’s mentality. This means... having ashopping list of quality products to buy at bargain prices,” Nelson said.In other words, you should aim to sell high and buy low. And though it’s probably hard tothink of a recession as an opportunity, for the savvy investor, that’s exactly what it is.

This is an article published online in the Huffington Posts on January 2019.



https://www.insterp.com/conference-brochure-request/

Introducing the Refresher-Accelerator Program (RAP™)

Most organisations and leaders today recognise the importance of Enterprise RiskManagement, but implementing it is often time-intensive and low on the list ofpriorities. With this in mind, the purpose of our new Refresher-Accelerator Program(RAP™) is two-fold: 1. To provide quick primers on ERM essentials to those new to ERM or those seekingto set up/ transform their organisation’s risk function 2. To provide a refresher to those seeking updates on best practices or new ideas anddirection on how best to improve risk management in their organization Held in half-day modules, RAP™ arms you with a breadth of tools and knowledge toconnect ERM to your organisation’s culture, strategy, operations, and governance.

M1: Building Sustainability, Agility andResilience via ERM8 April 2019, 0900 - 1300 M2: Linking ERM to GRC8 April 2019, 1330 - 1730 M3: Risk Appetite Statements and ERMReporting16 May 2019, 0900 - 1300 M4: KRIs, KCIs, and EffectivelyCommunicating Risk Information16 May 2019, 1330 - 1730

M5: Understanding the Applicability,Mechanics, Value, and Limitations ofMeasuring Risk18 September 2019, 0900 - 1300 M6: Cybersecurity Risk18 September 2019, 1330 - 1730 M7: Risk Culture3 October 2019, 0900 - 1300 M8: Effective and Practical BCM andCrisis Communication3 October 2019, 1330 - 1730

Modules

Learn more at our website!


https://www.insterp.com/programs/refresher-accelerator-program/

[email protected]

For more information about our events and programs, [email protected] or visit our website.

Learn more about our new Refresher-Accelerator Program (RAP™) View IERP® Training Calendar 2018-2019

http://www.insterp.com

monthly newsletter issue 8/ february 2019 · 2019-04-11 · 1 the ierp® monthly newsletter...

Documents