By:
On:
In: *Connecting the Dots Blog*, Incident Reporting, Workplace Violence

  The Centers for Medicare and Medicaid Services needs to improve the way its staff and contractor staff process complaints from its waste, fraud and abuse hotline.  Long timeframes and inefficient processes have delayed starting work on many complaints.  On average, more than five months passed between CMS receiving complaints from OIG and contractors beginning work on them. Lessons Learned: It is critical for government agencies and all organizations to improve responses to tips and hotline complaints.   Not only are five months of inaction un-excusable, but  employees aware of this timeframe will no longer trust and will no longer report incidents to hotlines that doRead More →

By:
On:
In: *Connecting the Dots Blog*, Government, Human Resources, Workplace Violence

  The Ethics Resource Center’s (ERC) recent survey revealed that 40% of employees observing misconduct do not step forward to report it out of fear of retaliation, mistrust or feel their reports will be ignored. Lessons Learned: Organizations must develop secure, anonymous and/or confidential reporting solutions to empower all employees (and third-parties) to report suspicious incidents, violence, fraud, misconduct, ethical violations, etc.  And once an incident has been reported, all appropriate personnel (ethics, legal, management, compliance, safety, law enforcement, etc) should be immediately and automatically notified to ensure a timely response and ensure red flags do not fall through the cracks. Based on other surveysRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Security

  A review of security practices and investments at 46 global organizations finds that compliance with industry security standards actually saves money over the long-term.   A recent Ponemon Study revealed that companies that consistently comply with security requirements and standards save three times more in security-related expenses annually than non-compliant companies. Lessons Learned: Compliance does not equal security, but security can benefit from compliance.  Organizations investing in comprehensive compliance programs are better prepared to prevent expensive breaches, lawsuits, fines, etc. and save money and resources over time.Read More →

By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Information Privacy, Information Security

  A targeted phishing e-mail with the subject line “2011 Recruitment Plan” tricked an RSA employee to open a document attached to an e-mail.  The document contained a virus that led to a sophisticated attack on RSA’s information systems. Lessons Learned:  Are your employees aware of changing and more sophisticated risks?  Does your organization update employees with situational awareness as more and more attacks target your employees?  All employees must understand their individual roles and responsibilities for protecting sensitive information.  Organizations need to implement comprehensive and ongoing awareness programs to ensure all individuals understand changing risks, threats, best practices, etc.Read More →

By:
On:
In: *Connecting the Dots Blog*, Regulatory Compliance, Risk Management

  Miami-based Pacific National was fined a $7 million penalty for violations to the Bank Secrecy and USA Patriot acts. Lessons Learned: Fines for gaps in AML practices are becoming more severe.  Financial organizations must ensure they have the appropriate policies and procedures in place and ensure their people are aware and accountable for their decisions to meet ongoing compliance requirements.  Organizations also need legal-ready and audit-ready documentation to avoid expensive fines, lawsuits, and embarrassing headlines.Read More →

By:
On:
In: *Connecting the Dots Blog*, School Safety

  What does recent a school survey reveal about ‘thou shall not snitch’ culture?  Can schools take advantage of real life situations to create a culture of preparedness, safety and prevention? The responses to this survey at H.D. Woodson High School reveal opportunities for schools to open the lines of communication, but only if school leaders understand how to relate to students and how to build trust with students. Lessons Learned:  Status quo responses to a survey, status quo comments from adults and status quo news articles validate how status quo approaches are not going to solve the problems and new challenges schools and communities faceRead More →

By:
On:
In: *Connecting the Dots Blog*, Uncategorized

  I have attended several threat management and risk management seminars this year, and it seems like many of the speakers and experts have fallen under the spell of “super-should-a-docious”. Many of the speakers and experts continue to express “You should do this” and “Your people should do that” or “You should implement best practices” and “Your people should know this/that” and on and on. And at the seminars and conferences I have been attending, I sense that attendees  are starting to get tired of the same old “should” dance and would rather hear about solutions that allow them to implement all the “shoulds”.  It’sRead More →

By:
On:
In: Campus Safety, Education, Government, Incident Reporting, Regulatory Compliance, School Safety

  The Department of Education and Office of Civil Rights sent out a “Dear Colleague” letter in October 2010 outlining schools’ responsibilities for being aware of, responding to and preventing future incidents of bullying, discrimination and harassment.  In response to the National School Board Association’s letter questioning a school’s responsibilities, the  Department of Education response clearly states it did not overreach in its original guidance to school officials— it only reiterated existing laws and policies and gave examples of how school districts can help combat bullying and harassment. Lessons Learned:  Schools have been put on notice and must develop comprehensive programs to respond to incidentsRead More →

By:
On:
In: *Connecting the Dots Blog*, Campus Safety, School Safety

  Raymond J. McNulty, president of the International Center for Leadership in Education discusses that in order to see real change in our schools and move the needle on closing the achievement gap, school leaders need to try some things that aren’t “proven.”  Organizations need to experiment with “next practices” not best practices that have been researched and proven. Lessons Learned:  As Einstein said long ago, “Insanity is doing the same thing over and over again and expecting different results.”  Lessons learned have clearly shown that schools need to replace traditional and status quo methodologies with new and innovative tools to help improve student achievement,Read More →

By:
On:
In: *Connecting the Dots Blog*, Campus Safety, Emergency Management, Incident Reporting, Legal, Regulatory Compliance, Risk Management, School Safety

  Virginia Tech was fined the maximum fine allowed under the Clery Act of $55,000 for waiting almost two hours before warning students, faculty and staff of an active shooter on campus. Lessons Learned: Colleges and Universities must develop, implement and follow clearly defined policies and procedures for notifying students and staff in emergency situations.  School Administrators may want to create customizable, organizational and situational specific templates prior to an incident so the warning messages are already defined and the appropriate processes are understood by all appropriate personnel.   Organizations must also have customized emergency and crisis management plans and ensure all individuals (students, faculty, staff,Read More →