Flawless Compliance

The Cost of Slipping Up

Gulf Coast Oil Disaster Wreaks Havoc

The oil rig Deepwater Horizon burns off the coast of Louisiana April 21, 2010. Picture Source

What’s the price for not being careful? If you’re lucky, it’s negligible; otherwise, it’s anywhere from significant to mind-blowing. In the recent gulf coast oil spill catastrophe, it’s safe to say nobody was lucky, we’ve already flown past significant, and we’re quickly approaching mind-blowing.

The trouble started on Tuesday, April 20 when, 50 miles off the coast of Louisiana, the Deepwater Horizon oil rig exploded, sending 126 workers into a panic for their lives. 11 were killed, and the remaining, altered for life.

Since then, BP PLC, the company who leased the Deepwater Horizon has been on a very oily slope of trying to contain the problem, investigate root causes, and protect its reputation. This hat trick of damage control doesn’t seem to be faring well as, in less than two weeks, the originally anticipated oil spew rate of 1,000 barrels a day has vaulted to 5,000 barrels a day; they’re still not certain what caused the explosion; and as of the end of the month, the market has shaved about 13% or $25 billion in capitalization.

In all fairness, it’s a bit inaccurate and grandiose to attach a $25 billion price tag on the incident, as there could be an over-reaction in the market due to its recentness and predictable sensationalism by the media. In time the market could recover, but there are some real costs staring BP in the face.

By its own admission, BP is spending $6 million per day on the disaster, and relief wells could cost $150 million each. To make matters worse, the Oil Protection Act of 1990 allows for a maximum fine of $3,000 per barrel leaked. So, at a disgorgement of 5,000 barrels per day, assuming it takes 90 days and two relief wells to fix the problem, the hard costs to BP (factoring in its 65% working interest) could be well over $1 billion (yes, with a “B”). That’s before considering any lawsuits, which could reasonably bring the number close to $2 billion. That’s a big number!

Of course, they’re not the only ones that could be blamed for this mess. There’s a long chain of potential culpability involved here, with each link exposed to financial and repute-related damages. Although the investigation is not complete, there are some theories into what happened, which point to the cementing process; a process that is supposed to prevent oil and natural gas from escaping. If this turns out to be related to the root cause of the explosion, Halliburton is in the spotlight again, as they were handling the cementing process on the rig. Also, Cameron International Corp is under scrutiny, as they built the blowout-prevention equipment that didn’t stop the explosion.

And, don’t forget the innocent parties that are affected by this. In addition to the 11 families that lost their loved ones, the small fishermen and shrimpers in the Louisiana area are immensely impacted. Louisiana has a $3 billion fishing industry, which accounts for a third of all seafood consumed in the United States. The timing of the oil spill couldn’t be worse, as this is the spawning season for some fish, and migration period for some species of shrimp. Some local fishermen claim that this disaster will have a greater impact than Hurricane Katrina. Finally, what about the sea life. They didn’t ask for any of this.

All this mess, because somebody wasn’t careful enough. You would think that after over a century in operation, the oil giant would know how to prevent a huge oil rig from exploding. But then again, look at the number of extreme and horrendous “surprises” we’ve had to deal with over the last decade.

This is the kind of situation I’m trying to help you prevent when I tell you that if you’re company is doing more than $1 billion in revenue, the expected cost of each compliance violation is $80 million. I didn’t make this number up; this is based on research (from META Group, now part of Gartner to be precise).

This is the kind of situation I’m trying to help you prevent when I tell you that risk prevention is much more important than merely compliance. I wouldn’t be surprised at all if the investigation comes back with no compliance violations. It doesn’t matter.

If there’s any redeeming quality at all to this horrible situation, it’s the story—the reminder that situations like this do happen, and the evidence to not only convince the compliance officers of the seriousness of a proper and effective compliance program, but also the executive leaders that they need to sell on the idea.

I hope you never find yourself in a slippery mess like this.

Whoa Toyota, Whoa!

Protecting Your Reputation During a Witch Hunt

Aiko Toyoda is sworn in to testimony at the House Oversight and Government Reform Committee. Picture Source

You asked for it, you got it, Toyoda. Is his company’s brand permanently tarnished, or will the great Japan auto-empire save its reputation?

Last Wednesday, Toyota CEO Akio Toyoda found himself in the hot seat of the United States House Oversight and Government Reform Committee. Not a familiar or comfortable spot for the CEO of a Japanese company, especially one whose hallmark of outstanding quality, supplanted the US auto-markers’ front-running position decades ago in the US, and their reign until now has been uncontested.

In a long string of high profile icon-toppling discoveries, starting with Bernie Madoff and recently including the Tiger Woods fiasco, Mr. Toyoda becomes the latest victim of skinny-dipping in the ocean when the tide goes out. He asked for it though. In his testimony, Toyoda stated:

“I would like to point out here that Toyota’s priority has traditionally been the following: first, safety; second, quality; and third, volume. These priorities became confused, and we were not able to stop, think, and make improvements as much as we were able to before.”

Dear Grandfather—what have I done!

His decision to divert his focus from quality to growth ended up producing cars that would suddenly accelerate for no reason. Just one day prior to Toyoda’s Hibachi in front of the HOGRC, the House Energy and Commerce subcommittee heard testimony from witnesses like Eddie and Rhonda Smith from Sevierville, Tennessee.

In 2007, on an ordinary fall day in Tennessee, Ms. Smith took her Lexus out for a drive, as she normally would. She casually pulled onto interstate 40 when her Lexus suddenly took off out of control! Before very long, the car was traveling at 100 mph. Ms. Smith didn’t panic though, she did everything—I mean everything—you would expect somebody in this situation to do. The cruise control light came on, so she immediately disabled the system—nothing. She put the automatic transmission into every gear including neutral—nothing. She pressed hard with both feet on the brakes—nothing. She actually engaged the parking brake—and the car still kept going. After six long miles at over 100 mph, she finally called her husband to hear his voice one last time, whispered a prayer to God, and prepared for what she thought was the inevitable. In what cannot be described as anything but a miracle, her car started decelerating. Ms. Smith finally brought the car to a halt, and thanked God for his (or her) divine intervention.

As I stated, this was in the fall of 2007, well over two years ago, and only now after being summoned by the US, did he ever answer for what was happening with his “high-quality” cars. Mr. Toyoda did apologize to Ms. Smith from Sevierville, Tennessee and all the others who were traumatized by his out-of-control rocket cars, and he did promise the American people that something like this will never happen again.

From the standpoint of restoring Toyota’s reputation and confidence in the mind of the Americans, which according to Mr. Toyoda was his goal in coming to the US, how do you think he did? I think he came close, but no cigar—not yet. I’ve recently engaged in some very intelligent debates with my colleagues on whether or not Toyota will ever be able to restore its image. Many people think it’s not possible at this point, but I disagree. However, Toyota is missing a critical element to pull this off. Let’s review Toyoda’s statements to date:

• He has apologized to the people who were victimized by his uncontrollable rocket cars—good.
• He has admitted that he purposely revised Toyota’s strategy to favor growth over quality—very good.
• He’s made a promise to the American people that this will never happen again—sounds hollow, but okay.
• He has admitted that there was a glitch in his product development and / or manufacturing process that caused anomalies in the electronic control of his accelerators—wait, no he didn’t!

In fact, Toyoda denies his electronics had anything to do with it. His only remediation to date, is to replace floor mats and accelerator pedals, which he admits may not prevent future accidents.

What?!

Wait a second. Doesn’t something seem off to you? What’s missing here is our confidence that they’ve identified the cause of the problem, which is a necessary component for fixing the problem, which is a necessary component for us to feel safe about driving his cars.

Some of my colleagues would have you believe that there’s nothing Toyota can do to restore its image. In my view, that’s temporally myopic. Inside, we want to believe that Toyota manufactures high-quality cars. It’s what we’ve come to know for a number of decades now, so it’s hard to surrender that impression. We need to have closure though, and we won’t have that until three things happen:

• Toyota comes up with a good explanation of why the cars were suddenly accelerating
• Toyota comes up with a good explanation of how they fixed the problem
• We see objective evidence for a couple of years that the quality is back where it “should” be
• If these things happen, I think Toyota’s brand will be fine.

You’ve heard me talk before about your moral and ethical compass as a company, and how the wrong alignment can severely compromise your compliance efforts; however, although this was Toyoda’s first mistake, that’s not my point today. My point is, as hard as we try, with all the right intentions, compliance violations do happen. And, your biggest exposure doesn’t have anything to do with penalties and fines, it’s your image. If your brand suffers as a result of a compliance violation, your company will be ruined.

To protect your company’s brand in a situation like this (provided your ethical compass was pointing in the right direction), apologize to those affected, but also get to the root cause as quickly as you can, and demonstrate that you now have things under control. This is vital for closure in the perception of your customers, and an important ingredient in being able to forgive the mistake and move on. People will forgive, but you must handle it properly, or it could cost you your company.

Strength from Within

A Haitian Disaster Brings an Invaluable Lesson in Resilience

On January 12th at 4:53pm, the capital city of Haiti was struck by the strongest earthquake it has seen since 1770. Picture Source

How much damage can a 7.0 earthquake cause? The answer really depends on how prepared you are. As you know, Haiti just experienced one of these, and the impact is devastating; the current death toll is reported at nearly 170,000 human lives. The Haitians that survive will be altered for life.

When the two million residents of Porte-au-Prince, Haiti woke up on the morning of January 12, 2010 they had no idea what was in store for them later in the day. At 4:53 pm, the strongest earthquake since 1770 was about to wreak havoc on the gulf harbor, and country capital city. What the people of Haiti would have to endure was unconscionable.

Many that weren’t killed immediately would face the ultimate challenge; a contest with the elements, paying the ultimate consequence for losing the battle. When the quake struck, a small five-year old boy was instructed by his parents to stay quietly in a plastic crate and await rescue. They assured him that everything was going to be okay. The young boy did as instructed, waiting patiently, but nobody came. Day after day passed, the boy didn’t move. Now several days had gone by, his body had grown weak, and his will was fading; did anybody out there know he was there? Was he ever going to be rescued?

As the days passed, I can only imagine what was going through the young boy’s mind. Only his innocence protected his delicate psychology. Without the “benefit” of experience, he didn’t know what to be afraid of. All he knew was obedience; he did as his parents had told him, and he stood still in a crate—for eight long days.
Day eight was the final day of the battle, and the amazing young boy had overcome. Day eight was the day his rescue team anxiously pulled the child from the rubble and immediately administered much needed medical care. And just like mom and dad had promised, everything was going to be okay.

With great fortune, the young boy is on the road to physical recovery; however his life is changed forever. At a very young age, he has acquired an acute awareness of how much can be endured. He knows that deep within his soul is the strength to overcome any obstacles that will face him in the future. He will live life on his terms, unafraid of the many additional challenges that will come his way.

Resilience is the upside of disaster—if you allow it.

I hope you’re company is never faced with a catastrophic impact, but if it happens you must rejoice in the upside. Let’s face it, nothing’s guaranteed. You can put the best compliance program in the world, and still get pummeled by a highly publicized data breach, or an inside attack by a disgruntled system administrator. These things happen.

What’s important is how you recover from it. You can choose to feel victimized and unlucky, or you can choose to be more resilient going forward. It’s up to you. Don’t allow misfortune to shape your future. If a five-year old can survive for eight days in a crate under a pile of rubble, you can move on with building a better compliance program than before.

Living Under the Information Highway

This article comes from the May 2009 issue, and based on our recent survey, happens to be the readers' choice for all of 2009. Efficiency is a huge concern even today, and there's no better place to learn how to live on a dime than to look at how the homeless do it.

What Homeless People Can Teach You About Efficiency

Skip Schreiber working on his laptop in his van, which is also his home. Picture Source

The year of 2008 scared a lot of people including myself and the year of 2009 is no day at the carnival either; however if you have a street address right now, you’re doing better than some. In my hometown of San Francisco alone, there are about 6,500 homeless people; some push around shopping carts all day arguing with themselves, and some work the streets looking for a helping hand from generous people—and some surf the internet on their laptop computers!

In this day and age, some of the homeless have decided that staying connected to the information highway is a non-negotiable term. The job might go, the house might go, but the laptop is going nowhere.

According to the Wall Street Journal, a 37-year old Charles Pitts has accounts on Facebook, Myspace, and Twitter, and even runs an internet forum on Yahoo: all from the un-comforts of his residence under the bridge. Mr. Pitts claims that you don’t need place to live a TV to watch or newspaper to read, “but you need the Internet.”

I have to admit that I don’t know too many homeless people personally, but I have befriended one or two in my past and I certainly hear and read real stories based on actual accounts. It’s very easy to misconceive that “the homeless” are somehow a different class of people; however, nothing could be further from the truth. Some homeless people are highly intelligent and resourceful due to their conditions. There’s a lot that can be learned by understanding how they cope with their situation.

Paul Weston, a 29-year old hoping to be a computer programmer someday was laid off in December from his job as a hotel clerk and was forced to move into a shelter. With his PowerBook in hand, he stations himself at places that offer free Internet service. Once wired, he’s free to search for work, and even write the computer program that he hopes to sell someday.

This economy also took its toll on Robert Livingston, a 49-year old who quit his job as a security job late last year. Unable to find a new job, he lost his apartment in December and was also forced to move into a shelter. When he realized he was going to be homeless, he bought three things: a backpack, a padlock (for his locker at the shelter), and a premium account on Flickr to display the digital photos that he takes. And although his only monthly income is a $59 welfare check, he stays clean cut and meticulous, with notebook under arm.

Long time veteran of the streets, Skip Schreiber knows a thing or two about staying wired without a permanent address. The former HVAC specialist took a turn for the worse 15 years ago and has been living on the streets ever since. These days you might find him in his van working on his Mac laptop. He draws power from his van’s battery and saves power by keeping the wireless antenna off, and avoiding videos. He also cools the computer down by setting it on a damp cloth. Using these techniques, he is sometimes able to get 16 hours of life out of his computer’s battery.

These are just a few examples of many, on how people without homes are managing to stay connected to technology and the information highway. No, I’m not homeless, but when forced into the unusual circumstances of the 2008-2009 economy I had to become resourceful just like the rest of us.

The point is this. We as human beings are very, very good at being resourceful: much more than you realize until you’re forced to. The opportunity here is that you can absolutely make your compliance program much more efficient than it already is, but you need to realize the following:

• You need to be absolutely crystal clear on what you’re minimum future state and ideal future state is. You can have grey area in between, but you must be extremely clear on the scope boundaries of your future state.
• Achieving your minimum future state cannot be optional.
• You need to know how to get help. Know who to trust for advice, and then trust them.
• Lock in the outcome, but allow the means to be fluid. It doesn’t matter how you get where you need to go, as long as you get there.
• Trust the power of the collective wisdom of a team to solve problems. As humans we have our shortcomings, but our amazing ability to solve problems is what makes us the higher species. Enlighten the human spirit and anything can be accomplished.

Your potential for an efficient operation is already within your team; you just need to tap into it. Don’t wait until you’re forced into an urgent situation like a lawsuit; this is the worst time to rally resources and get your act together. And don’t ever believe it’s not possible to reduce your company’s exposure for less cost. If Robert Livingston can survive on $59 a month and still stay connected to the Internet, you can get more out of your compliance program for less cost.

Uninvited Guests Spoil White House Dinner

How to Defend Against Social Engineering

Uninvited guest Michaele Salahi shakes hands with President Barack Obama. Picture Source

What do feel would be the consequences of an uninvited guest wandering around your company? What if you threw a party at your house, and noticed somebody meandering that you didn’t know? The White House certainly has some explaining to do after allowing Tareq and Michaele Salahi to shake hands with the President of the United States recently at a dinner—a couple who wasn’t even invited to the event!

This month, the White House threw a star-studded gala event littered with dignitaries, celebrities, and the Salihi’s—relative nobody’s until shortly after event when it was painfully apparent to the secret service that they had not only “crashed” the event, but they had full and seemingly unfettered access to some very important people, including President Obama himself. As of this writing, we haven’t heard their side of the story, however according to Fox News, secret service director Mark Sullivan has already issued the following statement:

“although these individuals went through magnetometers and other levels of screening, they should have been prohibited from entering the event entirely. That failing is ours."

Yes, I agree. Our government is actually very good at telling us things we already know. I don’t know whether they’re trying to make the point that they shouldn’t have been there, or that it’s their job to make sure unauthorized people don’t get to shake hands with the President, or both. In all cases, I think we know that already. They shouldn’t have been there, and the controls that were in place to prevent something like this from happening obviously failed.

Contrary to what you might expect, I’m not really going to beat up on the secret service here. Reason being, I think this is more sensationalism at work, than any real threat to national security. I’m not saying it’s okay, but let’s face it—this is really newsworthy, isn’t it? What put me over the edge was the angle these people were coming from. Again with the reality stars! Don’t you find it interesting how current and / or aspiring reality stars (why would anyone aspire to be a reality star?) get about 100 times more media coverage than say—US soldiers losing their lives in Afghanastan?

Anyway, back to the Salihis. We all know they weren’t supposed to be there, and I sincerely doubt the secret service was in on it, so how exactly did they get into the party? As I understand it, they also had a camera crew with them? Don’t you think this is a bit conspicuous? They certainly didn’t “sneak” into the party, in fact they probably made more of a scene than most there.

If you’ve seen the pictures, didn’t they look like they belonged there? Doesn’t it seem like they spoke and acted just like everybody else? They actually worked the environment in a calculating way, playing off the dynamic of the event itself. They tacked into the wind instead of avoiding it. I think if they actually dressed up in black body suits, and repelled down the White House wall with grappling hooks they would’ve been arrested in seconds. Instead, they practiced the sacred art of social engineering.

This time-honored underground profession is one of the most difficult things to defend against. They look like they belong, the sound like they belong, they actually feel like they belong—but they don’t. Unlike reality stars, real social engineers aren’t there to boost their pseudo-celebrity image, they’re there to undermine your business and they can do real damage.

So, what’s the best defense against social engineers? The answer is familiarity. It goes back to what we learned when we were small children, “don’t talk to strangers.” As much as the Salihis looked and acted the part, nobody there really knew who they were. But as most politicians and celebrities know, it’s social suicide to not know somebody important, so they all pretend that they’ve known each other since grade school.

This is dangerous in Corporate America when you’re playing with sensitive or confidential company information. The rule is simple, there’s a defined list of people that you know that get access to your sensitive information. If they’re not on the list, they don’t get the information. No ticket, no laundry, end of story. Any grey area will get you into trouble, so don’t even go there.

And the next time a couple shows up at your company’s gates with a camera crew, at least check to see if they’re on the access list.

Failure by Remediation

Fixing the Fix on the Bay Bridge

An empty San Francisco Bay Bridge. Picture Source

Imagine driving over the San Francisco Bay Bridge on a beautiful Tuesday afternoon after a wonderful day of frolic and merriment in the charming Oakland bayside area of Jack London Square. The sun is low in the sky, turning from yellow to orange as it prepares to set into the San Francisco bay. Your gaze slowly turns to the beautiful San Francisco skyline as you reflect on one of the best days you’ve had in a long while. Suddenly, your meditation is abruptly interrupted by a thunderous crash as 5,000 pounds of steel comes flying down from the bridge! Two steel cables slither around like a pair of garden hoses out of control, taking out everything in their path. One cable actually crashes through the windshield of a truck! Reflections of your past accelerate into overdrive, as the rest of your life quickly flashes before your eyes. Fear and anxiousness overwhelm you as you painfully wonder if this will be your last memory. Everything calms, everything is okay, and nobody is hurt.

Although the actual account is fictional, the facts surrounding it make it quite possible. Last Tuesday, on October 27, 2009 about 5,000 pounds of steel from the Bay Bridge came crashing down on the upper deck, as the wind blew loose a large crossbeam and a couple of tie rods (the slithering cables). Fortunately and remarkably nobody was hurt, but the incident totaled a few cars.

Here’s the irony, which is the part I always love. The structure that failed wasn’t there a couple of months ago—over Labor Day weekend, it was constructed as a remediation! Just before Labor Day weekend, engineers noticed a crack in the bridge (not something you care to see if you’re a bridge engineer) so they rallied the crews to install some “reinforcement,” just to be safe. Although they get an “A” for effort, I guess they overlooked the fact that there might be some wind over a bridge that spans the San Francisco bay (imagine that).

I was actually on the road on Tuesday at 5:30 when the Bay Bridge came falling down. I pushed off from Reno, Nevada earlier that day; I had just finished attending Confab 2009, the annual conference for the Institute of Management Consultants. The conference was awesome. My mentor Alan Weiss opened up the conference with his keynote on Sunday, giving us insights on how to thrive in this economy. He brought the house down as usual—standing ovation.

It was an auspicious time to be driving home from Reno, as I could have quite possibly been driving into San Francisco at that time. I didn’t hear about the incident until I reached home later that night, however I do remember driving by the area, and I don’t remember it being that windy. Of course, the wind was blowing a bit, but nothing terribly unusual. I remember being in Broomfield, Colorado one time, which is right between Denver and Boulder, to do some work for Sun Microsystems. I actually drove there, and when I pulled up to my hotel, the wind was blowing so hard it was difficult to get my car door open. Now, that’s windy. Tuesday in California on the Bay Bridge…not so windy. I find it odd that a moderate amount of wind was enough to shake things loose on the Bay Bridge.

Another thing I find odd is the announcement we heard the following Wednesday morning. They told us, “the bridge would be closed indefinitely.” That’s a peculiar choice of words. I think what they were trying to say is that, “the bridge will be closed until we can get it safely repaired, and we’re working as fast as we can,” however the word “indefinitely” gives off the impression that the bridge will be closed forever, doesn’t it?

We can do better than this on our compliance programs, now that we have a clear example of how not to handle this. There are three lessons we can glean from our Bay Bridge case study, which I’d like to share with you, so you don’t make the same mistakes.

The first lesson is about remediation. The apparently kneejerk reaction to the crack on the bridge was to install an adaptive control, which as I’ve stated many times before is a poor choice when other types of controls are available. I would have preferred a preventative control which would address why the bridge cracked in the first place.

The second lesson is also about remediation. As we’ve seen with the Bay Bridge, even with the best intent, remediation can backfire on you if you’re not careful. You absolutely must do benchmarking on current state before you remediate, then do another benchmark to make sure you’ve actually improved the situation! Seems obvious, but people get this wrong all the time, and actually spend money to worsen their situation.

The third and final lesson is about communication. Take some time to articulate your communication carefully. Words are powerful, and choice of words is very, very important. I’m not talking about spin control, I’m talking about accuracy. Everybody involved needs to know the honest truth, as acutely as you can project it. This bridge will probably be open in a few days; that’s hardly an “indefinite” period of time.

Uncovering weakness in your compliance program, and taking proactive steps to remediate is an enormously responsible move on your part, but you must do it right. Always strive for preventative controls when possible, test your remediation to make sure it reinforces your situation, and make sure your communication is accurate and honest. You don’t want a crossbeam coming down on your compliance efforts because of a little wind.

Man Joins Grizzlies for Dinner

It’s about Protection, Not Compliance

The grizzly exhibit at the San Francisco Zoo. Picture Source

In the inaugural issue of Flawless Compliance (January 2008) the lead story was about a few kids that got themselves in big trouble by taunting Tatiana, a 300 pound Siberian Tiger that was minding her own business at the San Francisco Zoo on Christmas Day 2007. Well our zoo must be a magnet for people that want to get close to animals, because this month a man decided to pay his respects to a family of grizzly bears right around dinner time!

According to the San Francisco Chronicle, 21-year old Kenneth Herron either successfully negotiated a 20-foot wall topped by electrical wires or a 14-foot deep moat to interrupt a nice evening enjoyed by Kachina and Kiona, two 500 pound female grizzly bears. Nobody knows how he got in or why, but when he was spotted he was being “greeted” by one of the bears. The Chronicle reports that:

“One bear approached curiously and sniffed one of Herron's shoes. At that point, said zoo vice president Bob Jenkins, Herron did ‘the only thing he did right - he stayed still and didn't move.’”

Well of course, because anyone with common sense knows to stay still when being sniffed by a grizzly bear …

... True to protocol, the response team was dispatched to handle the situation. As with the tiger, the thing that disturbs me the most is that if the response team had sensed that Herron was in danger, they would have shot the grizzly bear. The grizzlies seem to be the only ones in this equation that aren’t insane. Fortunately for all involved the grizzlies did not follow the same fate as Tatiana who was shot and killed as a result of the incident. In this case the response team fired a warning shot and both bears scrambled back to their cave to finish watching the highlights of the LPGA tournament.

Here’s what I consider is a remarkable follow up twist to my original tiger story. Not only was the Tiger killed, but the zoo was subsequently sued and ended up settling for $900,000. Is it possible that the zoo could end up in another lawsuit as a result of this? You bet.

Think about this for a minute. The world lost a beautiful tiger and the zoo lost $900,000 because a tiger was taunted by three kids that may have been under the influence of something. We nearly lost at least one, possibly two grizzly bears and the zoo is exposed again, because some lunatic decided to invade a grizzly bear grotto.

As unfortunate as it is, this is what’s in the real world. You may think that your compliance program is good, but is it good enough to resist a deliberate, preconceived, and well-planned breach of compliance? Most organizations install good-enough controls and sleep well at night thinking they’re protected. Just like the zoo thought an 18 foot wall was good enough to keep out a tiger, or nobody would be insane enough to scale a 20 foot wall fortified with electrical wire to enter a bear cave.

You must be prepared for anything. You might have guards watching the safe, but who’s watching the guards? I’m not trying to install paranoia; instead I am trying to incite you to raise your own bar. Ironically a good compliance program is about more than just compliance—it’s about protection. An over-publicized privacy leak will be damaging, regardless of the numerous compliance points you can demonstrate. You can pass external SOX audits from each of the big four accounting firms with flying colors, and still get caught taking shareholders and employees for an egregious amount of money. Do you think they will care if you can produce a string of unqualified opinions from various big four firms?

Good enough compliance is a start, but not the end. Constantly challenge yourself to do it better. Enlist the aid of an outside firm to see if they can put your company at risk and still be compliant with your program. This is a sign that your compliance program needs to be beefed up a bit.

After the tiger incident at the SF Zoo, the executive director was forced to “explore other pursuits.” Even in the face of this psycho-Goldilocks adventure, the new executive director defends their security measures stating that they expect visitors to display some amount of common sense. Let’s see how that defense flies if they get sued. It’s not common sense they need to be worried about, it’s uncommon nonsense.

Finally, let me reiterate the bonus lesson we learned from the tiger story:

Don't mess with angry females, especially ones that outweigh you!

When Opportunity Blasts Through

Happy Anniversary, Katrina

Four years ago Hurricane Katrina took a devastating tool on New Orleans. Picture Source

The effects of destruction are largely up to you, not the fates.

On the four year anniversary of hurricane Katrina and encore showing of hurricane Rita just one month later, our fabulous city of New Orleans is still struggling to get back to where it was. My question is, “Is that really what we want, to get it back to where it was?”

There is a lot of negative press circulating around the subject as feelings of fear and despair have been resurrected, prompted by the recent address president Obama released on the topic. Now these feelings are coupled with disappointment, frustration and outrage as we reflect on all the time, money and attention that has been directed at the New Orleans’ revival project, only to put us where we’re at today.

Where are we today? According to the Yahoo News:

“On the fourth anniversary of Katrina, many communities remain broken, littered with boarded-up houses and overgrown vacant lots. Hundreds of projects — including critical needs such as sewer lines, fire stations and a hospital — are entangled in the bureaucracy or federal-local disputes over who should pick up the tab.”

I agree this is tragic. As both an efficiency and project management expert, it really disturbs me to see our nation operate like this. But I’m not at all surprised. At an attempt to cool our nerves, president Obama gave another of is “bright future” speeches on the subject. In his address, president Obama states:

“Our approach is simple: Government must keep its responsibility to the people, so that Americans have the opportunity to take responsibility for their future”

And goes on to say:

“I have also made it clear that we will not tolerate red tape that stands in the way of progress or the waste that can drive up the bill. Government must be a partner — not an opponent — in getting things done."

No real criticism here, but that’s what I would expect him to say, and I’ve heard so many speeches like this in my career that I’ve learned to tune leaders out when they go down this path.

Here’s the most interesting part for me:

“the legacy of a terrible storm is a country that is safer and more prepared for the challenges that may come.”

Here, Obama does two things. First, he draws attention to the fact that a devastating event like a hurricane actually has some opportunities if you look for them. Second, he implies that the country shouldn’t aim to restore things back to where we were, but beyond where we were.

Time ran a terrific article on the topic of Katrina. Instead of focusing on how lamentable it is that bureaucracy has slowed the progress of reconstructing New Orleans, it focused on how Katrina has provided an opportunity for a better New Orleans—and a greener New Orleans.

According to the article, Global Green USA has taken a large part in making the new New Orleans better and greener than it ever was. They’re not only promising on a better future, they’re delivering:

“[It] begins with the Holy Cross project, an entire sustainable village being built in the city's flood-damaged Lower Ninth Ward, with the help of Home Depot's corporate foundation. Eventually the village will include five sustainable homes, along with an 18-unit green apartment building and a community center. Three homes have been completed so far, including one that is serving as a de facto visitor's center.”

And they’re not stopping there. They’re retrofitting the existing schools to be greener, and building new schools from the ground up with solar panels and other energy efficient architecture.
Going green isn’t the only order of the day. They also want to make the city more resilient. As an example, not only will the new schools be built with solar panels, but they will also have wetland habitats and rainwater cisterns. I don’t know what those are, but it sure sounds like the right thing to do!

The point is that disaster is what you make of it. For instance, a failed audit isn’t really all bad. The propensity is to panic and curse, but events like this are a blessing in a horrible disguise. That’s not to say you won’t feel impact. We lost over 1,500 lives in Katrina that we cannot get back, and that hurts. But there’s a real opportunity here to rebuild stronger, if you have the courage to be positive.