Welcome to Risky Business Commercial Insurance with Butler Byers. This is Paul Martin, the business commentator on CKOM, and joining me in studio today, Colin Rooke, the commercial risk reduction specialist with Butler Byers. And Colin, we have covered the waterfront through the course of this program in the last year or two. And we’ve looked at everything from reputational risk to, you know, what goes on in the benefits world. And today I just want to get back to kind of our basics, which is talking about how business owners actually run their business and how they approach it. And, and as funny as that might sound, that actually is an insurance topic, isn’t it? Insurance companies care about that.

Yeah, they do. Again, part of when we explain, you know, our clients to the market is, well, why do they do the things that they do and how do they do that? And so it’s very important that you know, us as your broker, we understand, yeah, I guess really that very topic. But what if we’re in front of clients or prospects that that really don’t know? I mean, they’re obviously, they’re running a business but they haven’t, you know, they don’t quite have the answer. You know, why do we do the things that we do? Maybe it’s not articulated properly. They just kind of always have, well, I mean it’s a big part of our job just to, to sit down and say, “Well, you know, why, why don’t we talk about that? Why don’t we work together, get that documented and then maybe we can look at what you’re doing, make some improvements together.” Certainly again, identify areas of improvement, you know, and then part of that process, we’re going to improve organizational performance. We’re going to take that success story, we’re going to share it with the insurance market, which is going to mean a lot more than you think to them.

And then, you know, overall we’ve got, you know, more favorable premiums, we’ve got markets looking at your account that maybe wouldn’t, and then again, best of all, you know maybe we can save you some money through the process.

Yeah. Let’s talk about saving money in a, in a minute or two. I just want to get back to maybe talking about how you assist business owners and that’s really the nature of this program. If you’re new to listening to our program, to Risky Business, you probably wonder what are those two guys talking about? Really it’s about how do business owners and managers look at their operation, and we do it from through the lens of the insurance industry, and how do you manage your insurance costs, your coverage, your premiums, but it really is more than just buying something off the shelf, buying a policy off the shelf there.

This is really about trying to figure out how to run your business more effectively and one of the things that we talk about in this field, and it’s been around I guess for 60 70 years, is this whole notion of continuous improvement. You know, some people call it lean I guess, but it really just falls under this, this whole rubric of of how do you make your business better? And I remember talking to a business leader some time ago and he said, “If you can just improve your business 1% a year over the competition, what happens over 10 years?” You know, 10% ahead head of the, you really have a distinct advantage.

And it starts from this mindset thing that says, “I am going to build not only a better mouse trap, I’m going to take the one I got and I’m going to make it more efficient.” I’m going to make it more effective and make work better, which then attracts more customers and you can make a better argument when you’re talking to the customer. When you’re out in the business world, and you talk to business leaders and owners every day, how prevalent is the conversation of continuous improvement? Do you bring it up or do they bring it up?

You know, I think it’s both. I think, you know, it depends on the industry, it depends on the timing. I think, you know, the idea of continuous improvement, you know, it’s, it’s topical to most business owners. I mean when we, if we say, you know, if you use the word lean, I mean it’s not new, but then you think, okay, well if you’re busy being busy, regardless of the size of your organization, you have so many customers, you don’t know what to do with them. Again, it’s there, it’s probably on the back burner. And then, you know, you get to a stage where maybe things cool off a little bit, you know, let’s say the nature of your work’s seasonal, well now is the time to say, “Okay, so we’ve gone through our busy time, we’ve got some down time available, let’s really work on the business. Let’s, let’s get better. And when we go through that busy time again, you know, where, you know, we might be wildly profitable, maybe we can improve those numbers significantly by putting in the work now, by looking, by having a discussion around lean or continuous improvement, making sure that the whole organization, you know, knows what that is.”

Setting goals from the top down, sharing those goals and really looking at, you know, the, the culture you have. Do you have a culture of continuous improvement or is it just a topic that you know, you’ll sit around, you know, the management table discussing, but really it doesn’t trickle down to the employees that are doing the day to day.

That’s an interesting point. Do you have a culture of continuous improvement? I think it would be one of those things like how do you measure that? So if you’re a business owner or you manage an enterprise, it’d be pretty challenging. You have to challenge yourself on that one and just say, “You know, how serious am I about this?” You know, if I just take a step back, the whole word lean, and continuous improvement, I think Kaizen, some of these Japanese terms have flow, that flow from that. It’s got a bit of a reputational hit. It’s taken a reputational hit in the province from the politics that surrounded it from when the Saskatchewan government was trying to do it. You have to overcome some of that too, that, you know, maybe business owners understand it, but their employees may not, they might have a more jaundiced view towards it.

Yeah, I would completely agree. When when you, when you mentioned lean or even disguise it with continuous improvement, I think they, they think job cuts. I think they think of eliminating wastebaskets, you know, things like that. And quite frankly just initiatives that are, that’s really going to, you know, hamper their ability to perform their job, or cause a lot of stress in their day. And so it really does start with education. You know, why lean, why do this? And, and I always say, you know, the result of this, if you’re working on lean, if you’re working on continuous improvement, you know, if at the end of the day it should create a happier, more efficient workforce. You know, it’s not really about management as much as it is those, you know, out in the field out doing their job. You know?

And, and I think for lean to work and, and I think this is where, you know, you get some of the negative publicity is, you have to involve the whole organization. You have to build internally lean champions, and you can’t just be told to be lean. You can’t just say, you know, like, you know, manager can’t walk in and say, “Johnson, we’ve been looking at what you’ve been doing and we’re going to eliminate the following processes and you’re just going to have to live with it.” I mean, that’s not how it works. It’s working with those employees and saying, “Okay, you’re doing this day to day. This is what you do. And you know, maybe we’ve over proceduralized your current occupation. What do you see as waste? You know, what are you doing that just doesn’t make sense? Or what part of your day or part of this task are there some multiple touches that just aren’t necessary?”

Or even to elaborate further and kind of add some comedy like I’ll ask, “So when you’re in the coffee room or lunch room complaining about the company you work for, you know, all the things that you do that are stupid, write those down and let’s discuss why you feel that way. And quite frankly, a lot of them probably are stupid, but this is your chance to right those wrongs. This is your chance to have real impact on, again, eliminating redundancy and being part of change that’s going to free up your time.”

Well, you know, we’ve got to take a break here in a moment, but I, when we come back, if you’re all right with it, I wouldn’t mind talking about a couple of examples as a business commentator and a writer, I have followed this fairly closely and I’ve seen, you know, some real examples of how empowering people at the front line can be a very potent tool to enhancing performance of a business. And we’re going to take a little break. You’re listening to Colin Rooke, the commercial risk reduction specialist with Butler Byers commercial insurance. This is Risky Business, back after this.

Welcome back to Risky Business Commercial Insurance with Butler Byers, Paul Martin here, and joining me in the studio as always, Colin Rooke, the commercial risk reduction specialist with Butler Byers Commercial Insurance. And we’re talking about lean, about continuous improvement in an organization. And I sort of mentioned just before the break that you know, I’ve seen some examples of how this works and it really is about in your kind of, as you described it, empowering the frontline worker who knows their work site the best, how can you, how can I help you as the manager, help you improve the efficiency? How can I get stuff out of the way?

And I know that there were some pilot projects in the province in the health system and I remember covering one where they had kind of put pedometers on the nurses in one of the wards and they tracked how they walked and just what they did in a day. And when they got all those results, I built one of those spaghetti charts and they just followed their tracks all over. They rearranged the way the inventory in the ward was set up and they saved 1900 kilometers of walking on that ward. So, I mean that was just that walking time. Think about that. That was no processes other than that change. They just relocated a couple of things. And another cool deal, they took the doors off the cupboard so you didn’t have to keep looking inside. It was just, you’d walk by and see what was there.

And you know, these are not jobs threatening kinds of things. I think that was your point, wasn’t it?

Yeah. And that’s a really good example that, you know, when, when you say we want to eliminate waste, the waste isn’t the people. I mean that’s not the point. It’s, well if we get better we can cut staff, cut wages, and become more profitable. It’s, you know, we want more out of our people, but we also want to make sure, you know, again, they understand the why behind it. So to use the example of all the walking in the ward there and, and the cupboard doors. I bet if they surveyed the staff, they could have told you that. In fact when the doors came off, I’m sure there was a group that said, “We could have told you that.”

And, and you know, that’s, that’s part of, again, discussing lean with the whole organization. You know, you mentioned some examples of what we’ve seen, but some of the really, one of the most powerful examples of lean is quite frankly sharing a presentation on what it truly is. You know, really lean isn’t about workflows. It’s more about how work flows. And so when you explain that and you explain how it’s going to impact everyone involved, you can get some really, you know, some real excitement inside the organization around all things that they could do to improve. And when you make it about, you know, the people working, you know, then I think they understand, “Okay, so this, this is about me, but not in the sense that the more effort I put in, you know, the less value I’ve had.” And when we’ve seen a lot of resistance to talking about continuous improvement, it’s certainly been around that. So what you’re trying to say is, you know, you’re going to micromanage what I do or look at my day and then ultimately tried to eliminate the task.

Yeah, exactly. And really it’s about, “No, we want you to actually make your job easier to do because we’ll take a lot of the crap out of the way.” I’ve talked to one business guy who described it as, he said, “We in head office support the front line and we call it a race.”

Yeah.

“And the person on the front line’s our athlete and our job is to make sure they’re running a sprint, not a steeplechase. So we’ve got to pull these obstacles or these hurdles out of the way.” And the continuous improvement process is a mechanism for actually how you go about doing that very thing. Now that that is one of the daunting questions, tough, Colin, if I’m a business owner or a manager and I hear, you know, these two guys on the radio talking about continuous improvement, I’d say, “Oh, that’s all cool, but where do I start?” So how do you help a business owner walk through this? Do you have an assessment for them? I mean, what do you, how do you help them or get their arms around this thing?

Yeah, Paul you know, I think at this point we’ve got an assessment for just about everything. So, yes, yes, we always have an assessment and we have several around the idea of continuous improvement. And I think, you know, it does start with, you know, an understanding of your current culture. You know, I don’t want to say that, you know, often that the management team is out of touch, but you know, we often do get a different story from the executive table than we will from again a true, you know, survey going out, getting the thoughts of those working there, that you know, you think, “Oh, our people are always thinking about ways to, you know, become more efficient.” And then the survey goes out and it’s, “Well, no, they’re not really, they’re doing, yes, they’re trying to get the work done, but they’re certainly not, you know, looking at redundancies and waste and you know, processes that are non-value to the organization.”

So the big eyeopener I think is, you know, we do have what’s called a lean culture inventory and you can fill that out and score it yourself to start. Now we’re part of that process, and that’s going to set the stage for, you know, the next few conversations around lean, certainly.

Well we talked to before the break you, you introduced the word a culture of continuous improvement, I guess not a word but words, and I said we’d talk about it later, so this is probably the best opportunity to do it. It’s an interesting terminology that you used there of does your organization have a culture of continuous improvement? Can you sort of elaborate on that? What do you mean when you say that?

Well, for example, one of the questions, you know, and we use this all the time around Butler Byers, but the idea of athlete’s mentality. So you talked about the front line being the sprinters, and so we take it a step further and we say, you know, do you have a culture of seven months to seven days? Meaning, you know, if you come up, if there’s a new project, it’s really easy to say or a a new initiative around the office. You know, you’ll have a lot of meetings initially, there’ll be a lot of excitement initially about the project. You know, word will spread throughout the office like wildfire. And then you sort of look at this, this new initiative and it’s four months and really no progress and you know, it’s taking you six, seven, eight, nine months to get any task accomplished.

And you think, is that a culture of lean? Is that a culture of speed? You know, I’d argue not. So when we talk about the seven months to seven days, it’s can you take a project that would normally take your company seven months, but do you have the ability or the trust to get it done in seven days, and then move on. So you know that would be an example of a conversation that we’re having, but also something that would come up in the assessment. And you know, it is a self rated tool. So you don’t have to say, “Well we’re 100% there”, but we want to know, you know, when there’s an idea implemented, whether it’s right, or wrong, are you able to get to things quickly? Are you moving forward quickly? It’s a big part of the process.

That’s one side. The other side is your contractual obligations and to be honest with you, a lot of times, and I know you’ve talked about this in past shows, your reputational obligations to customers, employees, whatever it might be.

And obviously you won’t do that on the first try. I mean you have to learn how to get better at this stuff. But you know, this is intriguing stuff but keep coming back to this question in my mind of all the stuff you’ve talked about makes a lot of sense, but why does the insurance company care? I mean, why are we talking about it?

Yeah, good point. Like why do I care? Why does, why does Butler Byers, you know, spend time learning about lean outside of for our own purposes. And you know, the thing is we, again, we talk about, we work with our clients on risk, and we share that information with the insurance market. But ultimately we want our businesses to grow. And the policy is just one tool we use to mitigate risk.

Now, if you are not thinking lean, it is a risk to your business in today’s environment. It’s easier to ignore continuous improvement when things, when you are busy. If you’re slower now or if you look at your competitors, your competitors are talking lean. We are here to help you with that. We are here to eliminate the risk for you. It’s not something that we sell on a policy, but we work through together.

Colin, we’ve run out of time. I can’t believe how fast it went by. So thanks for this. Very insightful. You’ve been listening to Colin Rooke, the commercial risk reduction specialist with Butler Byers insurance. This is Risky Business. I’m Paul Martin. Thanks for joining us. Talk to you next time.

Yeah, so I would say the answer to that question is it’s definitely becoming a specialty. I think it’s a very new area of the law. I mean there’s a lot of overlap with technology law, with privacy law, but these regimes are relatively new in many countries, or many jurisdictions, and it’s changing all the time. There’s a lot of, “It depends. We’ll have to see.” There’s a lot of monitoring that you have to do of the… Even, again, foreign jurisdictions, how regulators are looking at these situations. I think you really have to keep your finger on the pulse in order to give good advice to your clients.

So if nothing else, that you get nothing else from today’s program. If you’re a business owner or you’re running a business, you might want to talk to your legal advisors and say, “Is this an area that you have competency in or do you need to bring somebody in?” Or just make sure you’re asking the question about, “Do we have all of the basis covered on the cyber front?”

Yeah, I think that’d be a good idea. Generally. Yep.

Yeah, and it’s probably something new that they need to be talking about. As you say, it’s a relatively recent development to create a specialty in.

In Canada, it’s as recent as, at a federal level, anyway, as you know, 2018. And again, we still run into organizations and business owners, other professionals that aren’t fully appreciative of the risks involved.

Good. Just hold that thought for a minute. We got to take a little break. We’re going to just be back in a couple of minutes. You’re listening to Risky Business Commercial Insurance with Butler Byers and my guest today is David Krebs, a lawyer with Miller Thomson. We’re talking about the legal side of cyber activity and potential cyber attacks against a business. We’re going to pick it up after this.

Welcome back to Risky Business Commercial Insurance with Butler Byers. This is Paul Martin and joining me in studio, as always, Colin Rooke, the Commercial Risk Reduction Specialist with Butler Byers, and our special guest today is David Krebs with Miller Thomson. He is a lawyer who specializes in this whole new emerging field of the legal ramifications of cyber breaches, data breaches, and all of these new-fangled things that business owners are having to deal with that…

You know, this is something that has come up really become more chronic in the last probably three or four years, I would think, David is likely true. But I mean, these attacks are coming from all over the world. They’re getting much more sophisticated. We’re a long ways from the Nigerian letter coming over the fax machine, aren’t we?

Yeah. Yeah, I think it’s evolved a lot since then, and as you can see from… You know, there’s a variety of reports that you can find online. The Verizon report, IBM does one, and you really see the changing nature, really from year to year, over where these attacks were coming from. I think as a general statement, as certain companies are becoming a little bit more sophisticated in terms of their technical safeguards, criminals find a way.

So they’re going after the weakest link, which unfortunately is still us as human beings. So, with that you’re seeing a lot of, and I forget what the actual number is, but I think it’s over a third of attacks that are phishing or spear phishing attacks aimed at exploiting our need to click on a link that’s sent to us in an email, as an example.

This really has evolved. I mean, I think back to this used to be something the business owner would say, “Well, that’s IT, we’ll handle that.” Then it became IT and PR, and now it’s become… And then HR, and now the legal department’s definitely involved in it. I mean, this covers a pretty wide swath of a business operation.

You know what? I think that’s absolutely true and it’s very cross functional. I think that’s why, just from a professional perspective, it’s quite enjoyable. It’s a lot of fun to work in this area because you are having to work cross-functionally on a cyber… Or an incident response team should have all those people that you mentioned. PR, IT, external legal counsel or internal legal counsel if you have, and to be honest with you, upper management, senior management. They need to be involved early. We see it now and again where that does not happen and it can be a risk to the company, it can delay things. So, I think that’s another key ingredient to keep everybody on the same page.

You know, you just used a really interesting word… Excuse me, word there that kind of piqued my interest because you said it is a risk factor, and it’s getting to be a bigger risk factor, and I just… Like, how big? Can you define that? I know I’m asking you how long is a piece of string here, but is it dangerous enough it could take down a company?

So, I think unfortunately it has the ability to cause some really significant harm. I mean, if it takes a company all the way down to the ground, that might depend, but generally speaking, especially if data is your livelihood, it has the potential to really cause some harm if you don’t take that seriously.

Well, we’ve seen some big ones, haven’t we? I mean, financial institutions with breaches that we’re talking tens of thousands, 100,000 clients. Customers daily-

Millions.

… that’s been breached, right? I mean, clearly there’s, you got to talk to the IT department about that. You’ve got to talk to the PR department about it, but there’s legal implications too.

No, that’s right. I think… And obviously the bigger the breach, the higher the number of impacted individuals. You get into… Another thing that we haven’t talked about, the notifications that, let’s say you have a cyber incident, which involves a notification requirement to a regulator and to individuals. Those notifications have to be drafted in a certain way that not only sort of satisfies from a reputational perspective, the person receiving that notification, they also have to satisfy legal requirements, which are actually spelled out in legislation.

So certain information has to be contained in that notification. Not to say that you can’t issue a press release that gives some additional basics, or if you want to get ahead of the story, that’s fine, but your legal notifications have to satisfy certain requirements.

You know, where do you like to enter the conversation? Do I as a business owner, or the manager of an enterprise on behalf of someone else, like a professional manager, do I talk to you early in the process before anything happens, during it or after? Or all of the above?

You know, ideally, I would… And I’m a business lawyer. I’m not a litigator. So if I can, I like to prevent things from happening. So, there’s a lot of preventative work that you can do. Now, you won’t be able to exclude the possibility of an attack. That’s just not in the cards, but you can do a lot to get prepared. You’ve got a breach plan in place. You have a team assembled. You know who to call, and having a breach coach, for example, if you have insurance, your insurer might recommend a breach coach, which is usually a lawyer to help you get prepared.

But if you don’t have that in place during an incident, I think right when you find out, I think one of your first calls should be to your breach coach or to the team that you’ve assembled to handle an incident. Then you figure out what you need to do, right? You start from the beginning, you say, “What are my legal obligations? What are I contractual obligations? What should we do? What do our employees expect us to do?” And you go from there.

Interesting you used the term team, and it really is about a team isn’t it in this particular field because you need the business side of it, you need the communication side of it, you need the legal side of it, and you need the people side of it.

That’s absolutely right, and I think from a… What I’ve experienced many, many times, organizations sort of look to their lawyer to do some quarterbacking. It doesn’t necessarily have to be the lawyer that does that, but many times we do fall into that sort of position where we’re kind of stick handling other team members. And like I said, I think it comes down to communication. Again, I think all team members have to have the same level of information in order to advise.

Well, if I’ve learned anything today it’s that this is a very complex area that business owners are sometimes probably find themselves that feel like they’re walking in a minefield because they don’t really know when this thing’s going to blow up, but they need to be prepared for it. And prepared is your best friend. Getting prepared in advance. Yeah.

David, thank you for taking the time to come in and provide us with some really interesting insights about how you need a team to be able to deal with these kinds of things, and that business owners are increasingly going to find themselves dealing with topics such as cyber breaches and data breaches and people generally attacking the inner data and information that is proprietary to any company.

So thanks for joining us.

Thank you.

David Krebs with Miller Thomson, law firm here in Saskatchewan, thank you for joining us. And Colin, as always, thank you for coming in. You’ve been listening to Risky Business Commercial Insurance with Butler Byers. This is Paul Martin. Talk to you again next time.