Public Risk January 2018

PUBLISHED BY THE PUBLIC RISK MANAGEMENT ASSOCIATION JANUARY 2018

MANAGING THE RISK OF

PAGE 6

ALSO IN THIS ISSUE

ARE YOU A DATA WHISPERER?

Psst—It Can Tame Your Workers’ Compensation Costs!

PAGE 12

THE INTERNAL AUDIT FUNCTION

Challenges and Opportunities for Today’s Public Risk Manager

PAGE 16

JUNE 3–6, 2018 Managing risk in our cities, counties, schools, states and tribal nations presents unique challenges and PRIMA’s Annual Conference is the only conference dedicated to YOU: public sector risk management professionals.

Join more than 1,000 of your public risk management colleagues, leaders and experts for an exceptional learning and networking opportunity in Indianapolis.

REGISTRATION OPENS IN JANUARY! conference.primacentral.org

JANUARY 2018 | Volume 34, No. 1 | www.primacentral.org

CONTENTS

The Public Risk Management Association promotes effective risk management in the public interest as an essential component of public administration.

PRESIDENT Amy J. Larson, Esq. Risk and Litigation Manager City of Bloomington Bloomington, MN PAST PRESIDENT Terri L. Evans Risk Manager City of Kingsport Kingsport, TN PRESIDENT-ELECT Jani J. Jennings, ARM Insurance & Safety Coordinator City of Bellevue Bellevue, NE DIRECTORS Brenda Cogdell, AIS, AIC, SPHR Risk Manager, Human Resources City of Manassas Manassas, VA

Managing the Risk of Unmanned Air Vehicles

6

Lori J. Gray Risk Manager County of Prince William Woodbridge, VA

NON-VOTING DIRECTOR Marshall Davies, PhD Executive Director Public Risk Management Association Alexandria, VA

L

T

A

EDITOR Jennifer Ackerman, CAE Deputy Executive Director 703.253.1267 • jackerman@primacentral.org ADVERTISING Jennifer Ackerman, CAE 703.253.1267 • jackerman@primacentral.org

16

AUDIT

Are You A Data Whisperer?

The Internal Audit Function

By Michelle Despres, PT, CEAS II

By Joe Jarret

IN EVERY ISSUE

Sheri Swain Director of Enterprise Risk Management Maricopa County Community College District Tempe, AZ

NT E R N I E

12

PSST—IT CAN TAME YOUR WORKERS’ COMPENSATION COSTS!

Forestine Carroll Risk Manager Memphis Housing Authority Memphis, TN

Donna Capria, CRM, CIC, AINS Risk & Insurance Coordinator WaterOne of Johnson County Lenexa, KS

By Kathleen L. Wieneke, Esq., Daniel P. Struck, Esq., and Dana M. Giallonardo, Esq.

H

Scott J. Kramer, MBA, ARM City/County Director of Risk Mgmt Montgomery County Commission Montgomery, AL

CHALLENGES AND OPPORTUNITIES FOR TODAY’S PUBLIC RISK MANAGER

Public Risk is published 10 times per year by the Public Risk Management Association, 700 S. Washington St., #218, Alexandria, VA 22314 tel: 703.528.7701 • fax: 703.739.0200 email: info@primacentral.org • Web site: www.primacentral.org Opinions and ideas expressed are not necessarily representative of the policies of PRIMA. Subscription rate: $140 per year.

Back issue copies for members available for $7 each ($13 each for non-PRIMA members). All back issues are subject to availability. Apply to the editor for permission to reprint any part of the magazine.

POSTMASTER: Send address changes to PRIMA, 700 S. Washington St., #218, Alexandria, VA 22314.

Copyright 2018 Public Risk Management Association

| 4 NEWS BRIEFS | 19 ADVERTISER INDEX

JANUARY 2018 | PUBLIC RISK

1

PRIMA Community Collaborate.

Communicate.

Network.

PRIMA Community, a social media and content website dedicated to the needs of PRIMA members. This platform provides a virtual meeting place to get the latest developments in public sector risk management, share your knowledge and increase your connections.

PRIMA Community lets you: • Connect with your peers and share information on risk management • Participate in discussion groups/communities • Post questions or respond to others’ questions • Obtain access to an exclusive member directory • Access documents from digital libraries • Create private and public groups to network online with your peers • View member blogs or create your own JOIN YOUR PEERS TODAY! community.primacentral.org

MESSAGE FROM PRIMA PRESIDENT AMY J. L ARSON, ESQ.

appy New Year! I hope that everyone had a wonderful and uneventful holiday season.

As I sat down to write this article and started thinking about all of the outstanding upcoming programming, I realized that 2018 is going to be a great year for PRIMA! Here’s a brief highlight of things we’re working on: You asked for it in the needs analysis survey, and we listened. In 2018, PRIMA will be releasing a five-part loss control webinar series.

This series covers different phases of the loss control process, including real-life examples and tools. The webinars are being written and presented by the members of the Loss Control Task Force that include: Michael Fann, TML Risk Pool; Don Leonard, Travelers; Jessica Rice, City of Charlottesville, VA; Jack Aspen and David Weightman, PMA Companies; myself; and of course, constant support from PRIMA’s Shaunda Ragland and Marshall Davies. This has been a fun and interesting group to work with, and I’m very excited about the product that should be released in the first quarter of 2018.

In addition to the Loss Control Task Force, we are putting the final touches on the Cyber Task Force. This task force will be charged to identify cyber issues and risks for our members as well as working with Homeland Security to bring timely information and resources to all of our members. Check out the Cyber Security Resource Center for more information on the website, www.primacentral.org!

Early bird registration for the Annual Conference opens on January 9, and I can hardly wait!

I’m looking forward to our time in Indianapolis.

Brenda Cogdell, 2018 Conference Chair, and the Conference Planning Committee did an

“

As I reflect on 2017, and the challenges and

blessings that were faced, I am very thankful and grateful for all of the opportunities, both personal and professional, that came my way… This is a GREAT organization. I treasure the friends and colleagues that I have gotten to know as a result

“

H

Welcome to 2018

of being a member and participating in all of the opportunities made available by PRIMA.

excellent job developing this year’s curriculum, and I know that there will be something for everyone in both the educational and exhibit hall offerings. So be on the lookout for the email telling you registration is open!

As I reflect on 2017, and the challenges and blessings that were faced, I am very thankful and grateful for all of the opportunities, both personal and professional, that came my way.

I am thankful for my family and friends. I am thankful and honored to serve as the 2017–2018 PRIMA President. This is a GREAT organization. I treasure the friends and colleagues that I have gotten to know as a result of being a member and participating in all of the opportunities made available by PRIMA. So thank you all for your continued support and participation

in our programs and for reminding me that I don’t have to face my challenges on my own— I have a GREAT group of people, smarter than me, that are always willing and able to help. So, until next-time—here’s wishing you all a Happy and Healthy 2018!

Amy J. Larson, Esq. Risk and Litigation Manager City of Bloomington Bloomington, MN

JANUARY 2018 | PUBLIC RISK

3

NEWS BRIEFS

NEWS Briefs

TO REDUCE RECIDIVISM, NEW YORK CITY TRIES A BOLD NEW APPROACH

That’s the idea behind newSTART, a jail diversion program launched in New York in October. It keeps defendants who have committed low-level misdemeanors—things like petty larceny or possession of small amounts of illegal drugs— from entering jail. It would also apply to people convicted of thefts of service, such as jumping a subway turnstile or exiting a taxi without paying.

Instead, in exchange for a guilty plea, misdemeanor defendants can opt for one or more social service programs, including drug treatment, job training and mental health counseling.

“We are hopeful that the program will stop the return to jail and [create] a virtuous circle,” says Elizabeth Glazer, director of the Mayor’s Office of Criminal Justice.

Right now, the program is limited to defendants who have been sentenced to up to 10 days in jail. If it’s successful, it will be expanded to those convicted of crimes carrying sentences up to 30 days.

But not all defendants who fit that time frame will be eligible.

The program specifically targets defendants in need of social services and those who have been repeatedly arrested for similar crimes.

Almost three-quarters of those facing short-term sentences are unemployed, and more than 40 percent are homeless, according to the Mayor’s Office of Criminal Justice.

4

PUBLIC RISK | JANUARY 2018

NewSTART is seen as an improvement from previous jail diversion programs. In the past, defendants who opted for jail diversion ran the risk of serving more time than their initial sentence if they failed to complete the diversion program.

For example, a person could escape a five-day jail sentence by opting for a diversion program—but then end up sentenced to 30 days in jail if they failed to complete that diversion program.

That undermined the point of the diversion program, says Jennifer Scaife, executive director of Prevention, Diversion, & Reintegration for the Mayor’s Office of Criminal Justice. “People were opting for jail instead of services, which didn’t stop the cycle of going to jail repeatedly.”

Under the new plan, the city will recommend that those who fail to complete the program be sentenced to no longer than 15 days in jail. Final discretion for sentencing, however, remains with judges.

Proponents of sentencing reform have pointed to the economic and social disruptions that even a short stay in jail can impose on poor and at-risk populations.

“Since the individuals who qualify for this programming are not major threats to public safety, it is far more productive to engage them in constructive programming than to impose punishment,” says Marc Mauer, executive director of The Sentencing Project, a group that advocates for

“

corrections reform. “Certainly, not everyone who goes through the program will succeed. But even a modest success rate will often be more beneficial than warehousing [inmates] in jail for a week.”

At its core, the program is designed to rely on the expertise of job counselors, drug treatment specialists and mental health providers to break the cycle of incarceration, says Glazer from the city’s criminal justice office.

“All these providers know how to change the behavior of the people they serve so they don’t go back to jail. They use strategies that teach people to make better decisions,” she says. “It’s not the same old, same old.”

Executing the plan has also required buy-in from both prosecutors and judges—complicated somewhat by the fact that New York actually has five separate borough court systems, each with its own judges and district attorneys. So far, the effort is in place in Manhattan, Brooklyn and the Bronx.

“NewSTART is a promising way to hold offenders accountable in a constructive and humane fashion which may also help decrease recidivism,” says acting Brooklyn District Attorney Eric Gonzalez.

The plan is part of the city’s broader effort to reduce its jail population, which has already been cut in half over the last 20 years when you include people awaiting court dates, according to the mayor’s office.

“

Like many other cities, New York wants to reduce its jail population and repeated lock-ups of low-level offenders, reports Governing.com. The city’s latest attempt to address that goal centers around a bold idea that could be modeled nationwide: Do away with all jail sentences of less than a month.

We are hopeful that the program will stop the return to jail and [create] a virtuous circle.

Elizabeth Glazer, director of the Mayor’s Office of Criminal Justice

MISSOURI REVERSES RESTRICTION ON WHO GETS HEPATITIS C TREATMENT The state of Missouri is reversing course and will allow anyone on Medicaid with hepatitis C to receive the medication that cures the disease.

The change in policy comes after a lawsuit was filed against the department that oversees the state’s Medicaid program, arguing that some Medicaid patients were denied medically necessary treatment.

The case, filed in federal court in Missouri’s western district last year, was dismissed following the state’s decision to change its policy, effective Nov. 1.

“We are glad that Missouri health officials will start to ensure that Medicaid enrollees receive these medications in a timely manner. This therapy is not only medically necessary for the individual patient, but it is vital in helping to halt spread of a communicable disease,” Abigail

Coursolle, an attorney with the National Health Law Program, said in a statement released.

It’s estimated that 13,000 Medicaid recipients in the state have hepatitis C, according to court documents.

Coursolle, along with the Legal Services of Eastern Missouri and the St. Louis University Legal Clinic, represented the three plaintiffs in the case, all unnamed Medicaid recipients with hepatitis C.

The price of the drugs has since declined, the state said in a statement.

In an attempt to curb spending on the costly medication, a serious budget concern for many states, the department implemented the policy that allowed only the sickest of Medicaid recipients with hepatitis C to receive the new treatments.

Initially, the price of the treatment was $93,000 for a 12-week course of the medication, according to a statement from MoHealthnet, the state agency that oversees the Medicaid program.

Hepatitis C is an infectious disease that can lead to liver failure or death. An estimated 3.9 million individuals across the country have the disease, according to the Centers for Disease Control and Prevention.

“This will actually save the state money in the long run,” John Ammann, one of the attorneys for the plaintiffs, told the Post-Dispatch.

“A poor person on Medicaid, their liver gets worse and worse, Medicaid would have paid for a liver transplant. But we don’t have that expense if they’re cured,” he said.

NORTHERN MICHIGAN UNIVERSITY OFFERS ALL-INCLUSIVE DEGREE IN MARIJUANA Alex Roth has gotten into the habit of pulling out his cell phone and showing skeptical friends a screen shot of the classes he’ll have to take to get his Bachelor of Science degree from Northern Michigan University.

“When they hear what my major is, there are a lot of people who say, ‘Wow, cool dude. You’re going to get a degree growing marijuana,’” said the 19-year-old sophomore at Northern Michigan in Marquette. “But it’s not an easy degree at all.”

His four-year medicinal plant chemistry degree—geared toward the burgeoning marijuana business that is about to explode in Michigan next year—includes classes such as organic chemistry, biochemistry, soils, biology, gas and liquid chromatography, biostatistics, genetics, accounting, financial management and perspectives on society.

Other colleges and universities—such as Harvard, University of Denver, Vanderbilt University and Ohio State University—offer a variety of classes on marijuana policy and law.

And there are programs that offer marijuana certificates in a variety of disciplines at places

such as Oaksterdam University, Cannabis College, and Humboldt Cannabis College, all in California; and THC University, the Grow School and Clover Leaf University in Denver.

But the NMU program is unique, mixing chemistry, biology, botany, horticulture, marketing and finance in a four-year program that began this semester. The first class has a dozen students, but Dr. Mark Paulsen, director of the university’s chemistry department, expects that number to grow quickly.

The students will learn how to measure and extract the compounds in the plants that can be used for medicinal purposes and then be able to transfer that knowledge to marijuana, which has been used to treat a variety of illnesses including chronic pain, nausea, seizures and glaucoma.

“It is a legitimate medicine and it’s helping people,” Roth said. “And that makes it more real for me.”

“We’re gaining students every week,” he said.

“With a full 12 months of recruitment, we expect that to grow.”

“Many of the states are legalizing different substances and they’re really looking for quality people to do the chemistry and the science,” said NMU trustee James Haveman. “And it’s the university’s responsibility to produce those kinds of students for those kinds of jobs.”

JANUARY 2018 | PUBLIC RISK

5

Managing the Risk of UNMANNED AIR VEHICLES

BY KATHLEEN L. WIENEKE, ESQ., DANIEL P. STRUCK, ESQ., AND DANA M. GIALLONARDO, ESQ.

6

PUBLIC RISK | JANUARY 2018

HE FAA ESTIMATES THAT BY THIS YEAR, AS MANY AS 7,500 COMMERCIAL UNMANNED AERIAL VEHICLES (“UAVs”), or “drones,” will be operating within the United States.1 Public agencies now have access to valuable technology, once available only to the military and its related entities, aimed at maintaining public safety, protecting law enforcement officers from harm, and collecting valuable data and imaging in order to aid in search and rescue missions, accident reconstruction, or to respond to natural or manmade disasters. 2 In the future, UAVs could help law enforcement in hostage negotiations, missing persons, drug interdictions, crime scene analysis, criminal surveillance and pursuit, and in creating maps to solve crimes. 3

Additionally, UAVs could assist police in active shooter or SWAT situations, crime and traffic accident scene and analysis, crowd monitoring, and bomb inspection.4 Indeed, UAVs have already been utilized by the Federal Bureau of Investigation (FBI) to support missions related to kidnappings, search and rescue, drug interdictions, and fugitive investigations.5 Moreover, UAVs have long been used by both the Mexican government and the Department of Homeland Security to patrol border towns.6 Increasing constitutional implications, however, surround the usage of UAVs by public agencies, and few issues are as polarizing to the American people as what may be deemed “Orwellian” surveillance by the United States government.

“THE AERIAL SURVEILLANCE TRILOGY”7

Three United States Supreme Court cases have challenged what it means to have a reasonable expectation of privacy in and around one’s home, and have provided the framework for modern case law related to remotely-operated aerial surveillance, search and seizure, and an individual’s expectation of privacy.

The Fourth Amendment of the United States Constitution provides in relevant part that, “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated.” Curtilage, which is defined by courts as the area immediately surrounding a private house, has commonly been touted as protected space.8

In California v. Ciraolo, the Supreme Court of the United States held that a warrantless, naked eye observation of marijuana plants growing in Ciraolo’s fenced-in backyard from an aircraft lawfully operating at an altitude of 1,000 feet in navigable airspace did not violate Ciraolo’s Fourth Amendment rights.9 In considering whether the police’s actions were violative, the Supreme Court relied on the “reasonable expectation of privacy” test enumerated in Katz v.

United States: whether the individual manifested a subjective expectation of privacy in the object of the challenged search and whether society is willing to accept that expectation as reasonable.10 The Court held that, “[i]n an age where private and commercial flight in the public airways is routine, it is unreasonable for [Ciraolo] to expect that his marijuana plants were constitutionally protected from being observed with the naked eye from an altitude of 1,000 feet.”11

On the same day as Ciraolo, the Supreme Court decided Dow Chemical Co. v. United States, which considered whether the EPA’s aerial surveillance of Dow’s 2,000-acre chemical manufacturing facility using a precise aerial mapping camera at 1,200, 3,000 and 12,000 feet without a warrant violated the Fourth Amendment.12 The Court acknowledged that “the businessman, like the occupant of a residence, has a constitutional right to go about his property free from unreasonable official entries upon his private commercial property,” but that the expectations of privacy associated with a warrantless inspection of commercial property differed significantly from the sanctity accorded an individual home.13

Three years later, the Supreme Court was tasked with deciding the case of Florida v. Riley, which presented similar facts to that of Ciraolo.14 In a plurality opinion, the Supreme Court largely followed the framework set forth in Ciraolo, holding that the 400-foot aerial surveillance of marijuana plants in Riley’s greenhouse did not violate the Fourth Amendment.15

KYLLO AND JONES—THE TECHNOLOGY CASES

In Kyllo v. United States, police used a thermal imaging detector from a vehicle across the street to determine whether Kyllo was growing marijuana plants in his home.16 Based on tips from informants, utility bills, and the thermal imaging, a warrant was issued to search Kyllo’s home whereby agents found an indoor marijuana growing operation.17 Kyllo moved to suppress the evidence, but both the trial court and the Ninth Circuit upheld the validity of the warrant relying on Ciraolo and Dow.18 The Supreme Court disagreed, holding that, “[o] btaining by sense-enhancing technology any information regarding the interior of the home that could not otherwise have been obtained without physical intrusion into a constitutionally protected area” constitutes a search where, as here, the technology in question is not in general public use.”19 Finally, in United States v. Jones, the government obtained a search warrant permitting it to install a GPS tracking device on a vehicle registered to Jones’s wife.20 The warrant authorized installation in the District of Columbia within 10 days, but agents installed it on the 11th day in

JANUARY 2018 | PUBLIC RISK

7

MANAGING THE RISK OF UNMANNED AIR VEHICLES

State legislation ranges from permissive to overly restrictive, and employs various protections,

specificities and definitions. Ironically, the majority

of states that have adopted legislation concerning UAVs

specifically require law enforcement to obtain warrants before operating a UAV, except for specific exceptions set forth in each state’s statute.

Maryland.21 The government then tracked the vehicle for 28 days, and subsequently secured an indictment of Jones on drug trafficking conspiracy charges.22 The Supreme Court held that the government, by placing the tracking device on the car, physically occupied private property, and that action alone constituted a search, as did the subsequent use of the device to monitor the vehicle.23

STATE LEGISLATION

Since 2013, states have considered literally hundreds of pieces of legislation concerning UAVs.24 Thirty-eight states are considering legislation related to UAVs in the 2017 legislative session alone.25 At this time, all 50 states have

either adopted a resolution, proposed a bill or enacted a law related to UAVs.26 State legislation ranges from permissive to overly restrictive, and employs various protections, specificities and definitions. Ironically, the majority of states that have adopted legislation concerning UAVs specifically require law enforcement to obtain warrants before operating a UAV, except for specific exceptions set forth in each state’s statute. States that generally require warrants before operating a UAV include Alaska, Idaho, Illinois, Iowa; North Carolina; North Dakota, Florida, Vermont, Oregon, Indiana, Wisconsin, Montana, Utah, Maine, Tennessee, Virginia, and Nevada.27

18

States that have enacted UAV legislation pertaining strictly to agriculture and/or wildlife

16 14 12

States that require law enforcement obtain warrant before operating UAV

10 8 6

States that impose civil penalties on individuals who violate state legislation related to UAVs

4 2 0

8

TYPES OF UAV LEGISLATION

PUBLIC RISK | JANUARY 2018

Exceptions to warrant requirements include: terrorist attacks; searches for missing persons; the imminent escape of a suspect; probable cause that a person has committed or is committing a crime and exigent circumstances exist that make it unreasonable to obtain a warrant; the need to mitigate a natural or other disaster; the need to perform geographical or environmental survey for purposes that are not criminal; the need to obtain aerial photographs or video images of a motor vehicle accident site; to locate an escaped prisoner; surveillance for the purpose of executing an arrest warrant; if a law enforcement officer has reasonable suspicion to believe that the use of a drone is necessary to prevent imminent danger to an individual or to prevent imminent destruction of evidence; use in “emergency situations”; use by institutions of higher education solely for research and development purposes; property appraisal; use in utility facilities and operations; or to deliver cargo.28 Additionally, and perhaps in direct response to Jones, some states require that a warrant authorizing the use of a UAV must specify the period for which operation of the unmanned aircraft system is authorized.29 In Oregon, in no event may a warrant provide for the operation of an unmanned aircraft system for a period of more than 30 days.30 In Nevada, it’s 10 days.31 Law enforcement agencies are subject to reporting requirements created by state statute.

In Illinois, a law enforcement agency that owns one or more drones shall report in writing the number of drones that it owns, which is then made available to the public.32

Louisiana has adopted legislation pertaining to UAVs in commercial agriculture.33 Relatedly, a few states have prohibited the use of drones in hunting and/or fishing practices.34

imaging and other such enhancement technology.43 Autonomous UAVs, or UAVs operated without a remote pilot, could also create entirely separate issues.44

Kansas has expanded the definition of “stalking” to include the use of drones to stalk another person.35 Mississippi has adopted a ban on voyeurism by use of drone.36 California expands the definition of “trespass” to include unauthorized invasions of a property owner’s airspace.37 In Nevada, a person who owns or lawfully occupies real property may bring an action for trespass against the owner or operator of a UAV that is flown at a height of less than 250 feet over the property.38

Furthermore, “weaponization” of UAVs with both lethal and nonlethal weaponry is largely prohibited in most states.45 Although North Dakota currently prohibits weaponizing drones, the North Dakota House recently voted against a bill that would have barred law enforcement from using nonlethal weapons on drones.46 Connecticut also proposed a bill that might have allowed regulation enforcement to make use of weaponized drones, but no action was taken by Connecticut’s Public Safety and Security Committee, and the bill was effectively quashed.47

Oklahoma prohibits the operation of drones over a critical infrastructure facility (i.e. an airport, prison, water source, etc.) without permission of the facility’s owner.39 Texas prohibits use of drones for gathering surveillance, disclosure of photographs or videos obtained while illegally surveilling, or flying over critical infrastructure.40 Utah, Tennessee and North Dakota have enacted statutes specifically related to data retention, which seemingly provides added safeguards to the individual subject to the UAV search.41

FUTURE ISSUES

Much like the advent of DNA analysis, the current state of the law related to UAVs is years behind its technological advances. UAVs have created a particularly thorny path for public agencies to travel down, where agencies must balance the necessity for new law enforcement techniques with an individual’s rights under the United States Constitution.

For instance, the issue of whether UAVs should be equipped with additional technology, such as thermal imaging or biometric data (facial recognition), will eventually come into play.

Vermont has already prohibited the use of both, while North Carolina has prohibited thermal imaging.42 Maine has directed for the establishment of written policies and procedures regarding restrictions on the use of night vision technology, high-powered zoom lenses, video analytics, facial recognition technology, thermal

Additionally, while UAVs could possibly assist law enforcement in crowd monitoring during protests or marathons, for example, not only is a warrant required to operate a UAV in some states, but it is illegal in Maine and Vermont for law enforcement to use a UAV to conduct surveillance of private citizens peacefully exercising their constitutional rights of free speech and assembly.48 Even if states are adopting legislation at a remarkably fast pace, judicially created rules and analyses have not started to develop. In fact, there is little to no case law in the United States regarding the legalities of UAVs. In states where laws pertaining to UAVs have yet to be adopted or are silent on warrant requirements, for example, the Supreme Court holdings in Ciraolo, Dow, Riley, Kyllo and Jones will likely apply. These cases do not create a neat picture of how the courts will react to novel UAV issues.

They do, however, present a common theme: surveillance is constitutionally acceptable if it is limited by human experience and endurance.

The Supreme Court has found that surveillance that does not go beyond the limits of the “naked eye” or that is short in duration is not considered violative of the Fourth Amendment. In Kyllo, for example, the thermal imaging device could detect heat, which is impossible to do with the naked eye, while the GPS device used in Jones tracked the subject for 28 continuous days, which is more than any one human could be

expected to endure. It has been suggested that legislators should craft simple duration-based surveillance legislation that addresses the potential for “persistent surveillance.”49 Doing so could limit the possibility that aerial surveillance could follow individuals and monitor their daily activities, or that UAVs could be used to hover directly over a landowner’s property.50

MANAGING THE RISK

In order to manage the associated risks inherent to UAV use, it is absolutely imperative that public entities take extra precautions in the use and operation of UAVs. Public entities should comply with all FAA Regulations, particularly the new FAA regulations that became effective in August 2016, including reporting and certification requirements, and should become familiar with navigable airspace guidelines, as well as any state, municipal or local laws and ordinances related to UAV usage in any specific area.51 Additionally, it is important that entities develop a UAV program philosophy, determining why the entity needs a UAV, what it will be used for, and what type of sensors or technology the UAV will carry.52 The entity will also want to develop a robust standard operating procedure covering equipment, personnel selection and training, operations, maintenance, and administrative procedures.53 In the development stage, it may be beneficial to involve the citizens and local elected officials served by the entity.54

Public entities should always obtain necessary warrants, and these warrants should spell out the exact parameters of a specific mission or search in compliance with any known law or regulation. At the very minimum, Jones and Kyllo should be considered when deciding how long a search should take or what technology should be used. Entities should develop data retention and confidentiality policies and procedures, and should stress the absolute importance of a subject’s privacy.

One major benefit to an agency’s use of UAVs is cost. UAVs cost about $25 an hour to operate, compared with $250 to $1,000 per hour for a traditional aircraft.55 UAVs can perform approximately 30 percent of the missions that a manned helicopter can perform for less than one

JANUARY 2018 | PUBLIC RISK

9

MANAGING THE RISK OF UNMANNED AIR VEHICLES

percent of the cost of the helicopter and crew.56 Compared to a police helicopter, which could cost anywhere from $500,000 to $3 million to acquire57, a very capable UAV can be had for approximately $10,000.58 The cost of a UAV is relatively insignificant in order to mitigate the risk of a law suit.

electronic store for $50 to $2,000.63 Suppose an agency is notified of a missing person report and the last known reported sighting was in a remote and fairly inaccessible tree-covered swamp area.

Could agencies face liability for either failing to own or operate UAVs to conduct the search, given their minimal cost and availability?

As the law races to catch up with technology, we are pioneers in this endeavor. But we

must be prepared for the risks that come with it. Whatever those may be.

POTENTIAL CLAIMS

Of obvious import is the question of agency liability. To date, UAVs have a higher mishap rate than traditional manned aircraft.59 Although advances in technology, training, and operation will likely reduce these accidents, the introduction of UAVs into highly-populated, domestic air traffic could create human injuries or property damage if a UAV were to crash or collide with another object in the air.60 Various states allow a plaintiff to seek compensatory damages, attorney’s fees, treble damages, injunctive relief, and punitive damages for UAV statute violations.61 It remains to be seen whether immunity will protect public agencies from civil liability resulting from a UAV mishap, although it is certainly clear that liability exists for an agency’s violation of an individual’s constitutional rights. Potential standard of care claims related to the operation, maintenance, or safeguards of a UAV will also certainly come into play as their use increases.

Are UAVs so commonplace and inexpensive that an agency could potentially be subject to claims for not owning or deploying a UAV in any given situation? A recent study identified at least 347 state and local police, sheriff, fire and emergency units across 43 states that have acquired UAVs, the majority in the last year, with local law enforcement leading the way.62 An amateur UAV can be purchased on the internet or a big box

10

PUBLIC RISK | JANUARY 2018

As the law races to catch up with technology, we are pioneers in this endeavor. But we must be prepared for the risks that come with it.

Whatever those may be.

Kathleen L. Wieneke is a partner with the Wieneke Law Group. Daniel P. Struck is a partner with Struck Love Bojanowski & Acedo.

Dana M. Giallonadrdo is an associate with Struck Love Bojanowski & Acedo.

FOOTNOTES

1 Chris Jenks, State Labs of Federalism and Law Enforcement “Drone” Use, 72 Wash. and Lee L.Rev. 1389 (2015).

2 http://www.techrepublic.com/article/police-arenow-using-drones-to-apprehend-suspects-andadminister-non-lethal-force-a-police-chief/ 3 https://redshift.autodesk.com/drones-in-policework-future-crime-fighting/ 4 https://www.policeone.com/police-products/ Police-Drones/articles/9502450-5-ways-dronescan-help-cops-fight-crime/ 5 Id. 6 Id.; see also http://www.ahwatukee.com/ community_focus/article_3201a05c-c891-11e2bf27-001a4bcf887a.html.

7 Jenks, supra, at 1405 (internal citations omitted).

8 Oliver v. United States, 466 U.S. 170, 180 (1984).

9 476 U.S. 207 (1986).

10 Id. at 211; citing to Katz v. United States, 389 U.S. 347, 360 (1967).

11 Id. at 215.

12 476 U.S. 227 (1986).

13 Id. at 237-238.

14 488 U.S. 445 (1989).

15 Id. 16 533 U.S. 27, 29 (2001).

17 Id. 18 Id. 19 Id. 20 565 U.S. 400, 402 (2012).

21 Id. at 403.

22 Id. 23 Id. at 404-405.

24 http://www.ncsl.org/research/transportation/ current-unmanned-aircraft-state-law-landscape. aspx.

25 Id.

26 https://jrupprechtlaw.com/drone-law-blog 27 See Alaska Stat. Ann. § 18.65.902 (2014); Idaho Code Ann. § 21-213 (2013); Ill. Comp. Stat. Ann. Ch. 725 § 167/10 (2014); Iowa Code Ann. § 808.15 (2014); N.C. Stat. Ann. § 15A-300.1 (2015); N.D. Cent. Code Ann. § 29-29.4-02 ( 2015); Fla. Stat.

Ann. § 934.50 (2015); Vt. Stat. Ann. tit. 20, § 4622 (2015); Or. Rev. Stat. Ann. § 837.320 (2015); Ind. Code Ann. § 35-33-5-9 (2016); Wis. Stat. Ann. § 175.55 (2014); Mont. Code Ann. § 46-5-109 (2013); Utah Code Ann. § 63G-18-103 (2015); Me. Rev. Stat. tit. 25, § 4501(2015); Tenn. Code Ann. § 39-13-609 (2013); Va. Code Ann. § 19.2-60.1 (2015); Nev. Rev. Stat. § 493.010, et seq. (2015).

28 See Or. Rev. Stat. Ann. § 837.320 (2015); Ind. Code Ann. § 35-33-5-9 (2016); Wis. Stat. Ann. § 175.55 (2014); Utah Code Ann. § 63G-18-103 (2015); Me. Rev. Stat. tit. 25, § 4501(2015); Tenn. Code Ann. § 39-13-609 (2013); Va. Code Ann. § 19.2-60.1 (2015); Vt. Stat. Ann. tit. 20, § 4622 (2015); Fla. Stat. Ann. § 934.50 (2015); Nev. Rev. Stat. § 493.010, et seq. (2015).

29 See N.D. Cent. Code Ann. § 29-29.4-03 (2015); Or. Rev. Stat. Ann. § 837.320 (2015).

30 See Or. Rev. Stat. Ann. § 837.320 (2015).

31 See Nev. Rev. Stat. Ann. § 493.112 (2015).

32 See Ill. Code Ann. Ch. 725 § 167/35 (2014); see also Vt. Code Ann. tit. 20 § 4624 (2015); Nevada Stat. Ann. § 493.118 (2015); Me. Rev. Stat. tit. 25 § 4501 (2015).

33 See La. Stat. Ann. tit. 3 § 41 (2015).

34 See Idaho Code § 36-1101(2016); Ill. Comp. Stat.

Ch. 720 § 5/48-3 (2013); Ind. Code § 14-22-6-16 (2016); 1994 Mich. Pub. Acts § 451, Mich. Comp.

Laws § 324.40111c (2015); N.H. Rev. Stat. § 207:57 (2016); W. Va. Code § 20-2-5 (2015); N.C. Gen. Stat. § 113-295 (2014).

35 See Kan. Stat. § 60-31a02 (2016).

36 See Miss. Code Ann. § 97-29-61 (2015).

37 See Cal. Civ. Code § 1708.8 (2015).

38 See Nev. Rev. Stat. Ann. § 493.103 (2015).

39 See Okla. Stat. tit. 3 § 322 (2016).

40 See Texas Gov. Code § 423, et seq. (2013).

41 See Utah Code Ann. § 63G-18-104 (2015); N.D. Cent. Code Ann. § 29-29.4-03 (2015); Tenn. Code Ann. § 39-13-609 (2013).

42 See Vt. Stat. Ann. tit. 20, § 4622 (2015); N.C. Gen. Stat. 14-401.25 (2014).

43 See Me. Rev. Stat. tit. 25 § 4501 (2015).

44 See Jenks, supra, at 1402.

45 See Nevada Stat. Ann. § 493.109 (2015); Wis. Stat. Ann. § 941.292 (2014); Vt. Stat. Ann. tit. 13 § 4018 (2015); Me. Rev. Stat. tit. 25 § 4501 (2015); Va. Code Ann. § 19.2-60.1 (2015); N.C. Gen. Stat.

14-401.24 (2014); Nev. Rev. Stat. § 493.010, et seq.

(2015).

46 http://www.thedickinsonpress.com/ news/4222456-nd-house-nonlethal-droneweapons-stay-legal-law-enforcement 47 http://www.uav.org/connecticut-decides-againstweaponized-drones-for-law-enfo/ 48 See Me. Rev. Stat. tit. 25 § 4501 (2015); Vt. Stat.

Ann. tit. 20, § 4622 (2015).

49 https://www.brookings.edu/research/dronesand-aerial-surveillance-considerations-for-legislatures/ 50 Id. 51 http://www.policemag.com/channel/technology/ articles/2016/08/getting-your-unmanned-aircraftprogram-off-the-ground.aspx 52 Id. 53 Id. 54 Id. 55 http://www.ahwatukee.com/community_focus/ article_3201a05c-c891-11e2-bf27-001a4bcf887a. html 56 http://www.bluetoad.com/publication/?i=251297 &ver=html5&p=1#{“page”:12,”issue_id”:251297} 57 https://www.aclu.org/blog/we-already-havepolice-helicopters-so-whats-big-deal-over-drones 58 http://www.reuters.com/article/us-usa-droneslawenforcement-idUSBRE92208W20130304 59 Geoffrey Christopher Rapp, Unmanned Aerial Exposure: Civil Liability Concerns Arising from Domestic Law Enforcement Employment of Unmanned Aerial Systems, 85 N.D. L.Rev. 627 (2009).

60 Id. 61 See Fla. Stat. Ann. § 934.50 (2015); Nev. Rev. Stat. § 493.010, et seq. (2015); Or. Rev. Stat. Ann. § 837.380 (2015).

62 Press Release, Airborne Law Enforcement Association, ALEA Announces Public Safety Drone Expo 2017.

63 http://www.bestbuy.com/site/aerial-dronesaccessories/drones-with-cameras/pcmcat369900 050002.c?id=pcmcat369900050002.

Further your public sector risk management education without leaving the office!

This Webinar series features top presenters delivering risk knowledge to your desktop!

PRIMA’S 2018 RISK MANAGEMENT

WEBINAR SERIES PRIMA WEBINARS ARE FREE FOR MEMBERS! Visit www.primacentral.org today to register for individual Webinars or for the entire program!

JA N UA RY 17 | 1 2 : 0 0 P M – 1 : 3 0 P M E ST WHAT’S SO SPECIAL ABOUT SPECIAL EVENTS? SPEAKER: Krista Dillon, Director of Operations – Safety & Risk Services, University of Oregon D E S C R I P TI O N : This webinar will cover the basics of planning for special events on campuses with an emphasis on large events.

Also included will be the use of the Incident Command System in planning for and managing special events, how to conduct risk assessments on events and other helpful tools. This session will also cover lessons learned from special events at the University of Oregon including: US Olympic Track and Field Trials, Dalai Lama visit, World Junior Track & Field Championships, Eugene Marathon, and ESPN Game Day. AT T E N D E E TA K E AWAYS : Roles and responsibilities of campus partners in planning for and running large events Tools to assist multiple entities in collaboration on special event planning  Lessons learned related to planning for and running large events

For more information, or to register, visit primacentral.org/webinars.

ARE YOU A

12

PUBLIC RISK | JANUARY 2018

DATA WHISPERER? PSST—IT CAN TAME YOUR WORKERS’ COMPENSATION COSTS!

BY MICHELLE DESPRES, PT, CEAS II

W

ORKERS’ COMPENSATION CLAIMS ARE IN SOME WAYS LIKE WILD MUSTANGS. They can be dangerously unpredictable in terms of cost and duration and prone to suddenly resist guidelines and oversight. Sometimes, they can erupt into frenzied activity that bucks against all expectations and can potentially harm both the patient and employer.

An advanced warning before these exploding claims occur is the key to keeping treatment plans on track and avoiding adverse clinical and financial outcomes. Predictive analytics is the tool that can rein them in—and possibly tame them completely.

JANUARY 2018 | PUBLIC RISK

13

ARE YOU A DATA WHISPERER? PSST—IT CAN TAME YOUR WORKERS’ COMPENSATION COSTS!

Predictive analytics is a marriage of information technology (IT) and claims management. It is data mining and deep analysis seen through algorithms that can predict future problems and identify current ones. Predictive analytics can also provide an early warning sign of claims about to go rogue or reveal a pattern of injuries that needs attention.

It gives a voice and substance to the hunch that a problem is developing so that you can take action, instead of being suddenly thrown off course by skyrocketing costs and poor outcomes. And, predictive analytics can also confirm that your course corrections are producing the desired results.

Where predictive analytics diverges from existing managed care data is that predictive analytics looks to the future using algorithms that identify patterns and relationships, presenting new insights and information. It can answer questions such as: If there is no intervention, how likely is it that a specific type of injury exceeds the usual duration and pattern of recovery? If there is an intervention, how is that risk reduced? If an office shows a pattern of a certain type of injury, why is this occurring? If a course of action is adopted, what are the anticipated savings?

If a clinical pathway is changed, what is the result?

In healthcare, this practice is referred to as “population health management.” In workers’ compensation, the population to be managed is injured workers. In that universe, sub-populations exist within job classifications (firefighters versus office workers versus bus drivers), age ranges, risk factors like obesity, and geography. By applying predictive analytics, the relationships between injuries and claims in these various sub-groups can be clarified so that interventions can be made.

As examples, consider these signs that can be determined via predictive analytics to indicate a problem: • The correlation of a specific job type with reporting of an injury to a certain body part • Presence of comorbidities with distinct injuries • Prior history of injuries reported at the time of filing a claim • A history of smoking and chronic illnesses • Seeking legal representation early in the claim process Viewed separately, the signals that there is trouble ahead will most likely be missed. Seen

14

PUBLIC RISK | JANUARY 2018

within a predictive pattern, the warning may be clearer and action can be taken.

A PRACTICE WHOSE TIME HAS COME

Why is predictive analytics so important now?

It is because workers’ compensation management has never been so unpredictable. Consider these realities: • Employees are getting older. One in four workers will be over the age of 55 by 2020 according to the U.S. Bureau of Labor Statistics. That means injuries can take longer to heal and recoveries are more prone to complications. Treatment windows are longer, the return to work is slower and the associated costs are higher.

• Today’s injured workers are more likely than ever before to have chronic medical conditions that complicate their recovery from illness or injury. These comorbidities can directly influence medical prognosis, therapy and outcomes. For example, osteoporosis is one of the common underlying comorbidities in aging workers, making them prone to breaking bones and having more complex fractures. According to the International Osteoporosis Foundation, more than one in four men over the age of 50 will experience an osteoporosis-related fracture. And, diabetes has become nearly endemic in the U.S. population; according to the Centers for Disease Control and Prevention (CDC), nearly 30 million Americans already have diabetes, and another 86 million are in a pre-diabetic state. These conditions may be factors in the injury, or they may influence the course of the treatment and recovery, or both.

• The workforce is also expanding—literally.

According to the CDC, more than one-third of Americans are obese, and more than 70 percent are considered overweight. Studies have suggested overweight patients who are injured in an accident are more likely to experience higher levels of pain. Those with diabetes need more time to recover from their injuries. The seemingly simple injury becomes much more complex and unpredictable.

These are just a few of the trends complicating injury management in today’s workplace. To manage them, claims specialists need actionable insights and tools.

REALIZING VALUE FROM PREDICTIVE ANALYTICS

The holistic view of data should include specific types of data such as: • First report of injury or first notice of loss • Managed care data, including bill review, utilization review and pharmacy data • Settlement data • Psychosocial factors • Therapy benchmarks • Length of time between medical treatments • Duration of treatment or disability • Cost thresholds for equipment or supplies Once this data is analyzed and patterns begin to emerge, the claims management organization must be poised to spring into action. The information from predictive analytics can generate alerts to spur immediate intervention by adjusters, claims managers and case managers. A clear chain of accountability is required to ensure that these findings are acted upon for corrective action.

What is the ROI on predictive analytics?

Companies using it report cost savings ranging from 5 to 15 percent, and sometimes more.

One company that listened carefully to its data reported reducing payments per claims, lost time days and total medical costs by an average of one-third each.

Over the long term, the results of a successful predictive analytics program can be measured in average reductions in: • • • •

Overall claim costs Medical costs Number of disability/lost time days Number of claim days, open to close

Using predictive analytics is not necessarily the be all and end all of workers’ compensation claims management. But, it can tame the factors most likely to upend your budget and send costs hurtling skyward. Learning the art of data whispering can be the key to propel your program to the next level of success.

Michelle Despres, PT, CEAS II, is the vice president and national product leader at One Call Care Management.

LEARN IN YOUR OWN TIME WITH

PRIMA PODCASTS! PRIMA’s Podcasts are a quick and convenient way to learn on-demand and on your own time!

Meant to provide you with information on specific topics important to the public risk management sector and hot topics, PRIMA Podcasts are the perfect way to fit in education and training into your busy schedule.

Check www.primacentral.org for new Podcasts!

CURRENT PODCAST TOPICS INCLUDE: School Risk Management Workers' Comp Best Practices

AND MORE!

L

T

A

H

E

T E RN N I

AUDIT FU 16

PUBLIC RISK | JANUARY 2018

N C TI

N O

CHALLENGES AND OPPORTUNITIES FOR TODAY’S PUBLIC RISK MANAGER

A

BY JOE JARRET

CCORDING TO THE UNITED STATES GOVERNMENT ACCOUNTING OFFICE, internal audits provide public sector entities with essential accountability and transparency over the various programs undertaken and services provided on behalf of the general citizenry. Given the current challenges and increased scrutiny facing governments and their programs, the oversight provided through the internal auditing process is more critical than ever. The same can be said of the risk manager’s role in the auditing process. The internal auditing process provides objective analysis and information needed to make the decisions necessary to insure taxpayer assets are protected and wisely utilized. It stands to reason then that risk managers are perfectly suited to assist auditors in providing a framework for performing high-quality audit work with competence, integrity, objectivity, transparency and independence to provide accountability and to help improve government operations and services.

THE INTERNAL AUDITING PROCESS

To belabor the obvious, internal auditing supports the governance roles of oversight, insight and foresight, by evaluating an entity’s financial and program compliance, effectiveness, economy and efficiency. This is one reason why it’s been said that “the need for financial accountability has existed ever since it became necessary for one individual to entrust the care of his possessions or business to another.”1 The public entity, as well as the general citizenry, relies on the auditor to provide an independent,

objective evaluation of the accuracy of the entity’s accounting. Further, that the auditor will faithfully and truthfully report on whether the entity’s use of the fiscal resources with which it is entrusted, is in accordance with sound auditing principles, as well as the will of the people who ultimately fund the entity through tax dollars. For an internal audit process or system to be considered effective, it must: • Demonstrate integrity.

• Demonstrate competence and due professional care.

JANUARY 2018 | PUBLIC RISK

17

THE INTERNAL AUDIT FUNCTION: CHALLENGES AND OPPORTUNITIES FOR TODAY’S PUBLIC RISK MANAGER

• Be objective and free from undue influence (independent).

• Align with the strategies, objectives and risks of the organization.

• Be appropriately positioned and adequately resourced.

• Demonstrate quality and continuous improvement.

• Communicate effectively.

• Provide risk-based assurance.

• Be insightful, proactive and future-focused.

• Promote organizational improvement.2 By assisting decision-makers in exercising oversight of the various programs undertaken by the entity, auditors are instrumental in ensuring that public sector entities are doing what they are supposed to be doing: spending funds for the intended purpose, being good stewards of taxpayer dollars and complying with all local, state and federal laws and regulations.3 According to the Government Finance Officers Association, 4 internal auditors commonly assist management in monitoring the design and proper functioning of internal control policies and procedures. In this capacity, internal auditors themselves function as an additional level of control by helping to improve the government’s overall control environment.

Because risk managers follow a structured, consistent and continuous process across the whole organization for identifying, assessing and responding to risks and threats that can adversely affect the achievement of their entity’s objectives, they are uniquely qualified to lend their expertise to the audit function.

AUDIT RISK

Generally speaking, audit risk is the possibility that the auditors’ findings, conclusions, recommendations, or assurance may be inaccurate or incomplete. Inaccurate or incomplete findings on the part of an auditor can be as a result of relying upon unsupportable evidence, or a less than adequate or diligent audit process. In the rare extreme, an auditor may engage in intentional errors or omissions, or offer misleading information in an attempt to perpetrate misrepresentation or fraud. As such, the assessment of audit risk involves two basic considerations:

18

PUBLIC RISK | JANUARY 2018

Qualitative (the probability of a risk occurring and its impact on relevant organizational aspects e.g., financial, reputational, etc.) and, Quantitative (actual and measurable data designed to calculate probability and impact values, normally expressing risk values in fiscal terms) considerations.

•

•

• Factors impacting audit risk include the time frames, complexity, or sensitivity of the work and the size of the program in terms of dollar amounts and number of citizens served. The auditor and risk manager should jointly assess the adequacy of the audited entity’s systems and processes in an attempt to detect inconsistencies, significant errors, or fraud.

Audit risk also includes the risk that auditors will not detect a mistake, inconsistency, significant error, or fraud in the evidence supporting the audit. Audit risk can be reduced by insuring that the risk manager is a key player in the auditing process. By taking a collaborative approach, the auditor and risk manager can jointly determine whether taking actions such as increasing the scope of work, adding specialists and/or additional reviewers and other resources to perform the audit, or changing the methodology to obtain additional evidence, may prove beneficial to the process. 5

THE RISK MANAGER’S ROLE

The risk manager can play a key role in the audit function by working with auditors and endeavoring to: • Conduct risk assessments with management regarding key and emerging audit-related risks • Work with senior staff to develop a risk management strategy for audit committee or senior staff approval • Provide insight on whether risks are correctly identified, evaluated and assessed • Evaluate current reporting of identified strategic and emerging audit-related risks • Assist department heads in defining risk tolerances where none have been identified— based on the risk manager’s experience and judgment • Suggest a risk-based approach to auditing designed to test compliance with strategic

•

•

•

objectives and goals established by the audit committee or senior staff Build a strong, non-adversarial relationships with the internal auditor that emphasizes a strong collaboration between the two Set the entity’s risk appetite (after conferring with senior staff), for risk capacity, risk tolerance and desired risk level Assist the auditor in implementing responses to identified risks Partner with the auditor on risk assessments in an effort to ensure an effective flow of risk information between the audit and risk functions Assist internal auditors in appreciating the risk manager’s responsibilities and oversight roles when it comes to the audit function Tactfully examining, evaluating, reporting and recommending improvements on the adequacy and effectiveness of the entity’s auditing process6

In order to accomplish the above, the risk manager must have complete and unrestricted access to employees, property and records as appropriate for the performance of audit activities.

By assisting the auditor in providing unbiased, objective assessments of whether public resources are managed responsibly and effectively to achieve intended results, the risk manager can play a key role in assisting their entity in achieving accountability and integrity, improving operations and instilling confidence among citizens and stakeholders alike.

Joe Jarret is an attorney, federal mediator, former public risk manager and past-president of the Southwest Florida Chapter of PRIMA and PRIMA’s Author of the Year for 2016.

FOOTNOTES

1 Committee to Review the Functioning of Financial Institutions (Wilson Committee), 1980.

2 Public Sector Internal Audit Standards, (2016), The Institute of Internal Auditors.

3 Goodson, S. G., Mory, K. J., & Lapointe, J. R. (2012). Supplemental Guidance: The Role of Auditing in Public Sector Governance. The Institute of Internal Auditors.

4 http://www.gfoa.org/ 5 See, GAO-12-331G Government Auditing Standards, United States Government Accountability Office, 2011.

6 Ososki, M. (2014). Enterprise Risk Management & Internal Audit Function – Can Internal Auditors Participate? BankNews Magazine.

ADVERTISER INDEX

ADVERTISER INDEX Munich Reinsurance America. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Back Cover

HAS YOUR ENTITY LAUNCHED A SUCCESSFUL PROGRAM? An innovative solution to a common problem? A money-saving idea that kept a program under-budget? Each month, Public Risk features articles from practitioners like you. Share your successes with your colleagues by writing for Public Risk magazine! For more information, or to submit an article, contact Jennifer Ackerman at jackerman@primacentral.org or 703.253.1267.

FIND US ON FACEBOOK!

CALENDAR OF EVENTS PRIMA’s calendar of events is current at time of publication. For the most up-todate schedule, visit www.primacentral.org.

PRIMA ANNUAL CONFERENCES June 3–6, 2018 PRIMA 2018 Annual Conference Indianapolis, IN Indiana Convention Center June 9–12, 2019 PRIMA 2019 Annual Conference Orlando, FL Gaylord Palms June 14–17, 2020 PRIMA 2020 Annual Conference Nashville, TN Gaylord Opryland

PRIMA INSTITUTE November 5–9, 2018 West Palm Beach. FL

ISO 31000 TRAINING March 13–14, 2018 St. Louis, MO Hyatt Regency St. Louis at the Arch November 14–15, 2018 Alexandria, VA The Alexandrian Hotel

Keep up with what’s happening at PRIMA and connect with your risk management peers!

Visit us at www.facebook.com/primacentral.

JANUARY 2018 | PUBLIC RISK

19

When it comes to a cyberattack, it’s not a matter of IF, but WHEN. PRIMA offers free cybersecurity resources designed to equip risk management professionals with the knowledge, skills and ability to proactively protect their entities.

Visit primacentral.org and check out free cybersecurity webinars from the Department of Homeland Security, including a cyber resilience review presentation.

Everyone else is doing it.

Why aren’t you?

Join PRIMA’s 2018 Enterprise Risk Management training and learn how to add value to your risk management program by implementing an enterprise-wide approach to risk.

PRIMA developed this training program to teach attendees how to apply the framework of the ISO/ANSI/ASSE 31000 Standard. Participants will learn the basics of the standard as well as how to fully integrate the framework in their organization’s risk management program.

Visit primacentral.org/ermtraining for 2018 training locations and dates.