Blog

  • The Event That Forever Changed Resilience Management

    The Event That Forever Changed Resilience Management

    Collectively written by the RiskLogic team.


    Nine-eleven are two of the most infamous numbers in history. They represent unimaginable disaster and loss and remain a pivotal moment in the journey to corporate resilience.

    The digital atmosphere shows evidence of taking a break from an onslaught of covid-19 updates while stories, videos, and tributes of a looming anniversary arrive.

    “Having seen the impacts of terrorism firsthand during my time in Northern Ireland and Bosnia through the British Army, you can get to a point of assuming there must be a limit to how far these people will go.

    “Twelve years later, sitting at my desk, supporting a tie in place of military stripes, I watched the unfolding event in New York. Anger crept in, not just because of the attack, but that with all these precautions, all these measures we can take, we’re never exempt from a crisis event; these people still got through.

    “It reminds me every day of the importance of resilience and preparedness. It is, unquestionably, what saved the thousands of people who did make it out of 9/11 alive”.

    Invest in any one of our resilience programs in Adelaide, Australia and you will get a unique experience with RiskLogic’s Principal Consultant.

    Their professional journey is vast and relevant to that of 9/11. Her time at the New South Wales Police Forensic Counter Terrorism agency saw her involved in the aftermaths of mass fatalities, the Bali bombings, the Indian Ocean Tsunami, and the Anthrax Attacks. She later joined INTERPOL serving three years as an Executive within the Counter Terrorism and Emerging Threats Directorate.

    “That day (9/11) was a turning point on my life’s path. Not only in terms of my own career, catapulting me out of Public Health and into a future related to Counter Terrorism preparedness and response, but also personally.

    “The subsequent response and investigation that unfolded over the next two decades enabled me to work with a variety of national and international agencies, organisations and individuals. The experience of those interactions and exposure to inner workings of multi-organisational, cross jurisdictional teams, has provided invaluable learnings that I have utilised, shared and endeavored to continually grow from”.

    One man’s resilience that shaped business continuity

    Rick Rescorla suspected a major attack on the Twin Towers eight years before the event. The documentation that today provides evidence of his concerns has become the cornerstone of many evacuation plans, drills and procedures leading up to 2001.

    The Story of Rick Rescorla, Vietnam Vet and 9/11 Hero | Military.com
    LT Rick Rescorla, Battle of Ia Drang Valley, Vietman, 1967.

    Morgan Stanley executive Bill McMahon stated that Rescorla not only saved over 2,500 employees that day, but he also saved 250 visiting guests for a stockbroker training class. “They knew where to go, Rick showed them the staircase and the evacuation points”.

    Often missed from Rescorla’s inspiring story are the reasons to why this man was so passionate about resiliency.

    On February 26th, 1993, six terrorists set off a 606 kg urea nitrate–hydrogen gas enhanced device with the intention to topple the North Tower into the South, bringing both buildings down and killing thousands.

    The attack failed to complete its overall objective but killed six people; it was enough to convince Rescorla to act. He found the evacuation of fifty thousand people that day to have been poorly handled and vowed that “such a muddled exodus” would never happen again.

    The seven years following, Rescorla’s resilience journey landed him as the Director of Security for Dean Witter/Morgan Stanley in 1997. Convinced of the evolution of terrorism, he began writing what is now known as the The Morgan Stanley Employee’s Bible. 

    This document became a cult sensation, an instantly recognizable document, the subject of numerous nicknames and euphemisms. It details clear procedures and schedules to practice disruptive events. You could not find a coffee table in the Morgan Stanley Trade Centre offices without it.

    In 1999, Rescorla and his team were publicly acknowledged for their efforts in Emergency Management and Security. He molded the people around him to live and breathe situational awareness. These people trusted him, and it spread into other organisations throughout the Trade Centre too. Soon, he was seen visiting businesses weekly to check on their response training and capabilities.

    Despite all this preparedness, Rescorla could not shake that another attack was possible. On the morning of September, the 11th, as the Port Authority ordered everyone to remain in place, from the 38th floor of Tower 2, Rescorla watched the first plane fly into the adjacent building. He could not quite believe his eyes; what he had spent seven years preparing thousands of people for was happening.

    Choosing to ignore instructions through the building’s PA system, he reminded his team of the plans and procedures they had trained against so heavily. He saved nearly three thousand people that day. Running back into Tower 1, he was never seen again.

    When putting the call out to obtain experiences and stories for this article, nearly 20 consultants named Rick Rescorla’s story as pivotal to 9/11. He is arguably the most referenced case study in business continuity.

    Deutsche Bank vs Merrill Lynch and Lehman Brothers

    Is Deutsche Bank the next 'Lehman Brothers'? - Quora

    No organisation wants to be singled out in such a significant story in human history, but if you are, you want it to be one of positive action.

    Following the collapse of Tower 1, Deutsche Bank Tower at 130 Liberty Street, New York became uninhabitable. As planned and practiced, all the Deutsche Bank staff were safely relocated to their business continuity site at lower Manhattan.

    Concise and tested plans at the organisation meant that the group could avoid serious human and customer impacts, loss of income, unplanned expenses, loss of critical information, and failures to meet on-going commitments to stakeholders. They remained operational and active. Many staff present on that day are still with the business today.

    “It was amazing how quickly the U.S. operation moved over to New Jersey”, recalls RiskLogic’s National Administration Assistant Gareth Perkins.

    “I was working for American Express at the time. It was extremely busy as we were dealing with a lot of overflow U.S. calls due to time difference and language. I recall mattresses in the office to allow some people to nap between phone calls.

    “The business [American Express] was also amazingly flexible with getting customer emergency cards, with some staff members even delivering new cards via taxi to their customers!”

    For Merrill Lynch, the outcome was different. Loss of entire production and development centres were instant and long lasting. There was no control over capacity and the corporate functions within their site. The result, ten thousand lost jobs and $43 million in lost revenue.

    Lehman Brothers employees squeezed into Jersey City where they bought a second building to operate from in the following months of 9/11. In Manhattan, they rented office space and hired the Sheraton Hotel, other employees worked from home, but none of these steps were planned. In a time when the idea of Zoom was alien, a dispersed workforce became impossible to manage and ultimately cost the business $3 million in lost revenue.

    Pushed on by global government policy updates, the trajectory of terrorism defense changed the landscape many businesses operated in post 2001. Business-as-usual took some American organisations years to return to because of disruptive (and some might argue abused) surveillance and policy changes by the U.S. government.

    A time before virtual conferences and webinars, restrictions on travel had businesses falling behind a fast paced Asian and European market.

    It is unclear how long it took businesses to return to an operational status in New York City. But what is clear are the ones that had a near immediate return, were the ones that planned for such a disruption.

     

    The economic impact of 9/11

    As we’re seeing with the current global pandemic, even the smallest ripple of change – whether positive or negative – can create a tsunami of disruption. 9/11 is such an extreme example, that many wouldn’t dare compare it to the slow burning nature of a pandemic. However, the aftereffects from an economic standpoint show similarities worth learning from.

    “For nineteen years, 9/11 was the standout event that no one expected or could believe happened.  Now it’s covid. It’s a similar story; many refusing to believe the impacts of a pandemic like this. Until 2020, a pandemic scenario exercise of this scale would have been considered ‘unrealistic’. So too was the concept of what happened to the Twin Towers up until 2001”, says Principal Consultant Mark Watson.

    “I was in Sydney working on scenarios with my colleague in the US for the upcoming Salt Lake Winter Olympics Games-wide Readiness Exercise.  I was preparing for bed when he messaged me with “wow, a plane crashed into the World Trade Centre and the tower is on fire”. What a farfetched idea for an exercise scenario I thought. The next morning when I woke, it all became reality and very real”.

    The attacks had an immediate negative effect on the U.S. economy, in particular New York City. Wall Street and the NY Stock Exchange saw an immediate drop as the market fell 7.1%, or 684 points. The city’s economy saw a loss of 143,000 jobs in one month and $2.8 billion in wages in the first three months. The GDP of New York City was estimated to have declined by $30.3 billion over the last three months of 2001 and all of 2002.

    Approximately 18,000 small businesses were destroyed or displaced after the attacks. The Small Business Administration provided loans as assistance in conjunction with Community Development Block Grants and Economic Injury Disaster Loans provided by the Federal Government.

    Also similar to our current covid-19 pandemic, one of the biggest losses was in the air transportation industry which accounted for 60% of lost jobs overall.

    What was the cost of 9/11 to the rest of the country?

    According to a survey by The New York Times, 3.3 trillion dollars. That’s about $7 million to every dollar Al Qaeda spent on planning and executing the attack. The cost to clean the debris and begin opening the city back to the world was reported at $750 million.

    On a global scale, the argument can be made that other countries saw little to no impact directly out of New York. But twenty years of study suggests that the swift changes in policy and sharp shifts in health, security and border control out of the US (one of the world’s leading suppliers and markets) has heavily stunted productivity and growth to some key trading partners.

    Canada, Mexico, and Japan saw huge shifts in their ability to meet and adjust to changing rules, customer demand and regulations. Canada saw impacts with exported goods to the States. Measures were put in place to minimize the disruptions, however, motor vehicles – a major supply to America – saw about a 40% impact in output.

    There is evidence to suggest that the onset of the security regulations and change in trade strategies with the U.S. unintentionally contributed to the world economy remaining efficient and functioning in follow up disasters and events. However, this is intangible and immeasurable.

    But then there is the cost of war.

    Military spending doubled to $700 billion in the decade following 9/11, to about 20% of total government spending. In 2001, the Defense Department had about $181 billion in contract obligations to 46,000 companies. In 2011, it had $375 billion in obligations to 110,000+ contractors. Increased military spending by the government turned the Washington, DC, area into the country’s hottest regional economy from 2001–2011.

    When President George W. Bush ordered a “war on terror”, America would lose approximatelytwo and a half thousand service men and women throughout the next twenty years.

    Therefore, many can be forgiven for feeling hollow off the back of that bleak time throughout Afghanistan and its neighboring countries. After the final few U.S. Troops left the middle east, seconds prior to the Taliban gaining full control of the country, the States had reportedly injected $5.8 trillion dollars into the war effort (including interest on debt and financing).

    For counter-terrorism, Co-Director of The Costs of War project at Brown University’s Watson Institute, Neta Crawford says that the United States budgetary costs and obligations of post-9/11 wars throughout the 2020 financial year were actually $6.4 trillion.

    Whatever the final figure, this financial commitment and decision to continue a twenty year war has crippled the American economy multiple times over. It begs to question, does “war” need to be a disruption practiced in our plans?

    The answer is yes.

    Credit PBS.

    Communication Channels with U.S. & UK

    I later found out that 658 staff, the entire workforce who showed up that day, had died.

    The Twin Towers were a hub of multinational entities and professionals of all expertise. With 110 stories each, the two towers made up nearly ten million square feet of office space. 350 businesses and 35,000 employees occupied the buildings. For the United Kingdom, it was hard to find an international business in London who didn’t have direct lines to someone in one of those towers.

    David Gumley, Head of Growth at RiskLogic, recalls the event vividly as he sat stunned at the mirrored TV screens in his London office.

    “I was just heading back to my desk on the Barclays Capital trading floor, having just popped out to grab a late-lunch. I remember one of the FX dealers saying that he couldn’t connect with our U.S. desk for the morning briefings, as there seemed to be a problem with their phone lines.

    “There was a bit of commotion starting to filter around the floor as several of our teams couldn’t connect with U.S. counterparts and market makers to fill early U.S. trade orders. It was then that I got a call from a friend of mine.

    “He described that he and his UK colleagues couldn’t contact any of their US team. The news feeds into the floor we occupied started to switch and the pictures of the event unfolding started to filter through. I remember sitting for what seemed like hours just looking at the TV screens with the surrounding phones creating a wall of deafening noise.

    “We were all told to make our way home in fear that other financial centres may be on the ‘attack list’. I called my friend later that evening and he told me that all his U.S. colleagues had likely died as their floors were between 101-105 of 1WTC, which by this time we knew had completely collapsed. I later found out that 658 staff, the entire workforce who showed up that day, had died”.

    David agrees that this sort of experience and the sheer number of losses changed corporate resilience forever. “I believe that the 9/11 experience was the impetus for major changes. The event shaped corporate resilience, as to what we know today.

    “Disaster Recovery strategies were executed globally almost simultaneously, back-up facilities were identified, and staff began relocating to these. Technicians worked through the night to get workstations and communication channels up and running again. The bandwidth between U.S. & UK operations was increased to support such events in the future”.

    Plan, do, check and act

    No matter how far we research, our consulting team is always brought back to the unique individuals who learnt and acted upon the event; a pivot in risk management as we know it.

    These case studies, like that of Rick Rescorla, are ones there to inspire the next generation of resilience experts, leaders, and professionals. This unique anniversary should be a time to pause and check on your people, to ask yourself that as part of your responsibility, do you have a planDo you train it out? Validate it? Practice it? Do you regularly check for gaps? If you found any, how did you act upon them?

    2,977 people lost their lives 20 years ago this week. But tens of thousands were saved due to the processes and resilience of those around us.There are thousands of case studies from people, organisations and emergency services of that day, each as humbling as the next. But, as devastating of an event that it was, we must seek to study and learn from the impacts. To increase organisational and personal resilience, we must focus on what went right, and what went wrong. Otherwise, this loss was for nothing.

    Contact us now ->

  • The Internet of Things Security: Being Hacked at Home

    The Internet of Things Security: Being Hacked at Home

    Working from home has become a norm during recent times for organisations across Australia and New Zealand. It’s something we’ve practiced repeatedly the last two years. However, one often overlooked aspect of working from home is ensuring that employees have tight internet of things security.

    The working-from-home arrangement has influenced many crisis and business continuity leaders to adopt more comprehensive strategies when it comes to remote work and response. This much is true, but gaps are appearing in how a more casual working arrangement may compromise an organisation’s digital infrastructure.

    It starts with what is called The Internet of Things, a term used to describe the almost endless option of technology and items that are connected to the world wide web.

    In your home, you may recognise items like your Amazon Alexa, your app-controlled CCTV, Netflix, and your child’s PlayStation falling into the criteria of what constitutes as an item that can connect to the internet.

    For hackers around the world, the perfect scenario has occurred; it’s become easier than ever to access valuable organisational data during a work-from-home arrangement.

    DDoS Attacks

    Denial of service attacks (DDos) are relatively common and a simple approach hackers will take to overwhelm a server. Tens of thousands of machines (fake users and their computers) will target one server to overwhelm it and in some cases, crash it.

    Technology has fought back, and successfully achieving a DDoS attack on large organisations is becoming harder. That’s why hackers have moved their attention to your Amazon Alexa and your remote powered fridge; an innocent device that connects to the same Wi-Fi and system your work laptop does.

    How do they do it?

    Users are typically unaware or oblivious to how their data is being collected by a home appliance or smart device. Furthermore, your IT team is very unlikely to know where exactly that data is being transmitted from within a home.

    The FBI have warned that hackers may be able to conduct a “virtual drive-by” of users’ digital lives if they gain access via unsecured devices. This, in turn, gives them access to a user’s router and everything connected to their home network.

    Each hacker will have their own process.

    There have been reports recently of hackers easily cracking home CCTV systems (done by simply finding your email address – or guessing it – resetting the app’s password and logging in remotely). If a camera is set up in a fortunate position for the hacker (over a computer), they may just get the information they need even more easily.

    Another technique being reported is overwhelming a local internet connection and slowing down the user’s operating system while they’re working. This lag in accessibility can provide the hacker just enough time to grab a password or two.

    What you can do to prevent it

    There has never been a successful cyber-attack because of bad machines or technology. All breaches are a result of a human error. That’s why awareness, communication and education is essential when sending your team home.

    Users should change the default password and set unique passwords for every smart home device they have. They should store sensitive and private data on a network system separate from the home devices.

    Update smart home devices regularly and check permissions on mobile apps linked to the smart devices (Apple iOS is particularly good at this). They should turn on automatic updates for software, hardware, and operating systems on your smart devices for the latest updates.

    To safeguard your organisation and yourself against hackers,  assume that every internal and external link is malicious, even if it comes from your CEO.

    Just sharing an article like this with a colleague may encourage them to update their smart TV or automatic vacuum cleaner, which in turn may just prevent the next attack being a successful one.

    You can learn more about cyber resilience here ↗

  • Understanding Cyber Ransom Procedures

    Understanding Cyber Ransom Procedures

    By Resilience Specialist, Amelia Fahey

    Cyber security should be an essential priority for all organisations globally. Irrespective of industry, access to technology and the internet opens us up to the ever-evolving digital threat landscape.

    But despite our best efforts to protect and prevent, there is still the possibility that you may be a potential victim of a cyber ransom attack.

    Therefore, to remain resilient, organisations need to consider, develop and embed an additional step in their cyber response plan; comprehensive cyber ransom procedures.

    Prior to an incident, it’s important to understand and agree on strategic objectives and financial thresholds at a senior executive and board level. This can save valuable time and ensure logical and organisational-aligned decisions can be made quickly and easily under pressure.

    Mapping this out now as a key response strategy means that people are more confident in how to react to a ransom attack.

    Resilience Manager, Harrison Orr touched on the importance of organisations acting now and being prepared for potential cyber attacks in the lead up to Christmas in his latest video, found here.

    A ransom may be in response to any type of actual or potential cyber-attack or IT security incident. The purpose of the procedure is to provide time critical guidance to members of a Cyber Incident Response Team or Crisis Management Team. It guides them on how to:

    • facilitate collection of relevant information on the nature and extent of the attack,
    • assess the implications of the attack on the organisation, and,
    • provide a framework for deciding how to respond to the ransom demand/s.

    Understanding a cyber ransom demand

    Whilst refusing to pay a ransom demand is the preferred approach, and should always be the organisation’s default position, the decision on whether to pay or not is no longer a clear-cut one.

    Legal implications of paying a criminal, reputational impact, and confidentiality issues provide difficult criteria on whether to pay. Often, the cost of not paying is greater than making payment.

    You don’t need to be an expert to know cyber-criminals may have breached your system, but you do need timely and concisely documented procedural expertise to know how to respond and what that response means for your organisation.

    In the third instalment of RiskLogic’s latest Cyber Series, Nick Abrahams, the Global Leader of Technology & Innovation for Norton Rose Fulbright, talks of a case study of a CEO who refused to take responsibility for a response.

    “An organisation worth probably north of a couple of hundred million dollars, so decent size organisation, got hit with a ransom attack” says Abrahams. “And quite clearly the CEO had never conceived this could be a problem because, in his words, “the IT guys got it wrong”.

    It was an extraordinary case study of response and reaction from a leader. He said to me, “It’s so unfair that this should happen to us”. It seemed such a bizarre thing for a leader to say in such a crisis. It’s a clear example of an organisation who was at the very basic level of cyber response.

    Nick’s case study here shows clear evidence that even large organisations still don’t have strong response procedures in place.

    Cyber ransom demand considerations

    Ransomware attacks are the most common form of ransom demand; however, a ransom may result from any form of cyber-attack or IT security breach. (I.e., a DDoS attack, theft of confidential data, etc).

    Care should be taken to avoid confusing a ransomware attack with a cyber ransom demand.

    With ransom demands, payment is usually made via Bitcoin using a link provided in the ransom message. There may be limited opportunity to negotiate with the perpetrators. However, if you do, this should be done through external specialist IT security providers and involve your legal and insurance stakeholders.

    For ransomware attacks, perpetrators will usually need to demonstrate through a ‘proof of life’ style process that they can decrypt files before payment.

    Remember, a ransom demand may be received in a variety of ways including e-mail, website contact form, text message, social media post or note left within a system file. It’s important to always remain vigilant and trust nothing.

    As you move into shutting down over the holiday season, now is the time to ask what your procedures are. When were they last validated? Does everyone know the plan? The December period sees one of the largest spikes in attacks, don’t get caught out.

    To learn more about how RiskLogic can help with your cyber resilience, click here.

  • Business Continuity – Online Capabilities

    Business Continuity – Online Capabilities

    As Australia, New Zealand, and the rest of the world battle with further disruptions in the war against the pandemic, leadership teams can be tempted to push back on training and building programs.

    Organisations are forgoing their continuity requirements off the back of so much change like staff attrition and concurrent events and issues.

    To alleviate pressure of having to bring working groups together, in-person, we are using our proven track record of hybrid and virtual support into engaging and interactive programs.

    How we conduct Business Impact Assessments

    It’s becoming harder to find a business not impacted by the pandemic and concurrent events, so much so, the majority of our client base is requesting a review of how they handled the pandemic or an incident; looking to identify any  gaps and prepare for what may come next.  The process is  called a Business Impact Assessment (BIA).

    Historically, a BIA is performed in a few stages.

    • Information is gathered unique to the client.
    • Agendas and times are set to interview key members of staff.
    • Interviews are conducted (face to face or virtual).
    • Our consultants conduct analysis of the data collected.
    • A comprehensive report is shared.

    Today, the overall move to virtual is becoming an advantage to active programs. “One small difference is the ability to share our screens while conducting an interview”, says New South Wales Resilience Specialist Matthew Foreman. He says the simple act of sharing a screen presents a more visual representation of the journey for the client. “They can see why we’re asking what we’re asking and what part of the assessment we need help completing. ”

    New South Wales Resilience Manager, Harrison Orr shares a similar experience. “These BIAs are actually becoming more efficient online. [It] allows the client to dial in and out while also having the business continuity representative present if they need to be”.

    Both Harrison and Matthew admitted that gathering so many important people within the response team involved juggling many diaries and often travel requirements. Now, more stakeholders are coming to BIA interviews and adding more insight in a far shorter timeframe.

    The reality of where we are

    By making an exercise as close to reality as possible, clients gain two advantages; a fresh and relevant take on the response to a current event, and the mindset to better handle the real-life event.

    Victoria and Tasmania Principal Consultant, Joanne Costa says that her team jumps on the opportunity to conduct an exercise as close to reality as possible.

    “Teams have been able to iron out issues in exercise conditions and build confidence and comfort in managing an incident remotely”.

    Given the disruptive nature of the pandemic, most crises are happening during a period of widespread, remote work.  “Having the whole Crisis Management Team in a room together when an event  strikes is unrealistic, in particular for the first phase of a response”, says Joanne.

    When building organisational resilience, keeping what’s working now can help maintain buy-in and employee adoption. As a consultancy, we do not necessarily use our own tools during exercises. Doing so would be disruptive and build a false sense of response for the client’s team.

    Joanne adds, “we encourage clients to exercise using the tools and VC platform they would usually utilise. It will ensure readiness of the team even when they can’t be physically present. It’s also an opportunity for the team to rehearse how they will communicate and share information while remote”.

    Keeping these elements in mind also helps convert busy senior members who may see our training as low importance within their never-ending meeting blocks. We work on ensuring everyone understands the importance of the session, their responsibilities, and how it will be conducted seamlessly.

    Historically hybrid

    Records as far back as 2012 confirm RiskLogic adopting more hybrid, hot-desking scenarios within training exercises and response programs. Co-founders Josh and Dan Shields saw their own offices begin to evolve into a hybrid arrangement.

    To reduce overheads and scale almost overnight, many new SAAS enterprises were also adopting remote working. By 2018, many organisations had welcomed the concept of cloud computing which allowed more operations to go remote.

    By April 2020, the RiskLogic client base (excluding essential services) had moved to a remote working status. Fortunately, the programs that had been tried and tested over the years were now fully functioning solutions for this disruptive requirement.

    “To be honest, we were conducting 95% of our BIAs and other sessions online anyway. Not a lot has changed”, says New Zealand Senior Manager Andy Wisheart.

    Reactions to a virtual partnership

    Overall, the client adoption of a virtual partnership has been taken very well. More stakeholder commitment and quick programs are evidence of this.

    By utilising online technology, sessions can be recorded. This is being used in onboarding modules, shared with staff that missed important sessions, or even publicly as culture driven incentives.

    Our most recent example of this comes from the RiskLogic and Australian Department of Health Emergency and Crisis Management online course. A government backed and funded incentive.

    Over 1100 Aged Care leaders, managers and board members have registered the online program; one of the largest adoptions of Emergency and Crisis Management training in the industry.

    However, not everyone is prone to accept such change. “The long-standing organisations we’ve been working with have been familiar with a face-to-face arrangement. Pushing them towards an online relationship comes with its challenges” says Harrison.

    Like other consultants, he admits that clients need to see that capability to continue the same momentum and output as we had in a physical, 1-to-1 environment. “We’re actually rebuilding the trust”.

    “Demonstrating the effectiveness and efficiency has been a priority from day one of the pandemic. Proving  we could take this virtual and continue the resilience journey regardless of the medium we’re on without dropping quality”, says Harrison.

    “For nearly twenty years, it’s been consultants travelling around the world, going into thousands of offices and premises. Overnight, we’ve all had to change that. But by remaining innovative and driven, I believe we’ve managed to take that same experience into a virtual setting well”.

    Moving a resilience program virtual and achieving the same outcome can seem unrealistic.  Having strong online capabilities is not new for RiskLogic,  proudly our online solutions have been in place for over six years.

    Start an online program today ↗

  • Loss of key staff: Major disruption for Australian businesses

    Loss of key staff: Major disruption for Australian businesses

    The substantial rise in cases associated with the Omicron variant combined with changes to the Australian testing and isolation requirements, created one of the largest “loss of critical staff” crises in recent history.

    Australia’s COVID-19 cases had emerged and grown immensely across multiple states at what was thought to be ‘the tail end of the pandemic’. These case numbers were driven not only by the variant characteristics, but influenced by changes in public health response strategies, vaccination timelines, and the impact of human movement.  As a result, the opening of the borders saw 150,000 new cases within 24 hours which was a catalyst for significant staff shortages, financial loss, and operational strain.

    Major supermarkets saw transportation and supply chain impacts over the Christmas and New Year period, resulting in lack of stock as well as lack of staff; Woolworths reported at the time, one in three staff were in isolation.

    Hospitals and aged care providers were impacted to critical levels, seeing the implementation of a risk-based assessment of isolation timelines, and definitions of close contacts amended to allow critical health care workers to return to the workplace in a shorter time frame.

    Similarly in the hospitality industry, patrons were finding more restaurants and venues closed due to lack of available staff. Falling on the back of long periods of lock down for some states, adding to the operational and financial stress for businesses.

    Controlling outbreaks of the Omicron variant no longer rely on tight physical and geographic restrictions, but rather a focus on vaccination and booster rollouts (with national and international advice demonstrating its importance as a mitigation tool).

    The message, reiterated by both Australian and New Zealand governments, is that you need to get your staff vaccinated, boosted, and refresh your business continuity plans.

    With the loss of critical staff, essential roles, and in-person processes, our clients were focused heavily on reviewing contingencies including cross training, use of external agencies and cross industry networking, to obtain the critical response they need.

    However, many industries and organisations were caught off-guard, with outdated or ineffective business continuity strategies in place.

    RiskLogic and our consulting team predicted there will be further staffing challenges well into the winter months, as everyone continued to manage the pandemic as well as other infectious disease threats such as Influenza. Therefore, it was important to manage current and emerging risks, review options and contingencies, and establish a clear framework for response.

    The timeline for total pandemic recovery is unknown 

    In early 2022, the World Health Organisation (WHO) Secretary General, Dr Tedros, issued a warning to world leaders that the coronavirus pandemic “is nowhere near over”.

    His statement comes as European countries experience a surge in COVID-19 cases, even post vaccination roll out. He warned leaders that “with the incredible growth of Omicron globally, new variants are likely to emerge”.

    Our advice to clients, and with the knowledge that we will be facing not only the impacts of the pandemic but the potential impacts of parallel crises (such as cyber incidents, extreme weather and geopolitical change), is to focus on developing and updating their COVID-19 management (prevention and response) and business continuity plans.

    These two plans will enable organisations to maintain and strengthen organisational resilience in an ever changing risk environment.

    Employees seek more hybrid arrangements

    In addition to the impacts of illness and isolation, many organisations are moved into the year with the knowledge that several front-line professionals are seeking new career paths – as they respond to the stress and fatigue of the pandemic.

    In addition, and as an outcome of the pandemic, many organisations have adapted well to working remotely, according to a report by the Government’s Think Tank, The Productivity Commission, 35% of jobs have aspects and responsibilities that can be continued from a remote working arrangement.

    Many workplaces have adapted to provide what they imagined to be a temporary flexible workplace. However, two years on, many professionals are seeking a more flexible and adoptable work-life balance, favouring a more hybrid workplace and actively seeking out organisations that provide that option.

    Leadership must consider the potential impacts on critical roles, critical processes and identify potential policy changes to reflect new social expectations.

    Critical next steps 

    As we continue to manage the evolution of the COVID-19 pandemic and attempt to identify and prepare for other risks and threats, valuable next steps for all leadership needs to include an immediate revision of critical process, the minimum level of human resources and skills associated, so that contingencies, both short and long term can be developed.

    In addition, now is the time to review organisation-wide business continuity and strengthen response strategies focusing on four areas:

    • Loss of critical staff
    • Denial of access (temporary or permanent)
    • Loss of IT and communications, and,
    • Loss of critical third-party provider or supply chain.

    Our experience at RiskLogic allows us to streamline this process and assist clients to strengthen resilience maturity as we head into another year.

    Article references:

  • Uncovering crisis trends post pandemic

    Uncovering crisis trends post pandemic

    Written by General Manager, Risk Consulting, Malka Bakes.

    Scenario based exercises are commonly built on events that are measured as high probability, high impact, such as cyber and natural disasters.  More recently, RiskLogic has been changing the theme to consider more difficult conversations, that of cultural and moral responsibility.

    We’re reinvigorating these scenarios not only to provide diversity in our training, but to consider culture crises like icare and the developing stories coming out of organisations like Rio Tinto and Ansell.

    Noncompliance to modern day slavery, abuse in the workforce, racism, sexual harassment, and discriminative workplaces have been concurrent events smouldering under the blanket of the pandemic.

    It’s becoming clear that leadership teams need to continue to work as hard on managing culture as they do the pandemic.

    The repercussions

    Recently, the Uyghur people have allegedly found themselves in modern-day slavery, working in factories supporting companies such as Adidas, BMW, and Amazon. The investigative reports by the Australian Strategic Policy Institute (ASPI) uncovered and published 83 businesses associated with employing Uyghur people. As a result, thousands of employees around the world have now begun speaking up or against their own employers.

    Online discussions like the #MeToo movement began exposing unfair and unjust organisations. The “Great Resignation” allowed more employees to negotiate better working arrangements.

    US Senate Cabinet members announce the new legislation

    And in a rare show of bipartisanship, the US Senate passed legislation prohibiting companies like Facebook and Google from requiring employees to resolve sexual harassment and assault cases through arbitration.

    The board of Rio Tinto will be continuing to conduct many reviews of their work culture off the back of a recently commissioned external review by former Australian Sex Discrimination Commissioner Elizabeth Broderick.

    The investigation uncovered systemic bullying and sexism across Rio Tinto worksites. Almost half of the staff experienced a form of bullying, 28.2% of women and 6.7% of men had experienced sexual harassment at work, 21 women reported actual or attempted rape or sexual assault, and racism being common across several areas with 39.8% of men, and 31.8% of women who identify as Aboriginal or Torres Strait Islander in Australia experiencing racism.

    People protest the destruction of sacred land in Australia by Rio Tinto.

    Think outside the box: RiskLogic’s approach

    In the last twelve months, RiskLogic has been challenging our clients to think outside of the box on what constitutes a crisis and areas that require training.

    Over the last two years, we have empowered over 400 clients to prepare, respond, and successfully recover from minor to critical disruptions while operating in an unprecedented pandemic world.

    Our most exercised scenarios have ranged across cyber, reputational, loss of life, site accessibility and supply chain crises.

    However, threaded through all the simulated exercises worked with our clients, we have continuously brought clarity to a key outcome that was hidden behind the layers of risk and resilience management practices, the correlation between their existing corporate culture and their crisis management readiness, response, and recovery plans. 

    Every scenario has shown a direct impact to an organisation’s external brand and reputation whilst often showing internal cracks in the organisation’s issues management practices, incidents review, assessment and reporting controls that could lead to having a significant effect on the organisation’s culture.

    From our reviews, we see an organisational trend is to distance oneself from controversial partnerships or third-party suppliers. This may have worked during an age without the internet, but today simply breaking partnerships does not fix the underlying issues.

    Australian protective and medical grade glove manufacturer, Ansell saw their share price drop 35% in a day after the US Department of Homeland Security banned importation of their products to the country and said it had “information that reasonably indicates the use of forced labour” out of their Malaysian partnership channels.

    Ansell chairman, Glenn Barnes says the company is investigating allegations one of its major Malaysian suppliers is abusing worker rights and will dump any supplier it finds is exploiting workers.

    But, has the damage already been done?

    A trillion-dollar responsibility

    Simply dumping suppliers and firing offending employees does not fix the fact that there was a problem there to begin with.

    Apple continues to increase its lead as the most profitable company of all time, but it should credit a lot of its success to China and its substantial workforce.

    Apple’s CEO, Tim Cook understands the moral responsibility of the commercial partnership with China. He makes a valid point on how large organisations should deal with offending third-party suppliers by demonstrating that simply leaving does not always fix the issue.

    In the reigns of Steve Jobs, Apple rarely paid much attention to the alarming number of suicides and human rights violations being reported out of their Chinese manufacturing plants.

    But as the brand grew, so too did the investigations and information on how Apple produced its high-selling products.

    The manufacturing of iPhones, Macbooks and AirPods have been outsourced for over a decade to the Chinese manufacturer, Foxcoon out of Shenzhen province. Today, the number of workers involved in the manufacturing lines is north of 150,000 people. A community so large, full townships have been built around the factories to accommodate them.

    Cook recognises that simply leaving this partnership would be catastrophic to the workforce and their families.

    Apple is now working to fix the issues of their partnerships, rather than simply ignoring them. They have dedicated full-time teams based in the factories monitoring and supporting the well-being and working rights of the staff.

    In Rio Tinto’s case, the company had two choices; aim to keep their crisis internal and try to fix it in confidence, or publicly acknowledge the issues and their steps to address them.

    They took the latter (and correct) option of publicly announcing their strategy by releasing the report on their website.

    Rio Tinto’s former CEO (and the man who built the Diversion & Inclusion Strategy), Harry Kenyon-Slaney took the findings of the report head on.

    “If this culture is now widespread, then either I did not ask the right questions in my engagement and listening efforts, or the environment was not sufficiently safe for women to raise their concerns…”

    Elizabeth Broderick said, “This report is not a reason for reduced confidence in Rio Tinto. By proactively commissioning this study, one of the largest of its kind within the resources industry, it demonstrates a very clear commitment to increased transparency, accountability, and action.

    In my interactions with the Rio Tinto leadership team, I have observed a strong desire for transformational change, as well as to make positive contributions to the societal shifts that we need to see. There is clear recognition, however, new approaches are needed to solve these issues.”

    How we challenge our clients

    As we return to a post pandemic existence, it is prudent for organisations to reintroduce to Board discussions and organisational strategy setting agendas the what if questions such as, “what if such a crisis was to happen to us”? “What if our culture is behind the eight ball”?

    When preparing our clients for testing their crisis management plans and capabilities, we challenge the stakeholders ranging from the board executives to the operational management teams with the most uncomfortable events. Because experience has shown us when one is faced with a crisis, the mindset at the time will shape the outcome.

    Our crisis management program is based on three key phases. Throughout these phases we objectively test internal processes and critical controls performance including communications for effective response and recovery management.

    We objectively test internal processes and critical controls performance including communications for effective response and recovery management. Whistle-blower, anti-corruption and bribery and workplace conduct policies, processes and associated controls are those foundationally tested when dealing with cultural and moral crises. How these are designed, embedded, and practiced at all levels within the organisation plays a vital role towards culture.

    Leadership actions points

    What is clear as we begin to see the tail end of the pandemic is that leadership teams need to ask better questions. The difficult and confronting questions; the black swan.

    Can you confidently say that your people feel safe enough to report concerns and cultural violations?

    We need to consider the scenarios we’re training and exercising, and how we’re responding to them. By practising this now, you may be asking questions you know are not being answered internally but should be.

    Through simulated exercising of cultural and moral types of scenarios you can strengthen your organisational resilience maturity and risk avoidance plans whilst testing you and your team’s crisis management capabilities in a safe to fail environment.

    Because, as we’re seeing with Ansell, Rio Tinto and icare, if there are issues simmering deep in the fabric of your organisation’s culture, they will be found and become a fire very hard to control.

  • The moral and financial impacts of the invasion on Ukraine

    The moral and financial impacts of the invasion on Ukraine

    Written by Commercial Marketing Manager, Ollie Law, and the RiskLogic Consulting Team.

    Recently, McDonalds announced it would be suspending all operations in Russia and closing over 650 of its restaurants. The continued pay out of 62,000 salaries alongside an immediate stop to sales will equate to a loss of 9% global revenue. Their exit was followed by a chain of other suppliers like Coca-Cola and Starbucks.

    These moves are as much a sanction on Putin’s war as they are a statement to the world. Soon, if not already, it will be common expectation that all businesses exit from Russia, particularly as institutions like Yale publicly compile lists of those who remain.

    Credit: Potato Pro

     

    With this expectation comes a balancing act of moral responsibility and serious financial loss. Millions of people are about to lose their jobs, shareholders may become uneasy and further recessions will be announced as businesses lose key trade options in Russian Markets.

    Tim Archer, RiskLogic’s Head of Crisis Communications reiterates the entire community is sharing the load and knock-on effects of the sanctions.

    We are all having to reach into our pockets and pay our bit. No one loves the idea of paying $3/litre for petrol, but it’s the collective price we are having to pay to try to stop a war.

    Media always search for new angles

    With the continuous live coverage of the invasion of Ukraine stretching into weeks and possibly months, journalists continuously search for stories with fresh angles. This creates both an opportunity and a risk for businesses that trade in Russia.

    “Some businesses have achieved some good PR out of their withdrawal from Russia, but this must be carefully stage managed,” says Tim Archer.

    Credit: Play Stuff

     

    “Organisations that are still active in Russia need to pay close attention to their decision. They may not be able to afford the financial hit, but they need to weigh up the reputational hit they could take from not withdrawing.”

    Adapting to change

    The tariffs that were inflicted on Australian barley farmers by China in 2020 provide an example of the need to adapt and find new markets quickly.

    Australian farmers were frozen out of the market, with China instead sourcing unprecedented volumes of product from France, Argentina, Canada, and Ukraine.

    Credit: Agric AU/WA

     

    It is unlikely that these farmers had such a crisis in their response plans. In fact, farmers do not tend to write business continuity plans.

    “Farmers are very good at adapting to adversity,” says Tim.

    “Floods, droughts, disease, locusts, mice and market volatility all pose a constant threat to their business. They pivot quickly and are highly innovative, working hard to find and realise new sources of profitability where they can find it.”

    Organisations should take a page out of the farmer’s manual. Aligning corporate level resilience strategies to the attitudes and resilience of farmers is a good option during this period of unknown and angst.

    The invasion and subsequent global downturn are events where adaptation, innovation and agility are most needed.

    Is a business continuity plan (BCP) the right tool?

    “A BCP may not be the right tool to help [you] through a reputational impact event, and this is likely what will be the initial, biggest impact,” says Head of Consulting, Brad Law.

    “This war has the hallmarks of a smouldering crisis for organisations. As such, we are advising our clients that fall into the bracket of ‘most at risk’ to consider a few actions to avoid a crisis creep.”

    • Activate your crisis team and leadership team
      • Begin a watch and wait state of readiness.
      • Begin conducting an initial assessment to determine where your operations fall under Russian influence, supply chain, in country operations and third-party alliance.
    • The Crisis Team should conduct a pre-mortem.
      • This involves an exercise to identify potential failures.
      • It is used to assess likelihood of occurrence and then to plan contingencies before they occur.
      • It is typically used before something goes wrong, but equally effective in forecasting potential impacts after a crisis event.

    Brad also goes on to say that organisations need to be doing some analysis on monetary loss vs reputational impact. This has been one of the most recurring concerns from our consulting team and one that could affect most businesses.

    “Doing ‘the right thing’ is going to come with a financial hit. But by doing so, you may benefit from long term favouritism from your customers and stakeholders,” Brad says.

    Training and exercising are key

    New Zealand Resilience Consultant, Cameron Smith is collaborating with our Principal Consultant Michael Wells on a new scenario exercise in Sydney.

    Solely reliant on China for their stock, one of our clients realises the very real risk this business relationship currently holds.

    In one of our recent scenario exercises, this particular client wanted to practice an escalating Russian situation alongside a hypothetical Chinese invasion of Taiwan, says Cameron.

    Credit: Nikkei Asia. Tsai Ing-wen and Xi Jinping.

     

    After practising and reviewing the exercise, what was clear – once again – was the reputational impact far outweighed the financial. The impact of losing all stock access by pulling out of China would be immediate, but mendable. Whereas the reputational impact of the business maintaining Chinese relations was seen as a long-term impact.

    As we are seeing in Ukraine however, there are some nations that have no option but to withdraw operations in Russia. Government mandates can mean a blanket ban on organisational trade between another territory, potentially narrowing your issues down to significant loss of supply chain.

    Doing exercises now have major advantages:

    • You can formulate a response to the immediate situation.
    • Identify strategies to manage customer impacts from the disruption to services.
    • Develop a strategy to communicate to impacted stakeholders and media.
    • Formulate an on-going resumption strategy until business-as-usual can be restored.

    New South Wales Principal Consultant Michael Wells says “one of the key threats on this year’s BCI Horizon Scan Report was regulatory changes. This month I am doing an exercise for one of our more mature clients who wanted to challenge themselves with regulatory and supply chain disruptions.”

    What does the war in Ukraine mean to you?

    This week, Michael Wells provided stern advice on what to do next.

    Organisations should think about what this current crisis and geopolitical tension could mean to them at an organisational and operational level

    He is right, whether you have ties with Russia or are at risk of losing supply chain or reputation, you do have a moral responsibility to how your organisation responds.

    If you have not practised this, now is the time.

  • Organisational Resilience and the 4 Levels of Maturity

    Organisational Resilience and the 4 Levels of Maturity

    When we talk about “organisational resilience” at RiskLogic, we’re implying the implementation and maintenance of crisis management, incident management, emergency management, and business continuity. As a minimum, we would label a well-versed resilient organisation as one that has at least those four disciplines in place, are practised and are recognised as a part of the organisational culture and strategy.

    But with most things, there is always room for improvement, even for those who tick many of the response and resilience boxes. Therefore, the next stage up for some may be those who have embodied pandemic management, crisis communications, technology, or annual scenario exercise training.

     

    As the world navigated through the covid pandemic, there is one question that was asked in just about every initial conversation with clients:

    How does our organisation stack up from the rest?

    There are many ways to measure this through complex programs and business impact analysis and reviews, but this doesn’t score you against another organisation as a benchmark. What we do is narrow the steps into four stages. We call these, The Four Levels of Resilience Maturity. 

    By breaking down what constitutes each level and what an organisation would need to measure themselves against, we are able to align ourselves to a tried and tested framework we know works.

    Four levels of organisational resilience

    Shared widely at the RiskLogic and Department of Health Emergency Management workshop in 2020, Principal Consultants, Joanne Costa and Dr Rebecca Hoile broke down what each level constitutes.

    Level 1: Aware

    Elements across some areas of resilience are established. 

    • Organisational resilience is established to a small degree and includes, risk management, emergency management, crisis management, business continuity.
    • Policy established for one or two areas.
    • Basic response team established.
    • Some procedures in place.
    • Low level of cultural awareness.

    Level 2: Applied

    Components of a Resilience Program are in place and communicated. 

    • Deeper understanding and implementation of the components of a resilience program.
    • Several policies with one overarching resilience policy.
    • Established business continuity program, but it’s not yet fully implemented and realised.
    • Some response and recovery plans, but perhaps

    Level 3: Embedded

    A cyclic program is in place across all elements of business resilience. 

    • A cyclic program in place across all areas of business resilience.
    • Completed at least one life cycle of the resilience disciplines annually.
    • Embedded an established business continuity management system to manage programs.
    • Identification of strategic and operational level teams; including strategic planning, a governing body, or identification of who would be activated during a crisis.

    Level 4: Mature

    Organisational Resilience is at the core of organisational values, operations and service.

    • Resiliency is at the core of company values, operations, and services.
    • Systems, frameworks and policies in place across all areas of resilience, scheduled, practised and reviewed at least two life cycles every year.
    • Regular team training.
    • Passion, genuine interest, and organisational culture would be embedded across all areas of the business and referenced during onboarding.

    The elusive fifth level

    Implementing and managing the required steps to be considered a mature, resilient organisation is a sizable, long-term commitment in itself. If more organisations had these levels in place pre-pandemic, the outcome would have been significantly different. But there is another level some are beginning to venture into this year; the ISO 22301 accreditation.

    A permanent commitment and annually reviewed by official bodies like the BSIISO 22301 could be considered the final frontier of resilience practises.

     

    This accreditation is as much a statement to the market and investors as it is a useful tool to maintain constant, strong resilience practices. This has been shown by our client NTT who have continued to work on their accreditation for a few years now.

    The program suits large enterprises that service on a global scale, wishing to dominate tenders, and prove strategic, ongoing management at an elite level to their shareholders.

    Resources coming soon

    In the coming weeks, RiskLogic will begin to share complimentary materials and resource to help you understand where on the resilience journey you are.

    Carefully curated by our Principal and Senior Consultants, the assets will encourage you to provide better insight into where your organisation is on the four-level scale, help determine or consider timescales and stakeholders to reach (or improve) each level, and begin the conversation of ISO 22301 accreditation (if applicable).

    You will have access to:

    • A self-assessment resilience matrix.
    • A simple, single page brochure of the four levels to share with colleagues.
    • A snippet of the RiskLogic and Department of Health Emergency Management webinar where Dr Rebecca Hoile discusses the levels in more detail.
    • An opportunity to book in a 30 minute call directly a member of our consulting team.

    Access to these materials will be available in the coming weeks. Make sure to keep an eye on your emails and our social media for more news.

  • Business Continuity: The Fundamental Guide

    Business Continuity: The Fundamental Guide

    What is business continuity and why is it important?

    When an emergency, disaster or related incident occurs a business must be able to continue its operations if it is to remain functional. Business Continuity refers to this ability for a company to maintain functionality despite any setbacks that are occurring internally or externally to the organisation.

    Business continuity is so important because without it, a business will be unable to continue their operations if an emergency, disaster, or related event strikes. During this day and age where downtime is unacceptable by consumers, it’s imperative your business equips itself with the capability and tools to efficiently continue operations no matter the event.

    For example, some threats such as a cyber-attack or extreme weather event is a likely scenario that may occur at any time without any warning. In fact, these days it seems these events are becoming more and more likely. By having a business continuity plan in place to deal with these scenarios, you maintain your resiliency whilst also saving time and money in keeping your business operational.

    The components of a successful business continuity plan

    Strong business continuity consists of the following 4 stages of the business continuity lifecycle:

    Planning

    Planning is the first step in the business continuity lifecycle and arguably one of the most important. By planning for a wide variety of emergencies, disasters or related incidents, your business continuity plan gives your business and its stakeholders a clear direction on how to maintain resilience.

    Your business continuity plan should endeavour to identify all the key vulnerabilities and responsibilities you have to consider and work through in the event of disruption.  

    . On top of that, it should also outline and design processes to remain resilient. Things like staffing rotations, data redundancy and maintaining a surplus of capacity are all examples of actions your plan could include to remain resilient.

    Training & Exercise

    Business continuity should be a process that is constantly changing and evolving – it should never simply sit on a shelf once it is planned out. For starters, the business continuity should be communicated to as many people that it impacts as possible. It is fundamental to your business resilience  your stakeholders and staff are all trained on how to follow the processes within your plan.

    This testing is critical to the success of your business continuity plans when an actual emergency does arise. Without this testing phase, how do you know if the plan works when a real emergency does happen?

    Training exercises can include tabletop exercises, emergency evacuation exercises, shelter in place exercises and more.

    Our realistic scenario-based exercises are tailor made to your organisation and are our most sought after offering in the business continuity space.

    Maintenance

    You’ve now outlined your business continuity plan, trained your staff and performed exercises to mimic the plan. What’s next? Once training & exercises have been completed, notes should be taken on what worked and what didn’t; and the plan updated accordingly.

    This process of tweaking and updating your business continuity plan helps your organisation maintain its resilience; not only for threats that we know of today but also those which become apparent in the future.

    Common challenges businesses face with continuity planning

    Although business continuity plans are designed to aid your business with unprecedented challenges you may have to face, continuity planning also harbours several challenges. The most common of these challenges include:

    Lack of resources

    When the business is operating as intended, the likelihood of a disaster is often downplayed and ignored. Diverting resources to business continuity programs may slow down business growth when the benefits of the plan are only apparent when things are going wrong.

    Despite this lack of benefits, when an emergency does strike the value of a business continuity plan is immense. To better understand this and justify the diversion of resources – try making a clear budget of the exact cost to your business if things go wrong compared to the cost of a business continuity plan.

    Lack of organisational engagement

    It can be difficult to get members of your business to be engaged with the business continuity plan. Even during training or exercises, staff members are not guaranteed to pay as much attention to the plan as you would like. This can mean that the effectiveness of the plan is impacted negatively by staff members not knowing how to follow the plan.

    One way to potentially help with this issue is to involve staff members in the planning stage – helping them better understand why the plan is so important and how it can protect them and their livelihood.

    Constant training

    As outlined earlier your staff and relevant stakeholders must be trained in order to effectively carry out the plans in your business continuity plan. However, as new threats arise your business continuity plan will constantly be changing and updating as time goes on.

    On top of this, your staff members are likely to one day no longer be a part of your business. When they leave, so does their knowledge of your business continuity plan and their replacement will also need training.

    To help mitigate this, try using training methods such as flexible online options to help make training as accessible as possible and not impede on business operations.

    High complexity

    As mentioned earlier, despite our strong understanding of current day threat environment there will always be new threats that become possibilities in the future. It can be difficult to keep up with these changing threats into the future.

    One of the best ways to overcome these increasing complexities is to hire experts to keep up with these changes for you.


    Business continuity allows your business to continue its operations and minimise impacts in the face of emergencies and threats. It’s imperative  you equip yourself with the capability and tools to overcome these challenges no matter the event.

    RiskLogic is a premier business continuity services provider, having serviced some of Australasia’s largest organisations and supporting them in their journey toward resilience. Contact us today to discuss your own businesses resilience and business continuity planning.

  • Emergency and Crisis Management Aged Care sector: a training success story

    Emergency and Crisis Management Aged Care sector: a training success story

    Last month marked the end of an 18-month program that saw RiskLogic, together with First 5 Minutes, train almost 2,000 managers or senior managers in crisis management in the aged care sector. Whilst being well‑versed in emergency management and clinical care, many participants recognised that they weren’t adequately prepared to respond to complex incidents. The program was tailored in partnership with the Australian Government Department of Health and Aged Care (Department). The Emergency and Crisis Management Program was prioritised for the aged care sector due in part to the recommendations of the Royal Commission into Aged Care Quality and Safety, with the aim to support senior leadership development through targeted training.

    Delivered against the backdrop of declared natural disasters, the training proved timely and relevant for aged care providers preparing for, and responding to, a range of high impact issues. It ensured that if a crisis or emergency situation were to occur, all staff of the facility would be able to respond in a timely manner and provide confident instruction to occupants to get to safety.

    RiskLogic developed a series of short online modules together with group and 1-2-1 mentoring sessions which enabled participants to apply knowledge gained and step through crisis management tools with leading advisors. The program covered areas including, threat environment, crisis management principles, activation of response teams, governance, and critical communications.

    RiskLogic’s analysis of pre/post training survey responses (from almost 2,000 training participants) identified a significant improvement in participants’ emergency and crisis management capability. – DoH

    At the completion of the course 95% of participants rated their understanding of escalation and assessment of emerging crises as either Good or Excellent, displaying a significant shift in understanding and application of tools. The ability to make adequate assessments early enables leadership to establish and maintain control, reducing risks and further impacts to critical operations.

    Participants’ knowledge related to the role of the Governing Body rose from 46% to 93%. The role of the Governing Body, whether a small leadership team or board is critical to managing an emergency or crisis. – RiskLogic

    For many across the targeted sector, this program provided the initial exposure to the key phases, concepts and response strategies related to crisis management. While many organisations are well established in responding to critical incidents, the ability to adequately prepare for and respond to complex emergencies or crises requires further collaboration and development.

    The ability to demonstrate sound understanding of operational and strategic interdependencies like crisis management, crisis communications and business continuity is an asset to any leadership team and a skill set that can be addressed through a tailored industry program such as this.

    Throughout the program, RiskLogic’s proactive and committed approach generated increased participant engagement (amongst an already time-pressed cohort). This was supported by the development of high‑quality, tailored training materials, which helped to deliver tangible improvements in aged care sector emergency/crisis management and preparedness. – DoH

    Many organisations continue to manage the flow on effects from the pandemic, in parallel with workforce continuity stress, and impacts of recent flooding. As the need for adaptation and flexibility rises, organisational resilience has never been more pertinent in establishing support for people, the workplace, and business operations.

    The training program developed for the Department demonstrated our ability to support leadership during difficult times with skills and resources that were immediately implemented.  Consider how we can support your industry in the coming months to build your resilience maturity. Contact RiskLogic now to learn more.