Okay, as I said in the beginning here, my name is Mads Pærregaard. I'm the founder and CEO of Human Risks and I think we are about to get started here. We have a lot of participants joining in from almost all over the world, I can see. So thanks for doing that. There is a little bit of housekeeping first maybe for the system that we're using here or the app that we're using for this webinar. So if you're new to 23, then we have a box for questions at the top left side of your screen. So you can always click on that and then ask questions. I have my good colleague Stella watching over the questions and the chat and she will make sure that they are brought to the attention and we can answer any questions. Yeah, and then we also have a, of course, just right next to the questions, there's the chat. So feel free to throw in any comments that you have on the webinar as we go along. And we also have a poll section. I think we're going to test that in a second and throw a question there or a poll in there and see to test your participation there a little bit. And then also I have to say, oh, here the poll is. How well do you think security team, the security team and leadership understand each other in your organization? Feel free to answer that while I paddle here a little bit. The session here will, of course, also be recorded and be shared with you directly on the email as a follow up of our webinar, our live webinar here. And then we would love your feedback. So we'll try to send out a survey as well after the webinar together with the recording. If you have any input on our webinar. If you have any input on our webinar, I suggest a topic for the next one or anything, then don't hesitate to provide some feedback. That is the only way of improving and getting better. So we really appreciate that. And then I think we're going to be able to get started here and are ready to throw ourselves into the mix. We are here today to talk about how security adds value to the organization and how it's viewed from the top and senior leadership. And I'm really happy to have Harald Bittenberger with me here from Ernst & Young to share his experience with us. And Harald, welcome and thank you very much for taking the time and for joining us. Would you like to introduce yourself? Sure. Thank you so much for having me. I'm really glad to spend some time with all of you, the security risk experts. Thank you. I'm a professional services provider, one of the so-called big four. So we have around about 350,000 people globally working for us. And I'm always saying, it's only people and laptops. We don't have anything else. So that's what we are looking after. I'm a lawyer by profession and worked in the transaction M&A business for quite some years. But then moved to take care on quality assurance, quality measures, methodology, and also risk management and compliance. And these type of things, which I'm now leading this fairly broad function in one of our geographical units, which is called EuroWest. It consists of 10 countries. And that's what my team and I are looking after. Thank you so much, Harald. Thanks for the introduction. And I think one of the points that we try to make for this webinar is that we are going to talk about a topic that has been talked about before. Like how do we as a profession add value to our organizations that we work for? But today we are lucky enough to persuade you to join us. And also because often that conversation is among security professionals. But today we are actually hearing from someone who comes from outside that profession and having security professionals report into you. So I'm really looking forward to that. How do you see that from your perspective and your lens here? Yeah. For those of you who don't know Human Risks, we are a security risk and resilience platform, a digital tool. It's, as we say, built for practitioners by practitioners. And we are a software company based in Denmark and founded by industry experts that were trying to build the tool that we didn't have ourselves when working in security. And why build a platform? Well, we exist because the old way of doing things in Excel sheets and siloed tools, it simply doesn't work at scale anymore. A centralized platform is the way forward as we see it. And that's what we are building here and are going forward with. We have companies like EY, HSBC, GlaxoSmithKline, Energinet, CraneCurrency as our customers trusting us with our risk programs. And we, of course, are proud to be building out that list every day. So if anything that we say today resonates or makes you curious, then we would, of course, love to give you a guided tour of the platform. Reach out, drop a message in the chat or go to our website and sign up for a demo. And we can go with to coordinate that. OK, I think it's time to have a look at the poll. I don't know. We have some results coming up here. Yeah. How well do you think the security team and leadership understand each other in your organization? I think there's an old way here, but somewhat. There's a gap. Very well. 25 percent. That's great. So that's fantastic. Good for you. Good on you. And then six point something percent here. Not well. We talk past each other and it varies. So I think maybe it also reflects that there is still a gap to close and some things to do. And how do we communicate and align with the senior leadership from the security teams out there? So thanks for participating. OK, Harald, to get into the conversation here, maybe a little bit of background and context, because as you also said in your own introduction, you don't come from the military. You don't come from law enforcement. You haven't worked a lot of years in security, but here you are in security and managing security in a very big organization. Could you tell us a little bit about how security has developed since you started the role in EY? I'm very happy to talk about that. Since we have gone through a journey from really almost not recognizing the discipline at all to building a solid, mature team working on all of the disciplines and pillars that we have set up, I still remember the time. It was around about 10 years ago, where I assumed the role of risk management, where on the org chart, security risk management was a box, a little box in the corner. And I still remember the transition interview I had with my predecessor. We talked about 90 minutes and in minute number 91, he told me there is something else. I have not really touched that a lot in the last years, but you should look at it. And he handed over like a bunch of 10 papers. And that's what I was left with. And that was all what I knew about the function. When I then looked at it, for me, it became very clear very soon, we need to do something about it. And that's very much started with hiring professionals. People that are experts in security risk management. And then we put a team around them and build it step by step, which was a long journey. And the poll actually shows you. And I think we probably would see the same results in EY, depending on with whom you are talking to. But 10 years ago, there was no connection at all. So we needed to do a lot of work on awareness, on proof of concept. And that paid out. And I think we come to that later, in which way it paid out very well. Yeah, thank you so much. It sounded as if security was this little appendix. Oh, by the way, you have something here you need to manage on the side. Okay, so the big question today is, and that has been a topic ever since I joined the industry, some whatever, 10, 15 years ago, that how do we add value to the organization, right? We want to serve. We want to make a meaning. We want to add value to our organization. The word enablement has been a well-used term here. But from an overall perspective, how do you best see this? How does security best add value to the company they work for? That's the question. That's what we are striving for. And I have brought some slides that we can look at on how we try to link everything what we are doing to an impact and to a value proposition. So you see here the six pillars that we are working on. And I'm really not going to go through each point of the slides, but you can see in the next slide that describes what we are doing in terms of linking any activity to a value proposition. So in physical office security, you see the clear focus on people and assets, the focus on are we clear how operations can be interrupted and then get back to running again. And you see the impact indicators we are listing here. So the point that I want to make here, like beyond the bullet points, nothing happens without a thought what impact it drives and can create. And by doing that, I think we create an environment where leadership, but also our people recognize the value very, very immediate, very quickly. At least once one of the pillars, and maybe if you can go back the slide with the overview, that's the easiest to explain. Like when you think about travel security, if we get people out of high risk areas quickly when something happens, they will forever thank you for that action. If you advise them what to look at and what to be aware of when you go to an extreme risk country, they will forever thank you because they feel much prepared. I have to admit, it was a journey to make clear that it helps, but the more people experienced a challenge during travel and then saw that our advice was relevant and clearly given and easy to translate into a mitigating measure, then you have another supporter for the function. So in travel security, it's very much about people. In crisis management, it's mostly about learning how to deal with the unknown. And I think that's where our training and exercises with the leadership teams and the crisis management teams kick in. It takes a while to get them through the exercises because it's so human that you think everything is all right and whatever is coming, I will deal with it. And just an exercise and a drill can show you, you know, maybe we haven't thought through many of these things. So that's a growing area of awareness. When it comes to meeting and event security, that also is very immediate, contributing to people's well-being and people feel safe and sound when they are in big events. And some of our events are with a couple of thousands of people. So it's really relevant that we put the right structure around that. So that's where I think value is provided in various layers. One is hard numbers. So we can, if a discontinuation of a security measure is a problem, we get back to continuation. That's just a matter of fact that it helps you. If it's something that relates to people, it contributes to the culture of the organization. And this is something we have for long underestimated. How important it is to have a solid stand against travel security and physical security and the meeting and event security to give a signal that people matter for us. And that is now, I think, works very well in a still, I think, small team, but a very effective team that is taking care. And maybe, Mats, if you allow me one more comment. A side effect of the security risk management methodologies and expert knowledge is something I actually detected during the COVID pandemic. And I never thought about it, which is when you are leading a professional services firm like ours that is organized in partnerships. So we have partners that are owning the business and they behave like that. So we are very much, we call it a consultation culture. That sometimes means in practice, we discuss a lot. When a crisis comes, you can't discuss a lot. You need to change to a control and command habit. And only the security risk management experts and the framework allowed us to make clear to all people, now it's a crisis, this is it, and this is the control and command structure we need to apply. And then we have been able to make very quick decisions and still very informed decisions through the framework. So that was also a methodology element that went much beyond the disciplines of security risk management, I think. That also reveals, I think, a little bit about the organization and how your organization values different expertises or experts in the organization, of course. Maybe as a follow-up question, I would say, because you're already talking to, there are certain things that can be measured and there are certain things that can't be measured and creating ease of mind and support and all that. I think we will, of course, come back to that. When you look at that and you took over a whole new area, you hired the right people and all that, and you've built up a system now and a framework. But how is value then being perceived if you look at the people that you report to, the leadership above your level? Are there different angles there? Maybe if I was very focused on numbers, I would look at this or what's the impression that they focus on? I mean, in a way, there are various types of leaders. So one is like the compliance-driven leader. For them, the development of a risk-based framework that we could measure our assessments on every year was very relevant. And we have a policy, a global policy, that drives how things should be set up, for example, when it comes to physical security measures in an office, or when it comes to how a process should be designed in crisis management. And then a yearly assessment makes sure that we check whether we are at the level we want it to be. That's for some part, it's numbers, like CCTV coverage in offices, or backup servers in the IT space, or things like that. Sometimes you feel that you respond to a need appropriately simply by what you hear about the security risk management function in the organization. That's the reputational angle that I have alluded to. And leadership listens to that very carefully. So if they hear the good stories, and if they hear the not so good stories, where something went wrong for whatever reason, we deal with it. And they see how we deal with it, how we fix situations. And that's very much how the leadership becomes happy about the investment we take in this regard. And I just saw the comment from Horst. Whenever we talk about culture, it becomes hard to put a number to it. And I think we don't need numbers there, because everybody knows how good you do in this respect. If you listen carefully, then you know whether there is still something to do, or whether you are okay. And I think leadership at EY is cognizant of that fact, which allows us to have the appropriate investment when we see that there is something to improve or to fix. But is that also without putting words in your mouth, of course, maybe some of the hard metrics with numbers might reveal something that is an underlying challenge that is, you know, in order to fix it, you have to look into the culture and awareness and all the, you know, where it's difficult and more challenging to work. That's, yes. The assessments, to be honest, whether we learn from the KPIs in terms of what else needs to be done, I'm not aware of many things there, to be honest. I think it's, or maybe I should actually broaden the view here. For example, if we see crisis management mindset only comes from people that have gone through the training, very clear, we have numbers, how many people have gone through the training, and we see it's beyond what we expect, then we need to double down on getting these people to the training. So that's, that's the type of numbers, I mean, you could not manage without. So that's, that's where we see, and that's actually the experience. The more people we run through the training, the more supporters we have, because people are lacking the experience what helps them. So KPIs like that definitely are examples that trigger action since we see what needs to be done. That makes a lot of sense, and I think later on, if we get the chance, we'll have a look at KPIs versus, you know, key risk indicators, but, you know, and then maybe you can, you know, revert back to this point in the conversation where we are maybe tying those together, right? That reduction on non-performance or less performance than expected in KPIs might actually, of course, result in some KRIs, and how to solve it is then a little bit more nuanced than just fixing a number and doing that in business. And talking about numbers, I've often, I've been head of security myself, you know, they see, there's a risk of organizations of seeing security as what we call a cost center. It's just, oh, we need to have it, and it's a financial cost on the spreadsheet and we need to pump money into that. I think human resources has been a department looked at in the same way over the years in some organizations. Have you ever combated that approach or been able to, you know, okay, we have to address that perception and are there any tricks in your book on how to do that? Yeah, I mean, since we started literally at zero, we needed some concepts how to achieve that. It is as often the bad examples that, like the war stories that you use to become better or it's the success stories where you say, okay, guys, if we wouldn't have done that, we wouldn't be able to manage. and again, the pandemic was an example where it turned out to be extremely useful to have a structure in place since 2017, 2017, when then 2020, the pandemic hit us and there was some other kinds of crisis that are more related to our profession where also the discipline, the structure and the expert knowledge of the security risk management function helped a lot to get that stuff organized properly. So, to be honest, it was mostly these two elements, the good and the bad stories that we used to achieve the appropriate level of investment and which allowed us to go beyond what the letters of law anyways required to do. I mean, there is some areas where letters of law help us to implement things because it's simply regulation in the countries telling you this needs to be in place. I mean, that's the easy one but to bring it more to life and more strategic and more effective also contributing to culture you need to do the storylining and that works a lot and to be honest still to make that a fairly effective function in the greater context of what else an organization needs to spend money on I mean, this is not the biggest one. So, there should be enough funds to get this right. That might be different in other industries. I mean, I can see industries where this has a completely different angle when you talk about physical security short floors but that's a different different game. As I said, we have laptops and people to take care of and that's complex enough. You don't need a lot of machinery to further complicate the situation. No, no, of course, every industry is different with different margins and different operating models so of course that's a contextual thing. If I can dive into let's say the hard metrics a little bit remembering of course there are other metrics to be focused on but if we can dive into the KPIs and maybe we talked about some tangible examples that are there elements that you could share here that how you measure the success of the teams reporting into you and that you also use further up the chain if I can say it like that like some examples that have proven valuable for you to measure success and follow in yeah, insecurity over the years. yeah, maybe a couple of only it's it's one to measure simply the completion rate of things we have agreed to do the training coverage is one of it the attendance and advice on events and the coverage how many events we are we are covering and with physical attendance of the experts or without so that's some activity based KPIs that that we apply and then there is a set of KPIs that comes out of the yearly assessment that we do where the entire activities are measured against a framework and with a regular process of analyzing the assessment and then see whether we need to do more in a certain area or whether we are okay now you are I think you are on mute I was still muted no I am not muted I hope sorry for that everybody good it happened to me I think for those KPIs I am sure you have worked a decade with security at EY and you have matured the perspective here and ruled out KPIs and introduced new ones and all that are there KPIs you are looking for in the future that ties even better into the outcome maybe not activity based but outcome or impact based for the organization that you could when we talk again in three years what would you then highlight yeah that's difficult for me to respond to be honest where we can showcase impact I am always prepared to put that on the dashboard and to make it a discussion at top leadership but to be honest this is really where experts like Bruno our security risk management leader would be much better to answer so that that's where I need the expert to help me with that that makes sense that makes sense are there any of the KPIs you mentioned that then resonates that you keep certain measurements on you know with your managers the people that you manage but other KPIs that you talked to before that actually goes up in the organization that you are measured on and that you report on what is likely to create noise and noise at least in a positive sense this is really measures around the travel security area where it is recognized how many people travel to which place and how they are prepared so that resonates immediately which is a function of simply because it's people that matter here individuals that need to be protected well with others I think we still have to do some work that I mean the crisis management training is one where I think we still wait for the tipping point that the majority of the leadership teams are asking for it and I think that's a typical thing where we are working in progress I think yeah that makes sense I also think you highlighted some KPIs on your slides I don't know if we've looked at them enough but I know also that if people want some inspiration for very tangible measurements I know that in the slides that we shared here on the call but I'll let Stella make that call if you want to bring them back oh here we go yeah reduced incident rates and vulnerabilities or compliance with internal and standards global standards of course are something that is listed here as impact indicators or safe execution of high risk travel you talked to that as well Harald just before like you have people traveling all over the world and of course incident response effectiveness and the support you've given but that and I'm throwing you maybe a curveball here sorry for that in advance but that also requires you and your team to do a lot of registration because if you report on that as how has that changed over the years if you can talk to that that's like from a very much hands-on approach based on Excel and based on a very local approach as well so we started with not knowing what's going on to country by country getting a feeling for what it is documented in Excel sheets and now of course we respond to that with technology with tools that allow us to collect the data effectively and quickly and also allow us to do the necessary analysis around the data and I mean technology companies like yours that decided to think about technology in a very specific niche area of activity that brought a lot of value to us using that type of technology and then set aside the whole implementation and roll out of course that's a whole other webinar maybe for another day but yeah sounds good and when we talk about we've talked about measurement now and success and how that looks and some things can be measured with hard metrics and KPIs and whatever and some things are difficult to measure and it's all about the reputation and supporting the staff that works at EY but from an organizational perspective when we you know with the different organizations customers we work with we often see security organized reporting up in very different places it can be within human resources it can be in facility management it could also be more of an admin function under whatever support there or finance whatever do you have an opinion on that or perspective I'm sure part of the answer is it depends but how do you see that I'm glad how we positioned security risk management within the risk management compliance quality assurance methodology space because by that we ensure that the entire organization is looked at first and we also ensure that it links to any related activities so if there is cooperation with the people that take care of the offices is required which is a lot they are in the same overarching organization they are close to us and if it's travelers they are in all like we call it service lines in different departments obviously this is organized as one block and we take care of all of them there is there is only one element which is separately organized and that's the IT technology driven like cyber security risk but it's also a collaborative approach with them because every time when there is a need of behavioral change of people it's on us to work on that and if it's just technology getting the firewalls right and the spam filters and what have you that's then the IT guys taking care and it's not that's really outside our organization yeah and that makes a lot of sense of course that you work together with other risk disciplines and try to create a uniform and aligned approach there but again speaking of success criteria and measurements have you been able to align on language you know we often have that conversation oh but cyber risk or information security risk are talking and calling it have different terminologies or different risk levels or how is that managed very honest there is still a gap they are talking a different language and they are not always and I say they because it's just like the other organization within the same organization but it's clearly a way to go to align and to align also response methodology and that's actually very complex because you need technology you need legal advice you need security risk management methodology so you need quite a bit to fix that and it and it becomes as we speak highest priority to fix that since it's all about data and data security and professional services firms move and become more and more tech companies and we need to respond to that change of our organization and obviously our clients look at us because they trust us in giving a lot of information that we then need to process and to deal with so there is a high level of trust we need to respond to and make sure that we don't lose that trust so that's a high priority area where we also invest a lot of money to make sure that confidentiality and cybersecurity risks are responded to as best as possible yeah it's a big responsibility and of course when you hire one of the big four I guess people also look to you as being the role model so how are you guys handling this and yeah coming in to provide a lot of advice here I think we are getting some activity here on the audience chat and that is fantastic we are slowly transitioning into the Q&A session here so if there are any questions I'm sure Harold will try to provide answers and I'll support the best I can here but first of all Mario is asking here let me read it out loud for the senior business owner which KPI or format works better to understand the value of corporate security Harold I'll give you 10 seconds maybe to consider this but we've been around the KPIs before we also talked about maybe even the senior managers above what matters here and what is the format and I don't know Mario let us know if you think about format is actually like is it a monthly powerpoint is it a BI dashboard or whatever but maybe can provide so maybe Harold any thoughts here yeah I mean where there is a number can attach to a matter should use it especially in a company where people think in numbers they admire it but there is a lot where it's hard to put a number to it and then I think it's important to have the confidence that contribute by other means and that also express that confidence this is how senior leadership is getting it I think yeah so are all do find yourself trying to translate the success of your team that works that are industry experts in security and have to translate that to senior business owners or senior leadership that don't work in security but again have to tell the story of successful achievements yeah and we do that over and over again I mean it needs to be addressed regularly and we are building intelligence what can be showed in numbers and what can be showed in stories and I think that concept works well yeah then we find out that we all work in sales and marketing right because we have to communicate and get our message across and all that yeah Pavel has raised a question also hello my question did we talk also about security like the entire architecture physical cyber fire resilience if I add now it's math speaking if I add my interpretation here it's more about are we in our conversation here have we been so focused on physical security or have we talked about cyber I think Harold you alluded to cyber and working across disciplines in your own organization but any thoughts on this when we talk about risk in a broader concept clearly you need to look at it as broad as possible and then you need to decide what's the team you need for certain matters and that's at least the IT guys the legal guys talent and security risk management needs to work together in almost all circumstances and sometimes when it comes to physical security you have like the office people included so there is a lot of connecting dots we need to deal with yeah and this comes in from Bruce just also yeah it's on the screen here thanks Bruce for raising this corporate security should not stand alone in trying to be a strategic partner security should join with all the protective disciplines to demonstrate how collectively increase the certainty of achieving each value generating objectives in the operational domain I can see already Harold is nodding oh totally totally that that's where what I alluded to when I said that it's well situated in risk management and under the roof of what we call enablement services so that we are teaming up with all other disciplines that have a strategy on protection of assets and people I assume it's also a shortcut to being respected by the people that we serve as security professionals out there in the organization because if security is visiting on Wednesday and IT security is visiting on Friday and health and safety is dropping in on the next Tuesday then of course if those forces are not aligned I guess there's also risk of stressing the organization and things are not aligned and they have to answer the same questions multiple times I speak from personal experience unfortunately there right so yeah yeah and I wouldn't say we are perfect on that one I think that's a challenge for each organization to keep us together as a multidisciplinary team thanks Harold I think yeah and Pavel has said thanks for the answer sounds good if there are any additional comments or questions from the from the audience now would be a good time so don't hold back feel free there is this question something coming in here I have a something I thought about how if we had the time for it and we do you know the critical entities resilience act from the EU is being rolled out across Europe as we speak from my side is one of the first standards or regulatory elements we've seen where physical security sort of takes the lead and and your team is responsible for the security across many European countries and I think Germany also just released a new physical security standard that also has a meaning there how do you guys get that overview and how do you manage the different requirements that suddenly your offices in Spain have to live up to something different that your offices in Sweden might have to live up to that's a level of complexity we are very much used to because we are a regulated business in various aspects already and if you I mean the audit business is highly regulated and the European Union is perfect in making a nice mess out of these things so that's that's I'm not saying it's easy for us but we are used to it and that you know needs to be needs to go through a stakeholder journey where we analyze country by country what needs to happen and of course we try to find baseline like minimum baseline requirements so that it becomes more manageable fantastic thanks for your comment Bruno that's very much yes I will if we go into further detail we will also get Bruno on the call and I think that finalizes the questions that came in from the audience and from me so thanks for participating to everybody who chipped in here and not least for answering Harold and being ready to jump at any questions that we could raise here I think before we end the whole session here I know that we have been working also and trying to sort of close the loop on what we've been talking about here how do you measure the success and that if I can try to make a 20 seconds summary I think it's complicated and it depends but it also depends on what metrics use some are relevant for hard metrics and KPIs that can be reported in an Excel file but some metrics are I dare to say softer it's about culture it's about behavior it's about human beings and people and how are there for them when they need the support and then tell all the good stories so actually part of KPI reporting is good marketing about the elements to the attention I think if I can of course use this opportunity to talk a little bit about my own company that I wanted to bring to everybody's attention is that we are releasing an updated version of our dashboard where can build your own KPIs into it so can define your own measurements and your own success criteria and then select the dashboards the charts the numbers whatever that makes sense and resonates in your organization I'm not sure we support storytelling yet but we support different numeric and metrics both for KPIs and KRIIs and when we did the big brainstorming and it's again through with conversations like Harold and other customers I think it's on the next slide if I can oh here it goes know there's so many different metrics right some are could also be activities and some are KRIs or key risk indicators things that indicate to us that something is going in the wrong direction or function as early warning so we've looked at all these KPIs and KRIs that see on the screen and they're trying to modulate them into the dashboard saw before so stay tuned and keep an eye on that we are launching that soon the platform and the admins can put together their own success criteria here on the human risk platform first of all I would like to thank Harold so much for joining today and taking the time to speak with me and be online here and then thanks for also watching over us here with the chat and the questions that come in thanks to the audience for joining not least and for asking good questions that we can that we try to answer here and then before we shut down a little bit ahead of time so if there is a final question hiding somewhere we still have time but then we'll keep guys updated we'll send all an email with a link to the recording here and also with the survey and then I want to flag that we just launched a on how they are managing security risks it's right here and can download it for free on our website but it talks very much to how a professional security organization also is managing risks and resilience in another interesting company and organization that I guess prints the money that the rest of us spend some time okay I think that was it I think thank you so much for having me here thank for participating and joining have a good summer see bye bye bye bye