134- Risk Management with Gertha Jean

Episode Transcription

David Pisarek: Welcome to the Non-profit Digital Success podcast brought to you by wowdigital.com, your best place for non-profit websites and design, now including fractional CMO support.

Are you worried that your non-profit isn’t prepared for a crisis? Gertha Jean reveals how a few smart risk strategies can protect your mission, boost trust, and help you lead with confidence. Stay tuned, and let’s crisis-proof your digital strategy.

Welcome to the Non-profit Digital Success Podcast. As always, I’m your host, David. In this episode, we’ll discuss crisis readiness, digital risk, and building trust. And I’ve got Gertha Jean here with me. Before we continue, I want to note that our podcast needs your help. If you find this episode or any of the others insightful, interesting, or helpful, please like, subscribe, share, and comment. It really does help our podcast out.

With 15 years of experience, Gertha is the CEO of OWIG Risk Management. That’s pronounced OUIG. She’s also a non-profit founder herself, helping organizations stay ready, not reactive, by creating practical smart risk strategies that work.

Thanks so much for joining, Gertha. How’s your day going so far?

Gertha Jean: Going great, David. Thank you so much for having me on.

David Pisarek: Yeah, my pleasure. I think this is going to be a really, really great and interesting episode for a lot of people. There aren’t a lot of times when we’re thinking about risk management, and there’s a lot of thinking in terms of non-profits.

Now, I worked at a hospital for about just under five years. As you can imagine, we conducted various risk assessments: if there was a bomb threat, if there was a fire, if everyone was diverting away from other hospitals in mega-crisis, city-shutdown scenarios. We ran through what that would look like. How do we communicate? What systems do we have in place to get information out to the families of residents, loved ones, caregivers, or anything like that? That’s probably a little bit extreme in terms of what most non-profits might be thinking about.

As an agency, we have insurance. Non-profits should have insurance. So you have error and omission, you have general liability. Something a lot of people aren’t thinking about is cyber insurance. What if your organization gets hit with malware or crypto locker stuff or this or that? Let’s just start at the beginning here because I think I just totally threw a whole bunch of stuff at people here.

What does it really mean for a non-profit to be crisis-ready? And why should digital-first organizations actually take this seriously?

Gertha Jean: One of the things that you said is when it comes to risk, we know everywhere, especially when you’re a non-profit, risk is everywhere. We know it’s there, but how do you prepare for something that you don’t know could eventually happen?

I’m so glad that you mentioned insurance because I feel like a lot of people combine risk management and insurance together. They’re like, ‘I’m protected because I have insurance.’ I’m a very visual person, so a lot of my teaching and education is through storytelling.

I always say, ‘picture this: if it’s raining outside, you know it’s raining outside, you go outside, and you wear a pair of socks. What’s going to happen? Your socks are going to get wet. But that’s the whole point: you wear the socks to protect your feet. I always tell people that’s the insurance. You know that there’s going to be an issue, but just in case, I’m going to have this insurance in place to protect my organization. But if it’s raining outside, you put on your socks, but then you have your rain boots. The rain boots are the risk management. That is what’s going to protect the socks, which is the insurance. So you don’t have to use the insurance, and it’s going to save your organization.’

But I think a lot of people skip the rain boot part, and they don’t understand exactly what is risk management, and they don’t understand the processes to go ahead and put these things in place.

I think one of the biggest things when it comes to non-profit is realizing that risk can be anything. It’s not always a pandemic. It can be not having system in place when something happened. You don’t know how to communicate with your donors, you don’t know how to communicate with your staff.

But just putting these simple things in place, and that’s one of the reasons, too, we created, we call it the 3P framework. Back in COVID, they had a PPP. So at first it was PPP, but everybody thought we were giving out money. So we changed it to the 3P framework, which is prevention, preparation, and protection when it comes to risk management.

David Pisarek: I love that idea, the concept of the sock with the boots. I think what a lot of non-profits are probably more like is they’ve got the socks on, but they’ve taken some tape, and they’ve put it on the bottom of their foot. So they’re like, ‘All right, yeah, we got this. We know what we’re doing in case of an emergency, but there’s no formal documentation around the process.’

Risk management isn’t just about necessarily PR or crisis management.

It could also be you’ve got somebody in your team that has taken a new job somewhere else, and now there’s a gap, there’s a hole, there’s a void. Do you have your SOPs, your standard operating procedures in place so you know what to do, how things were done, and it’s documented so that somebody could take over with minimal downtime? And it’s those types of processes.

Back when I was at the hospital, that was… Let’s see, I left there in 2016. So we’re talking 10 years ago. There weren’t really SOPs, the way that you can do them nowadays. There are all kinds of platforms that you can get to help with the SOPs, especially in the digital world. We had binders. We had communication plan binders, emergency preparedness binders, and bright red binders. They were the four, five, six-inch binders, printed things. There was one at the comms desk, and one in our department because there was a marketing communications department. There was one, I think, with IT. There was one with the building and planners. Anytime there was a change, we had to print off new things and swap them out. Like, ridiculous.

You think about it now, and it’s like, why? But if the computer systems are down, if there’s a total power outage, if you are in an emergency, like a hospital getting care. If systems go down, if power goes down. There was a huge ice storm. We had to move residents into a local holiday, and we called and got rooms. What do we do? That’s something like, how would we have ever thought about that maybe being an issue? There was a power generator. We couldn’t get the fuel. It was a citywide… It was like wild, absolutely wild.

Gertha Jean: One of the non-profits that we specialize in working with is community health centers. We work a lot with hospitals and foster care, and we work with food banks, like the Community Service non-profit. And you would be surprised, David, because honestly speaking, I know me, if there is an incident, we have these binders that you talk about, but when it happens, do you know where the binder is? Or you have to dust through it and you have to flip through the pages?

Don’t get me wrong, those binders are great. But in a situation where the intensity is high, the risk is very high, you need to make these processes simple and easy.

So I always use this analogy of Hansel and Gretel, right? Because the story with Hansel and Gretel is that they left breadcrumbs. The first step in any crisis is to leave breadcrumbs, and you want to make it easy for your team or whoever is in charge. And I always say,

Put three simple things on those breadcrumbs: who to contact, what to do, what the follow-up is. Once they have those things, then it’ll make the process easier, and then we can go through the binder.

But I’m telling you, if the power goes out and it’s dark, and I can’t find that binder, what am I to do? So if we can go back, and like I said, I love telling stories, if you don’t notice them about me, because like I said, I’m a very visual person, and risk management is a very complicated subject, and so you have to make it in a way that people can understand. So, when it comes to the 3P framework that we talk about, which is prevention, preparation, and protection, right? If we go back to Hansel and Gretel, prevention is about spotting those risks, right? What are the gaps? What are we missing? You do a list of what can go wrong and how we can go ahead and put that boot on that sock. Correct.

With Hansel and Gretel, they left breadcrumbs. And so what you want to do is you want to leave these breadcrumbs behind for your staff or your donors so they would know what to do in an event of a risk. And I always say, make sure to keep it simple, make it easy for them to understand. Always three things on a breadcrumb: who to contact, what to do, and the follow-up.

Once you have those three items on the breadcrumb, you’ll know what to do, which will make it much easier for your team and help the organization run smoothly.

David Pisarek: I totally, absolutely 100% agree. And we need to be thinking, if there is some major emergency, people are going to be panicking.

Gertha Jean: Yes.

David Pisarek: If we make things simple, it’s easy to follow. We have a clear guide, do this, do this, call this person, do this, and it makes it really easy. Let’s keep the nerves calm so we can think clearly.

That should probably be the first thing. Stay calm, think clearly, call emergency whoever, and work through it.

But an online presence supports the mission without accidentally increasing reputational or security risks is the goal there. But how do you see how non-profits can leverage that?

Gertha Jean: I think one of the things that I have noticed is that when it comes to digital or even being online, it is such a great tool that some non-profits are not utilizing to their full potential. So we talk about risk, right? And sometimes, as I said, risk is not always a pandemic. It’s not something major.

Risk can be something simple as not following up or using certain platforms to create more revenue, to create more donors, to create more awareness.

So let’s take, for example, being digitally online. So many non-profits, I feel, are afraid of social media, do not utilize the importance of social media or even having a simple website because they are afraid of that risk. What if I post something wrong? Or what if a comment is given wrong? Or if I did the wrong picture, or I didn’t have this person permission? All of these things are important, but once you have that proper waiver, and you have all these things in place,

Use social media, use your digital platform because there are so many opportunities out there.

Let’s take, for example, we have a non-profit, and we’ve had so many people reach to us because of our use of social media. They’ve seen the events that they’ve done, we’ve done. They’ve seen the impact that we’ve made. And so many people out there want to be part of that impact. But if you’re staying within your geography and there’s a whole world out there, you can go ahead and utilize that, too. But don’t be afraid of the risk, but just putting those things in place to go ahead to enhance your non-profit.

David Pisarek: I think the benefit definitely outweighs the risk. Yes, you can put protections in place. If you need approval processes, if you have a volunteer or an intern or a placement student that’s working and helping out, you can put approval processes in place to make sure, ‘Okay, yes, this does meet the guidelines.’ You can have them put together a document that you review before anything goes up. You can have a month of content.

I was just talking about this, I think in the last podcast episode, but on the wall behind me, for anybody that’s watching this, yes, we do have video. Check it out on YouTube podcast. But I guess we’re also putting it on Spotify podcast. But I’ve got this board on the wall behind me where we actually plan out the content for the entire year. And then every month we figure out, all right, who’s going to do what and when are they going to do it? And we’ve got our standard. Every Thursday, we push out our email, that kind of thing.

You can build systems and processes to mitigate much of that risk if you believe it’s an issue.

From digital missteps that you’ve seen non-profits make, is there anything that might seem small but actually puts their credibility at risk?

Gertha Jean: I think one of the missteps is if we’re talking about reputation, right? So let’s just say if we’re talking about something, an incident that occurred, right? A lot of non-profits, they go silent, and that’s a no-no.

Do not go silent because with the world that we are in, media right now, whoever wrote it first, that’s who everybody’s going to believe.

And I always say, because they don’t know what to say in that incident, you do a simple announcement. ‘We are aware of the situation, we are working on it.’ That’s it. I didn’t tell you what the situation was. I didn’t tell you how we’re working on it. But you’re letting people know that we are aware of the situation, and then we are working on it. And internally, you also have that process. Okay, how are we going to contact our donors? How are we going to contact our employees? Who’s in charge of that? Internally, you’re working that internally, but externally, do not be silent.

David Pisarek: Communication is extremely vital, especially when there’s some emergency or crisis.

Not that long ago, there was a huge Cloudflare outage on November 18th. It’s built into the 19th, and many systems, sites, and resources went down. Were they able to communicate? Well, if Twitter was your main point of connecting with your audience, guess what? X has had huge outages, too. So how can we connect with people? What are the other different ways that are available planning for it? Going, ‘Okay, if this isn’t working, then what’s the backup? If the backup is not working, what’s the third one?’

I really do believe in triple kit in terms of being able to have fallback procedures. We did a server upgrade in the beginning of November, and we had a backup date. I think it was November 3rd, and then November 10th was our backup date in case there was a problem. We planned for were there to be a problem. Thankfully, we didn’t, and everything was fine. But how can we think about that? Do you have any tips for people that are watching this, listening to this, in terms of when should they plan multiple scenario backup things?

Gertha Jean: Well, this is the second P in the 3P framework. The first one is prevention. It happened, and we learned from it. The second one is preparation. What’s the whole point of going something if you’re not prepared for it? When it comes to preparation, let’s take the example with Cloudflare. We know if we prepared for the situation and we know that our only source was online, and that is not going to work. Okay, now we need to have plan A, plan B, plan C, correct?

When it comes to preparation, I always say, ‘think of every avenue or think of every risk that’s possible.’

For example, one of the things a lot of my clients are going through right now is funding. So a lot of changes happening in the economy and a lot of donors are pulling back. And so what we’re realizing right now, which was a huge risk, was a lot of those funding was either coming from a certain group of donors or a certain funder, correct? And so I say, ‘Look at the pie. If more than 50% of your funding is coming from one general area, you are completely at risk.‘

So what we have to do now is divide that pie up. We can say, ‘This is coming from this funder. What other streams of revenues that we can do to get those things.’ You have the perfect example of preparation.

With every non-profit it’s different. But with that preparation and looking at the whole pie and slicing it up, if this slice is taken out, we’re still good until we can put another slice in.

David Pisarek: Love that idea, right?

We need to diversify where funding is coming from so that we can make sure that the organization isn’t at severe risk. I would say 50% for sure is an issue. I would say 30% is also still an issue.

The last year has had a lot of shifts in terms of funding from federal, local, provincial, state, whatever. There’s a new reality. How can we shift away from that? And how can we lean into it to appeal to people? Because everybody, I shouldn’t say everybody, a lot of people understand what’s going on. If there’s a cause that they care about, a lot of organizations don’t want to say, ‘Hey, we’re struggling.’ But imagine if you went to people that already care about your organization, that have already been making donations for one year, two years, five years, 10 years, even if it’s $50 a year, $5 a month, saying ‘Hey, the new reality is this. We need your support more now than ever.’ I think there’s something to be said for that.

Gertha Jean: I think right now, too, is that we need to go back to the basics. With that being said, I work with non-profits. I started a non-profit. I’m on multiple boards. So when I say this, I’m seeing this from different… And plus I donate, too. So I’m seeing it from different angles, is that

as non-profits, we need to go back to the basics because right now we are at limited resources. Many leaders are burnt out. There’s stress, some which is out of their control. But let’s utilize the resources that we have right now, which is your mission and the impact that the non-profit is doing.

I wanted to think that you talk about so much on your podcast, and that’s why I’m a huge fan. I was like, ‘Oh, it’s storytelling.’ It’s a simple thing, but we forget the importance of storytelling when it comes to non-profits. You are doing an amazing work. You are doing wonderful things. You are changing lives. You’re bringing so much impact, but you’re not doing that storytelling. You’re not letting people know what you’re doing. And it’s not boasting because if the mission is in there, but if people do not know, they don’t know how to support you.

So let’s go back to the basics. Let’s use storytelling. Let’s use the impact. Let’s reach out to more people and say, Hey, and be honest, ‘Hey, I am struggling.’ You’re not begging because if there is a need, because how would you know what my response is if I don’t know what your need is? So I think that’s one of the things, too, when it comes to non-profit, is just going back to the basics.

David Pisarek: Absolutely. And I would argue with most non-profits out there, when you have your donation form, it’s going to sound bad, but on the donation form, don’t give people an option where the funding should be going to. It should be going to general operations or wherever it’s needed most.

And a lot of times, you’ll have a drop-down field that has 15 different things in there, and then the bottom is where it’s needed most. I would say get rid of that altogether and just it goes into the general pot so that as an organization, you can strategically use the money where it’s actually needed most. If you have people, if you have legacy, memorial, donation forms and things like that, build one-offs for those.

The overall main donation form that you’re driving traffic to should be for a general purpose. That way you can leverage that how you need.

Gertha Jean: Yes, I agree 110% on that. Just to add on to that, too, as well is bringing in that risk management component to it. I know we use the story of Hansel and Gretel. For the story of Hansel and Gretel, we use it within a 3P framework. At the end, which leads us to our third P, which is protection.

So at the end of the story, when Hansel and Gretel, they went back to their dad, and when their dad was like, ‘I’m so sorry this happened,’ and they’re like, ‘You don’t have to worry about your dad because we got all this gold.’ So they took the gold from the witch, right? And I use that analogy as protection, right?

As you go through these steps, you need to put in place measures that will protect the organization. So what we’re doing is we’re learning from our mistakes, and we are bringing that resilience in, and we’re bringing that protection.

I know in the beginning, we talked about insurance. So let’s use the stuff that we already have to better our organization.

One of a policy that most, if not, well, shame on you, non-profits need to have is a D&O policy, right? Which is a Directors and Officers policy that protects your board members in case if anybody says that their decision-making cost anything and they go to file a lawsuit against your board. It’s going to protect them, the board, and their personal asset, right? So you’re paying for this policy. You’re already paying for this policy. And this is a type of protection.

But how are you using that policy to go ahead and track new board members. So a lot of board members, if they see that you have a D&O policy, they’re going to say, ‘You know what? You care about your board. You’re reliable. You have these things in place.’ So use the protection that you have already, the risk that you have already, to go ahead and attract new board members or attract donors, because there are so many things that are being paid for, but there’s buy products for those things.

David Pisarek: I love the idea of leveraging the risk to help you get to where or whatever it is that you need. I talk about strategic partnerships with businesses, one of my workshops that I run is how can you get corporate sponsors? You can get corporate sponsors to help you mitigate the risk. Maybe it’s backup infrastructure, maybe it’s their expertise, maybe it’s some time value, maybe it’s some software. There are all kinds of things in the digital world that you can leverage to help you mitigate that risk.

Okay, so we talked about a whole bunch of stuff till now. The three P’s, why you need to be thinking this way. Let’s talk actual real tangible tactics here. People that are listening to this, maybe they don’t have a formal crisis plan. It’s probably something that just lives in their head, and they’re like, ‘Oh, okay, well, if this happens, it’s what I’m going to do.’ But if somebody’s listening and they realize they don’t actually have a formal crisis plan, what’s the very first step that they should take today?

Gertha Jean: The very first step to take today is to prevention. We have a crisis readiness guide that walks you step by step on what to do.

The first step in everything that you have to do is the prevention. Figure out what is your risk.

Let’s take, for example, cyber risk. We all know that it’s going to happen. What training are in place so that your staff know what to do besides the insurance? We all know we need the insurance. We all know that. Exactly. If there were a cyberattack, who would be the first person we contact? Is it our IT department? Is it executive director? Who is the first person that we contact? Then you want to go on, identify the who, and then the what. What do we do next? Do we have cyber insurance? Do we contact our insurance professional? And 9 out of 10 times. The insurance professionals, they will send you somebody, right? But you want to make sure that you have your internal things, okay? What was the issue? Did somebody click a phishing email? What was the… And figuring out those issues. So you have the who, the what, and the when.

How long is this process going to take for me to rectify all of these things? Who am I going to contact? Should I let my clients know? Should I let the donors know? And then we go again with why. Why did it happen?

And then that’s when we go with the preparation, the things, the different steps that we take.

So if you go with who, what, when, why, then you can go and have those. And I always say this, simplify everything, make it easy for everything, once there’s a panic, so nobody can be like, something happens, and they’re like, I don’t know. Where’s the binder? I don’t know. Who do I call? I don’t know. Who’s in charge? I don’t know. And then David, honestly, it leads from leadership, too, because the leadership needs to have all these things because it flows from the head down.

David Pisarek: Absolutely. And one of the things that is important for organizations to be thinking about is the training plan. It’s really important to know, all right, if this happens, we do this, this, this, this, right? But what is the mitigation? What is the staff training? When I was working at the hospital, one of my roles, there were two other sub-rolls that I worked with the legal department. One of them was compliance training for accessibility.

So what is the risk to your organization if you’re not accessible? We know that there are lawsuits and things like that that happen. That’s for physical space. Can’t somebody in a wheelchair get over that step to get access to the area? Or somebody who has a physical impairment, can they open a really heavy door that’s blocking the hallway or coming into the building, that thing. There’s digital accessibility for websites in that.

The other part of it was the compliance. Running training annually, having the staff that are responsible for managing the website in the situation that we’re talking about, sign a paper saying that they went through the training. That way there’s some responsibility. It all didn’t sit on me or the legal department, that everybody that managed it.

What processes can we put in place not just for the situation when and if something should happen, but to help prevent it to begin with?

Gertha Jean: Yeah. And like how you said, too, with training, and sometimes we take the word training and we’re like, it’s just a check the box. I took this training, but there’s no practical training. We do something with our clients, what we call it play, right? And so we actually do these trainings, whereas if this situation was to happen, I want to see how your team is going to handle it, not just saying, I sat down and if this has happened, then I need to push the door.

No, we need to see this in person, because in any high-intensity situation, you won’t remember what you sat down to until we do these things.

Exactly. And then we tweak it. We’re like, you know what? There was an extra step that really didn’t need to be there. And so that’s the thing, too. Don’t just check the box because you can say, I’m prepared for it. But in that situation, are you truly prepared for it? And I said, the risk is something that nobody… Because you can be prepared for one type of risk, and then boom, another one happens. But you’re constantly learning from it.

But like I said in the beginning, it’s having that boot there. Knowing that boot, I would rather have a boot there than have nothing. I’m like, I have soggy feet.

David Pisarek: Exactly. There’s a reason that in schools, they do fire alarm testing. They want to see how everybody handles the situation. They don’t tell you that they’re doing it. I mean, the principal, vice principal, they know what’s going on, right? But the teachers typically don’t know. The students don’t know what is the scenario and how is it handled, and what should happen, what training needs to happen, what assembly do they need to have to inform all the students, ‘Hey, when this happens, you should be doing this, not skipping down the hallway.’ I think that’s definitely an important piece. Are there any red flags or overlooked areas that you find might signal that a non-profit is vulnerable to a crisis?

Gertha Jean: Burnout. Burnout. Burnout, and sometimes a crisis, is the simplest thing. One of the things that I’ve noticed is burnout, because once the leader is burnt out, it affects the organization. So one of the red flags is when I’m talking to a leader, and I realize that they have a lot on their plate. They’re managing the organization, the funding, the programs and different things. Many of these things slip through the cracks. A lot of the things that you thought that they would have stuff in place, they slip through the cracks. So burnout is the number one.

The second thing is binders. Something simple. As binders, you have everything documented, but nobody knows what to do. So, having everything documented and having everything in a binder is not going to help you in that situation. Leave those breadcrumbs, make it easy and simple so everybody can understand.

The third thing is communication. Nobody knows who’s going to handle what. And I know these are simple things, but it’s the simple things that cost the biggest risk. Because I have met with leaders and I’m like, ‘Okay, so who handles this?’ ‘The COO.’ I go to the COO. ‘Oh, I don’t do it. It’s the IT Department.’ And I go to the IT, and the IT is like, ‘Oh, it’s the executive director.’ No one knows their roles or position, and they don’t know what to do in that situation.

Those are the three things that I would say are burnout, the binders, and then communication. Once we do an assessment. And those three things are a huge red flag that it’s time. It’s time to get you ready.

David Pisarek: That’s awesome. Gertha, amazing insights and thoughts on digital risk crisis prep, building trust with the community and within the organization, and helping people really understand risk and why it’s important. I hope the folks who have been listening or watching this have been able to get some great advice and some pointers from you. If you were to give everybody listening to this a challenge, something you wanted them to do within 24 hours of listening to the episode, what would that challenge be?

Gertha Jean: The challenge would be to write your breadcrumb list.

Three things to include in your breadcrumb: Who to call, what to do in that situation, and what’s the follow-up? What did we learn?

In that situation, you make a list. Who do I call? If it’s a cyber situation, it’s a PR situation, a patient situation, who is that person to call? What to do? Do I contact this person, or do I take care of this matter myself? Or whatever that what is, and what is the follow-up? What did we learn from the situation? Do that breadcrumb list, and it’ll be easy peasy.

David Pisarek: Awesome. If anybody wants to get in touch with you, what do they need to do?

Gertha Jean: You can find me and you can go to our website. It’s www.owigrisk.com, O-W-I-G-R-I-S-K.com. I’m very active on LinkedIn. You can find me, Gertha Jean, or you can find our social media outlets, which is Owigrikc on Facebook, TikTok, all the social media platforms.

David Pisarek: Amazing. And before the show, before we hit record, we were talking about how you’ve got a free non-profit crisis readiness guide. Tell us about that.

Gertha Jean: Okay. So if anybody who knows me knows that I always refer to my non-profit leaders as non-profit besties. Every time I’m like, ‘Hey, non-profit besties.’ I always, always, always have a gift for my non-profit besties because I’ve been in their shoes. I understand.

And so with the 3P framework, we’ve created a crisis readiness guide which breaks everything down simply, the different steps that you need to take, who to go ahead and put on your list, what to include in that, what section, what is a crisis. We have a scorecard to see where you are in your crisis position with your organization, and it is free to download. You can download it. If you go to our website, www.owigrisk.com, you click ‘Download’, and they’ll send to you. And that’s it. Because I like to give my besties freebies.

David Pisarek: I love that. That’s so great. Thanks again for joining in, Gertha. It’s been great having you here on the Non-profit Digital Success podcast.

To everybody listening, if you want any more details about what we talked about, we’ve got the full transcript, we have the video, we have the audio recording, we’ve got links to Owigrisk’s website and all of the amazing content that we’ve been talking about. Just head over to our podcast show notes page at nonprofitdigitalsuccess.com. Click on this episode for all the details.

And until next time, keep on being successful!