The need for risk intelligence in retail has grown significantly in the last year. Between Black Lives Matter protests, right-wing demonstrations, and rallies related to COVID-19, there were 16,670 demonstrations recorded in the US in 2020, according to the Armed Conflict Location & Event Data Project. “To say it was widespread, would certainly be an understatement,” said Ryan Long, director of global intelligence for McDonald’s.
Although public protests may not run as hot this year or next, we’ve entered a new era of vocal demonstrations and protests, with social media removing any “barrier to entry” for issue groups that want to mobilize and be heard, according to Long. Consequently, “the spotlight on a business’s duty of care hasn’t been brighter since 9/11,” he said, noting the complicating fact that the “speed with which these events can happen is faster than ever.”
Retailers have certainly taken notice, recognizing the high stakes for appropriately responding to risks of vandalism and business disruption while, in many cases, simultaneously demonstrating concern for the subject of protests. It’s made risk intelligence gathering a growing priority for many retailers.
So, as retailers look to build up their intelligence capabilities, what should they keep in mind?
Tips for Predicting Triggers, Readying a Response
Presenting at the NRF Converge conference in June, Long said there is no harder question to answer than the one that matters most—namely, “What’s going to happen next?” But while risk intelligence programs aren’t crystal balls, they can help position a retailer upstream of fast-moving events, as well as demonstrate care for its people. “It all comes down to being in a position where you are trying to proactively answer questions rather than reacting to events. That is not the state you want to be in,” said Long. He offered several recommendations for effectively building risk intelligence capability.
1. Beware of the “collector’s trap.” The ability to gather information about potential events that could disrupt retail operations is practically infinite, and more information doesn’t guarantee a retailer is any closer to preparing against them. “We can spend all our time searching, and searching, and searching instead of focusing on developments that could impact our organizations,” Long warned. Narrowing information sources to the most valuable and strategic use of search tools like “Google Alerts” can help keep intelligence-gathering focused.
Distinguishing the “signal from the noise” is a vital aspect of gathering intelligence for an early warning of disruptive events, suggested Long—because that is what an organization needs to start preparing, which is ultimately the most meaningful part of mitigation.
2. Study your business. To create a valuable early warning system, intelligence analysts need to as well-versed about a retail organization’s myriad component parts as they are about the risk environment. Because it is that understanding that allows an intelligence team to contextualize risk information for the business and discard the noise, suggested Long. It is why he generally believes that an in-house intelligence team or a GSOC is preferable to outsourcing risk intelligence monitoring and analysis.
A successful early warning system focuses on asking questions about risk with respect to company assets, priorities, and risk tolerance. “Questions about what’s likely to happen next, which specific stores could be impacted next week and how significantly—asking and answering those provide a roadmap,” said Long.
3. Recognize value beyond prediction. If risk intelligence programs can’t accurately predict events, what good are they? “One of the underrated aspects is providing psychological safety for your workforce and to reduce anxiety around what could happen, and so they know that someone is looking out for them and working to protect their health and safety,” said Long. “Our workforce wants to know they are being prioritized, and these days it’s not only appreciated, but also expected. Internal perception of security is critical to employees’ psychological safety.”
Additionally, Long says there is value in ascertaining a picture of risk events even if it’s a little blurry. “Even if I don’t have all the details, I would much rather provide our organization a heads-up that something could happen. That’s better than letting them be blindsided by events even when we can’t perfectly prepare,” he said. If security leaders can reduce the organization’s uncertainty, even by a small margin, they have more time to plan, communicate, and prepare the organization—and there is value in that, Long said.
4. Gain friends in key places. “Without our professional networks, I don’t know where we would be,” said McDonald’s Long, who notes that he is regularly in touch with his irsk intelligence professional counterparts. “You want to make friends before you need them,” he said. “There is no better resource for learning that something might be coming your way.”
For retailers without a team of analysts, it can help to tap into intelligence groups to “fill the void,” said Long, citing the value of groups like The Association of International Risk Intelligence Professionals (AIRIP). “We are a professional community and by sharing near real-time information and connecting with one another when we need help, we can build a more powerful defense. The bottom line is that resource sharing is a force multiplier.”
5. Manage expectations. Stakeholders need to have clarity on what a risk intelligence group can and can’t predict. “It’s incredibly challenging to know exactly what’s going to happen next,” said Long. Indeed, he says that while there is more information about the world than ever, it’s also getting more difficult to predict events.
Resilience is about identifying vulnerabilities to an organization and building plans around those vulnerabilities, according to Long. “We’re not going to see everything before it happens, so we have to maintain an ability to be nimble to develop resilience. You need a system that can roll with the punches.”
Risk Intelligence Best Practices
McDonald’s global intelligence director offered other recommended practices and ideas.
- Historical reviews are worthwhile, as civil unrest and rioting does tend to repeat itself. “It’s smart to look at hot spots from the past. They do go to the same places over again.”
- Maintaining an awareness of where your personnel is at all times is fundamental.
- Having visible security measures can provide a measure of deterrence from civil unrest.
- Scenario planning is key to building resilience, especially valuable for resource-strapped teams, and can define critical gaps to a retailer’s most sensitive assets.
- Set internal thresholds for when to act and define procedures for both leadership and employees to follow in the event of security risks from social unrest.