Archive for January, 2016

Getting Started with Business Continuity

Sunday, January 31st, 2016
Risky Business

Risky Business

The toughest challenge in any new process is taking the first step. Once you have started the work, you can build momentum to carry forward. Let’s consider how to get started with business continuity planning. First and foremost, you must consider human safety. Begin by considering plans to ensure the safety of your employees and their families in the event of a disruption to your normal operations. Do you have basic safety measures at your place of work? Can you put together an evacuation plan that you will implement on a moment’s notice if called to leave your workplace?

This process is important for many reasons, including the opportunity to secure buy-in from your employees to contribute to what they may perceive as an increase in their responsibilities. Share with them the thinking and methodology behind the planning process and how applying this approach in their homes can enhance the safety of their households and extended families. Engage all of the stakeholders in your company in the planning process, such as your suppliers, your neighbors, your service providers and others in your community. The ability of your company to stay up and running in a disaster is dependent, in part, of the ability of others to perform their responsibilities even in challenging and unexpected circumstances.

Next, start to assess the key assets of your business. This is not as easy as it first appears and the results of this process may trigger some surprising insights that can position your business for even greater success. Here is an example from my own experience: a neighboring business won a $25 million contract to do app development for a financial data provider. When their building burned to the ground, they were able to safely evacuate all of their people and insurance covered the cost of replacing their computers and furniture.

But the key asset of this business was not its physical property; it was the intellectual property – the hundreds of thousands of lines of software code that its developers and programmers had written for the financial client. They had failed to back up their code offsite and so lost everything.

This is an important insight because in a service and knowledge economy, our most important assets are often intangible, such as intellectual property or even reputation for stellar customer service. So begin by identifying those assets and how you might protect them.

Then it is time to perform due diligence on your own company and closely examine your own processes and procedures. You need to develop operational manuals to document what you do to systematize your processes. Even the most experienced pilots develop checklists as, in stressful conditions, it is too easy to overlook a critical procedure. As you consider your work processes, you will inevitably discover ways to improve upon them. More importantly, putting formal procedures and systems in place will help to scale and grow the business – and reduce the level of demands made upon the business owner with the stress that accompanies those demands.

I will be sharing these and other approaches to small business risk resilience in an interactive webinar offered by Datto’s and scheduled for February 4, 2015 at 2:00 p.m. EST. To register for the webinar, please click here. Upon registration, you will receive a “Risk IQ Test” to see if your framework properly estimates the risks to which small businesses are exposed! We will begin our webinar by sharing our findings and conclude our webinar with resources for follow-up support and a blueprint that small businesses can use to begin simple measures to protect their businesses. I hope you will join us!

Emerging Health Risk – Zika Virus

Saturday, January 30th, 2016
Be Well

Be Well

The Centers for Disease Control are working to educate the public about the risks arising from Zika fever, a disease caused by infection with the Zika virus, that is transmitted to people by mosquito bites. The most common symptoms of infection are fever, rash, joint pain and red eyes. A vaccine or cure for Zike does not yet exist. Treatment for infected patients focuses on relieving symptoms and including rest, re-hydration and medications  for fever and pain. The Zika virus first came to the attention of officials charged with public health responsibilities last May when the Pan American Health Organization issued an alert regarding the first confirmed Zika virus infection in Brazil.

The outbreak in Brazil led to reports of Guillain-Barré syndrome and pregnant women giving birth to babies with birth defects. Having worked in parts of the world where preventive measures were not entirely successful in helping me to avoid mosquito-borne illnesses, I would, out of an abundance of caution, defer traveling to regions where outbreaks have occurred. The CDC has an online map tracking the spread of the virus. If your company engages in international business travel, you can subscribe to free online alerts to health risks across the world. Take advantage of these tools to stay informed and make sure that your employees remain safe. Pay particular attention to the special needs of employees who are pregnant or may be vulnerable for other reasons.

Protecting Against the Risk of Carbon Monoxide Exposure

Friday, January 29th, 2016
Losing Oxygen

Losing Oxygen

Carbon monoxide is often called the “silent killer” as it is an odorless and colorless gas that is the product of fuel combustion. Approximately 430 people die each year from carbon monoxide poisoning, mostly as a result of carbon monoxide inhalation while sleeping. Low-level carbon monoxide exposure can result in symptoms, such as headaches and nausea.  There are basic measures that you can take to protect against the risk of carbon monoxide exposure.

Reduce the risk that carbon monoxide gas levels will increase in closed areas. Certain appliances that produce carbon monoxide should only be used outside in well-ventilated areas, such as back-up generators and gas and charcoal grills for cooking. Fuel-burning appliances that are used inside the home and office, such as furnaces, cooking appliances and clothes washers and dryers, for example, must be properly maintained. Ensure that when carbon monoxide is produced, it does not accumulate in an enclosed or sealed area, raising the risk of poisoning. If you warm your car or use a remote starter, remove it from the garage before starting it. Verify that the exhaust pipe of a running vehicle is not blocked by snow or ice. During and after a snow storm, make sure that the vents for your furnace, stove, fireplace and dryer are clear of snow and ice accumulation.

Install carbon monoxide detectors and understand how to use them. Install carbon monoxide detectors outside each sleeping area and on every level of your home and office and in other locations as required by local codes. It is best to interconnect all of the alarms through the home or office, such that when one sounds the alert, they all do. Make sure to follow the manufacturer’s instructions for proper mounting of the detectors. The alerts issued by carbon monoxide and smoke detectors can be distinguished from one another – when the alarm sounds four times, that indicates carbon monoxide has been detected; three times means that smoke has been detected. A chirping noise may suggest that the battery power is low, so check it right away. If the chirping continues, call for help. Test your alarms monthly and replace the batteries when you change the clocks in the fall and spring seasons. Carbon monoxide detectors have a lifespan of about five to seven years, so be sure to replace them as needed.

Understand how to call for help should you suspect carbon monoxide exposure. As part of your business continuity planning, you should have on hand the non-emergency number of the fire department to call should the carbon monoxide detector sound an alert. If you hear the alert, evacuate the area by going to a fresh air location outside of the property. Be sure that everyone has safely exited the property. Once safely outside, call the fire department for help. Do not open the windows or switch off the appliances in the area as the fire department will need to examine them to determine the source of the carbon monoxide leak. And, in connection with your business resilience planning, share this information with your employees so they may ensure that their families and homes remain safe.

Invisible Hazard: Carbon Monoxide

Thursday, January 28th, 2016
Losing Oxygen

Losing Oxygen

According to the Small Business Administration, there are 23 million small businesses in the United States, of which 52 per cent operate in the homes of their owners. The benefits include reduced overhead costs and improved quality of life. But this arrangement is not without risk and, as I discovered, unknown hazards in my live-work space presented life-threatening risks to which I was exposed sometimes in excess of 20 hours daily.

I rented a two-story, two-bedroom town home condominium with an option to purchase it. The property appeared run-down for lack of proper care, but I did not appreciate how dangerous it was until I had a home inspection performed. The landlord had presented me with his purchase and sales agreement that stipulated “no inspection – as is”, a very big red flag. As the legal right to a pre-purchase home inspection cannot be waived, and as I had not (and never did) sign the purchase and sales agreement, I decided to have a home inspection performed in the property where I had lived as a tenant.

I hired a well-regarded military veteran who is a “Certified Master Inspector”, one of only five people in the state to have attained that level of professional standing. He spent a day at the property and produced a 49-page report identifying serious violations of the housing code. These violations represented threats to my health and safety and to the health and safety of the other building residents. He found multiple sources of carbon monoxide leaks and the absence of carbon monoxide detectors, as required by state law. With respect to the latter hazard, there were detectors in the home that appeared to be dual-use smoke and carbon monoxide detectors, but they were mis-labeled. The units detected only smoke. Or, I should say, they would have detected smoke if they were working – they were over ten years old and not functioning. I was unaware of that hazard. I had no way of determining the age of the smoke detectors (the home inspector did) and as I had replaced the units with fresh batteries, I believed all was well.

Many of the housing code violations were not visible to me, making this home inspection a good investment as it helped me avoid serious problems that would result from purchasing the property. The home inspector found that the water heater exhaust pipe had improper pitch and was not properly sealed. This condition caused the back flow of combustion air that prevented the system from heating the water as it was designed to do. The perforations in the exhaust pipe discharged carbon monoxide into the living space. We contacted the manufacturer of the water heater and after checking the serial number of the appliance, learned that the property owner had installed the water heater himself. The city housing inspector confirmed that the property owner/landlord had done this work without the legally required permit.

Because the city had not issued a permit, the city inspectors were unaware that the work had been done and so did not inspect the heater after the installation, as is their practice. The landlord had told me that the water heater had only recently been installed, just before I moved in. According to the records of the manufacturer, the installation had been performed eight years prior, meaning that previous tenants (and one was a divorced man with three children) also experienced chronic exposure to carbon monoxide without being aware of the risks.

My primary physician, upon learning this information, ordered tests to check the levels of lead and carbon monoxide in my blood. As I don’t work in a profession that exposes me to toxic environmental risks, and as Rhode Island has laws requiring carbon monoxide detectors in all residential properties, my physician had ruled out possible carbon monoxide exposure as the cause of my malaise.  As someone who works in the field of risk management/insurance, I was embarrassed to find myself in this situation. I was stunned to learn that Rhode Island does not require rental permits or property inspections prior to leasing a residence. And I learned that over the past ten years, the tenants living in the property had all kinds of problems. According to my doctor, while you can improve your symptoms of carbon monoxide exposure after a walk in the fresh air, the signs of the exposure can be detected for some time thereafter through blood tests.

Enabling your business to be disaster-resilient requires time and care to the safety of your home and the homes of your employees. You cannot give your full attention to the business if you are worried about the safety of your home and family. And if you work from a home office, you have an additional risk factor to consider, one that is more difficult to manage if you lease, rather than own, the property.

Seasonal Elevated Risk of Carbon Monoxide Poisoning

Wednesday, January 27th, 2016
Losing Oxygen

Losing Oxygen

A recent news story highlights that the risk of carbon monoxide poisoning is elevated during the winter season due to the operation of unsafe heating systems. The news story reported that earlier this week, nearly 50 people were hospitalized for carbon monoxide poisoning after they attended an event at an East Providence social club. The chirping of the carbon monoxide alarm alerted the guests to the hazard.

The East Providence social club had carbon monoxide detectors installed, even though it was not legally required to do so. The fire department determined that the levels of carbon monoxide in the air were 300 parts per million, sufficiently elevated to cause headaches and nausea. The carbon monoxide had been released into the building from the blocked air vent of a gas-fired boiler that was overdue for cleaning. This story caught my attention as, in an unrelated incident, I was also exposed to elevated levels of carbon monoxide. I learned lessons from that experience that I would like to share with the small business community.

Lesson #1: Your state’s requirements for the installation of carbon monoxide detectors may apply only to residential buildings.

The National Fire Protection Association Life Safety Code requires that carbon monoxide (CO) detectors be installed in residential buildings, such as single-family homes, condominiums, apartments, dormitories, hotels, etc. The reasoning behind this requirement is that each year, approximately 430 people die of CO poisoning; most of the deaths occur at night when people inhale CO during their sleep. That is why local codes typically require that CO detectors be placed in bedrooms as well as in utility rooms where gas-fired appliances are located.

The Code does not apply to commercial facilities as officials believe that people exposed to CO would be awake and alert at their place of work and should they experience headaches or other symptoms of CO poisoning, they would seek help in a timely manner.  I disagree with this line of reasoning. While people might be awake and alert while experiencing headaches and nausea, they might not recognize that such symptoms may be the result of carbon monoxide exposure. People working longer hours might have longer exposures as they would not be leaving the facility to inhale fresh air at the end of the 8-hour shift.

Chronic, low-level poisoning, while usually not fatal, can cause other adverse effects. In the absence of CO detectors, the business owner remains unaware of the hazard. To ensure your safety and that of your employees and visitors, do more than you are legally required to do.   Install carbon monoxide detectors in your workplace.

Lesson #2: The risk of carbon monoxide exposure increases during the winter season.

You are at elevated risk of carbon monoxide poisoning during the cold weather. During the winter months, people increase their use of heating systems and keep their windows closed and their homes tightly sealed. Be certain to perform the recommended annual cleaning of gas-fired appliances (such as your boiler or furnace, cooking appliances, dryer) to mitigate this risk. Cars and trucks are also sources of possible carbon monoxide exposure, particularly during the winter months. People may start their cars in their garages, keeping the garage doors closed to avoid the cold until they are ready to leave, or have the engine running by the use of a remote starter in a closed garage. The carbon monoxide that is discharged from the tail pipe accumulates in the closed garage (which typically does not have a carbon monoxide detector) can be lethal. Another source of exposure in the car arises from snow and ice packed against the tail pipe such that carbon monoxide levels build up in the car as the motorist runs the engine to stay warm.

Lesson #3: After a suspected case of carbon monoxide exposure, exit the building, but leave it as is for the fire department to properly evaluate the hazards.

If your carbon monoxide detector sounds the alarm or if you experience symptoms of carbon monoxide poisoning, evacuate the building and call the fire department. Do not open the windows to air the place out or turn off the appliances. These actions will prevent the fire department from evaluating the hazards. The firemen will wear oxygen masks for their own safety while they work to identify the source of the leak and take the necessary corrective measures. If you open the windows or turn off the boiler before they arrive, you may unwittingly delay the time until you can safely return to the property.

Lesson #4: Some states may not require inspections to protect the tenants.

Prior to leasing a property in most states, the owner is required to obtain a rental permit that will be issued only after a satisfactory inspection of the property by city officials. If the inspector finds any hazards that could discharge carbon monoxide or if the required carbon monoxide detectors are missing, the owner must correct them and submit to a follow-up inspection before he may lease the property. The tenant has some assurance that the property is safe for occupancy. But, as I have learned the hard way, not all states require rental permits or some type of home inspection to protect tenants. In Rhode Island, for example, a property owner must submit to a city inspection in order to sell the property. The title to the property cannot be conveyed until the fire marshal has completed the inspection and the identified deficiencies have been corrected. But the owner can rent a Rhode Island property, even if it is not safe for occupancy.

In the next blog posting in this series, I will share with you the lessons I learned the hard way about carbon monoxide exposure. In the third and final posting, I will offer some tips to ensure the safety of your home and your business.


Safe Drinking Water

Tuesday, January 26th, 2016
Not To Be Taken for Granted

Not To Be Taken for Granted

Most of us probably take safe drinking water for granted.  I bring bottled water with me whenever I work in developing countries, as you cannot always trust the local water supply. I keep a bottle at the sink with my toothbrush and toothpaste on either side of the bottle as a reminder to use the bottled water when brushing my teeth or taking medications.  The citizens of Flint, Michigan did not take such precautions as they were unaware of the dangerous levels of lead in their public drinking water. The long-term consequences to children who consumed this water include impaired cognitive functioning. It is absolutely frightening to think that we cannot trust the water that comes from our kitchen tap.

I typically think of how to stay informed and prepared for water safety threats of a short-term nature. One of our neighboring communities was inconvenienced after a local construction company struck a water line when it dug in an area that was off-limits. After residents reported that the tap water was muddy, the community Facebook page issued an alert to advise residents to use bottled water until further notice. I always keep a supply of bottled water on hand for such an emergency, as I do not want to be in the position of going to the store to purchase water when I have an urgent need and so does everyone else. I also have a hazard alert on my smart phone to ensure that I receive the alerts in a timely manner. I expect that the situation in Flint will be addressed with some type of victims’ fund for those who have been harmed, along the lines of what was set up for the 9-11 survivors or those affected by the BP oil spill. These funds are becoming too common for our failure to oversee safe practices.

Winter Storm Jonas

Sunday, January 24th, 2016
This Weekend in New York

This Weekend in New York

Winter Storm Jonas covered the Northeast corridor with more than two feet of snow from Washington, D.C. through southern New England . The storm hit New York City on January 22 and continued through January 24. Heavy snow also impacted other parts of the country, with fourteen states receiving at least a foot of snow this past weekend. The highest recorded snowfall occurred in parts of West Virginia, with accumulations of more than 42 inches. For several locations on the East Coast, Winter Storm Jonas is the largest snowstorm on record.

Snowstorms represent a greater hazard to communities unprepared or unaccustomed to dealing with them. When I lived in Switzerland, a major snowfall was not a significant event. In New York City, the day after the snowfall, you wade through the melted slush as many areas lack proper drainage. Driving is hazardous, particularly in traditionally warmer climates. Do you remember the commotion that resulted not too long ago when Atlanta was struck by a snowstorm? If you or your employees drive in connection with your work commute or your work responsibilities (such as making deliveries), be sure employees understand safe driving practices in winter weather.

Allow extra time to arrive at your destination so you may drive more slowly and safely. Be sure that the gas tank of your vehicle is at least half full, as you may need to run the engine just to stay warm should you be delayed. Confirm that each of your company vehicles (or personal automobiles if employees use their own cars for work or commuting purposes) have emergency kits including a snow brush, flashlight (check the batteries), blanket, extra washer fluid, etc. Make sure your cell phone battery is fully charged should you need to call for help. Remember that tire pressure drops in very cold weather; verify that the tire pressure is adequate for safe handling of the vehicle.  Have your vehicle serviced by a qualified mechanic or technician to make sure that the car is safe to drive and all of the fluids (such as the windshield washer fluid) are topped up. And if you can avoid driving in the snowstorm, do so, work from home if possible.

Making the Case for Investment in Business

Friday, January 22nd, 2016
Risky Business

Risky Business

In the last post in this series, I presented a new framework for risk to help small business owners better assess the likelihood of experiencing the “everyday disasters” and appreciate the need for implementing business continuity measures. However, we all have lists of things we need to do, but fail to follow through as other matters assume priority. So the next step in our process to enable small business disaster resilience is to make the business case for the financial returns to business continuity programs.

Many people mistakenly believe that an investment in business continuity programs only pays off in the {unlikely} event that disaster strikes. Nothing could be further from the truth. A well-structured continuity plan will improve the profitability of the business even if disaster never strikes. Sharing this insight with the owners small and mid-sized businesses will help to motivate a greater sense of urgency to protect their businesses and raise the priority of investment in continuity planning in an appropriate way.

Let’s consider three specific ways in which continuity planning improves the profitability of the business. The first driver of profitability is the reduction in the cost of risk. A well-structured plan offers the opportunity to reduce the cost of insuring the business, with lowered premiums commensurate with improved risk management practices. Speaking from the experience of my own business, I was able to lower my commercial insurance premiums by more than ten per cent by sharing my continuity plan with my insurance carrier and even soliciting feedback and input from my insurer for suggestions as to how I might improve upon that plan, based on their institutional knowledge. The reduced insurance expense alone covered my up-front expense in data protection and other measures to ensure resilience.

The second manner in which continuity planning yields a positive return on investment arises from expanded market and procurement opportunities. I connection with their business continuity planning, large enterprises are re-evaluating the resilience of their supply chains. Their due diligence on prospective vendors explicitly considers the risks associated with their ability to meet their deliverables in the event of unexpected disruptions. Small and mid-sized businesses that have continuity measures in place are more competitive to win contracts and grow their revenues.

This is also true of public procurement. While government contracting officers do not always explicitly ask about continuity planning when they issue RFP’s, the form for response nearly always includes a section to address quality measures. This is the forum where I like to write about the measures in place to allow for consistent, reproducible results in uncertain conditions. This allows me to convey that awarding a competitive contract to my company is less risky than awarding it to a competitor owing, in part, to our thoughtful continuity planning.

The third, and most powerful manner in which continuity planning drives profitability is the creation of more robust systems that emerge from a continuity plan. Taking measures to protect your business requires that you begin with performing due diligence on your company. Can you identify your key assets? Are you able to document your business processes? Often as entrepreneurs start their businesses, they have informal, ad hoc and improvised ways of doing things. Effective continuity planning requires that you put systems in place for consistent results even in challenging conditions. Those systems will become a platform that will enable you to scale and grow your business. And as you undertake an examination of your company to determine how best to protect it, you will inevitably discover opportunities to do things differently – and more profitably.

I will be sharing these and other approaches to small business risk resilience in an interactive webinar offered by Datto’s and scheduled for February 4, 2015 at 2:00 p.m. EST. To register for the webinar, please click here. Upon registration, you will receive a “Risk IQ Test” to see if your framework properly estimates the risks to which small businesses are exposed! We will begin our webinar by sharing our findings and conclude our webinar with resources for follow-up support and a blueprint that small businesses can use to begin simple measures to protect their businesses. I hope you will join us!

Getting Small Businesses to Think About the Unthinkable

Wednesday, January 20th, 2016
It is all relative

Risky Business

Trusted advisors to small businesses, such as managed service providers (“MSP’s”), know the importance of enabling robust business continuity plans. As tech-savvy professionals, we are familiar with the depressing numbers:

  • Over 75 per cent of small businesses experience some level of data loss
  • 80 per cent of data interruptions can close a business for at least a day

Yet surveys of small business conducted by local chapters of the American Red Cross consistently find that two-thirds or more of small businesses fail to implement even basic continuity measures.

Why is it so hard to convince small businesses to protect their businesses, starting with basic data protection?

The answer, in my experience, is that most small business owners have a distorted assessment of risk. They believe that disasters will not strike them. In most cases they are right: extreme events, such as earthquakes, hurricanes and the like, are, by definition, high-severity/low-probability events. It hardly makes sense for a small business owner to divert his or her limited time and financial resources to address a low-probability threat when there are immediate needs, such as making payroll, that must be met.

The manner in which disasters are reported contributes to this distorted risk perception and false sense of security. The television news will broadcast vivid images of extreme weather, but since a computer virus decimating a hard drive is not visually interesting, it will not receive the same attention although, for the small business, it represents the greater threat.

That is why enabling small business resilience begins with reframing our perception of risk.  Prepare for the Worst, Plan for the Best: Disaster Preparedness and Recovery for Small Businesses presents a framework for risk analysis along a continuum of threats. At one extreme, we have the high-frequency/low-severity risks. These are the “everyday disasters”, such as human error, computer crashes and the like. At the other extreme, we have the high-severity/low-frequency disasters, such as earthquakes, hurricanes and other major hazards.

Conventional wisdom suggests that we should prepare for the extreme event, the worst-case scenario, and that subsumes preparedness for all lesser threats. That view generally holds true, but it should never form the basis of continuity planning for small businesses. Focusing on the catastrophic risks tends to induce complacency, as most business owners recognize that, by definition, they won’t likely experience an earthquake that measures 9.0 on the Richter scale. It also induces fear and paralysis, as small businesses cannot reasonably take all measures to protect themselves against terrorism and other threats.

A better approach is to begin by preparing for the high-frequency risks, the “everyday disasters”. This approach offers an immediate benefit against a more imminent risk at a more reasonable cost. And it gradually builds resilience against the more serious threats. The data backup the small business needs to recover a file mistakenly deleted by human error (the most common form of disaster) will be critical to the recovery from a more serious hazard.

So let’s begin to enable small business resilience by changing our risk framework. This approach will allow us to better serve small businesses. In the next blog posting in this series, I will discuss how to take this new risk framework and translate it into a more compelling business case for continuity planning.

I will be sharing these and other approaches to small business risk resilience in an interactive webinar offered by Datto’s and scheduled for February 4, 2015 at 2:00 p.m. EST. To register for the webinar, please click here. Upon registration, you will receive a “Risk IQ Test” to see if your framework properly estimates the risks to which small businesses are exposed! We will begin our webinar by sharing our findings and conclude our webinar with resources for follow-up support and a blueprint that small businesses can use to begin simple measures to protect their businesses. I hope you will join us!

Remembering a Life of Service

Monday, January 18th, 2016
A Life of Service

A Life of Service

I am working today, but on projects supporting the work of faith-based communities committed to responsible environmental stewardship – which is an appropriate way to spend the holiday!