Compliance Unfiltered is TCT’s tell-it-like-it is podcast, dedicated to making compliance suck less. It’s a fresh, raw, uncut alternative for anyone who needs honest, reliable, compliance expertise with a sprinkling of personality.
Show Notes: Hit By The Bus
Quick Take
On this episode of Compliance Unfiltered, The CU guys break down one of the wildest topics in Compliance Unfiltered history – What the term ‘Hit By the Bus’ means in a compliance context. What it means, how it pertains to you, how to go about leveraging this approach, and a ‘Hit By the Bus’ story you’ll have to hear to believe – all on this week’s episode of Compliance Unfiltered!
Remember to follow us on LinkedIn and Twitter!
Read Transcript
So let’s face it, managing compliance sucks. It’s complicated, it’s so hard to keep organized, and it requires a ton of expertise in order to survive the entire process. Welcome to Compliance Unfiltered, a podcast dedicated to making compliance suck less.
Now, here’s your host, Todd Coshow, with Adam Goslin.
Well, welcome in to another edition of Compliance Unfiltered. I’m Todd Coshow, alongside the conductor to your compliance crazy train, Mr. Adam Gosling. How the heck are you, sir? I am doing good, Todd. I’m glad I’m the conductor of the crazy train. That would mean that, what, I’m not one of the crazies, ostensibly? Well, you know, you’re not on the track, so that’s helpful as well.
But today we’re talking about another perilous situation, and that is getting hit by the bus. And I know it sounds obvious, but what do you mean in this situation when you say getting hit by the bus? Well, a euphemism for instantly gone. Actually, as I was thinking about this topic, have you seen the movie Final Destination? Sure. Have you watched, like, Final Destination 2, 3, that type of thing?
I think the last one I saw was 3, and that kind of checked the boxes for me. Well, there’s one scene, I forget which one, but there’s a scene in one of those where, you know, the girls standing there, you know, basically on a sidewalk, and all of a sudden steps into the street and instantly is just creamed by a bus. And so it’s a euphemism for instantly gone, you know, type of thing, whether it’s hit by an asteroid, you know, poof, you’re gone, there’s no notice, you know, type of thing. That’s what we mean when we’re talking about getting hit by the bus. And for the record, for anybody that likes horror movies and all that fun stuff, they’re actually a good watch, but yeah, after a bit, it gets old.
Indeed, Indeed. How is this notion of being hit by the bus. Like how’s it actually being used by compliance practitioners?
Well for years you know it would be a kind of a common approach, approach used by myself during like risk assessment interviews as you’re going through and interviewing people at the particular target location. You know forcing them to, forcing the interviewee effectively to name people they wouldn’t want to get hit by the bus aka these are the people that you know would be the most painful to have instantly gone. In all likelihood the, the individuals that they would name would be those that have you know a particular depth of experience. They are you know kind of single-threaded in terms of their knowledge on a particular topic where there is no you know kind of immediate backup or somebody else or you know that could step in and take over for you know the instant you know evaporation of knowledge that would happen should that particular individual get hit by a bus.
So you know usually what I’ll do is, is that let’s say that you know you’re talking to an organization that’s got like a hundred people you know then I would have each of the individuals name off three people that they don’t want to get hit by the bus type of thing and so you know more often than not it’s three if it’s an extremely large organization maybe I’ll you know up the up account to four or five type of thing but the, the intent is to is you know in any organization there’s just typically whatever you know 10 15 people that you’re like man we can’t we can’t do without them uh type of thing so it really makes the them think really makes them prioritize, you know, who are the people that if they were instantly gone, we would be screwed, you know, type, type of thing. So, you know, that is a, that’s a typical approach, you know, used, you know, by compliance practitioners as they’re going through, you know, kind of their, their internal, you know, internal risk assessments, or if it’s a third party doing a risk assessment, that’s usually where, you know, where the concept will come into play, if you will.
That makes sense. Now, how should folks go about leveraging this approach in their organizations? Well, you know, we talked about, you know, using it during, you know, during your risk assessment activities. So if I’m doing this for my own organization, you know, then similarly, going to different people in different departments, you know, kind of across the organization, you know, the tough part is, is that, you know, these are the people that are actually doing the work. So oftentimes the, you know, the perception by, I don’t know, let’s just take a typical organization that has a, you know, an HR department, a customer service department, an IT department, you know, an accounting department type of thing. You know, the folks that are actually doing the work will have each of them will have a different perspective based on their knowledge of the personnel within the organization, their particular department, etc, and kind of know who those critical folks are. So it’s interesting. What I would suggest is go through, talk to a wide variety of people across the organization and all the different departments and multiple people, you know, within, you know, each department and effectively go through and do a, you know, do a survey and for, you know, for everybody that, you know, that answers and gives you their three names, you know, then when all is said and done, gather up all of those, you know, all of those statistics of, okay, well, whatever, Bob got 18 votes and Mary got 16 votes and, you know, Frank got, you know, 13 votes, that type of thing. Just prioritize the list based on the number of votes they got for the folks that the people within the organization didn’t want seen to be hit by the bus. And then you know kind of you know then you can you know go ahead and effectively create a you know this person is the one that was voted as you know yeah most likely to succeed now is the, the one that that we can least afford to lose you know from you know kind of across the populace if you will and so you know so it just gives you a good sense of those that are actually doing the work that are frontliners you know kind of as they’re going through going through their day by day gives you a real good idea about you know what, what are their thoughts on you know who are the folks that be the be the toughest to replace if you will now once you’ve got like those inputs then Well, that’s the point at which, you know, now I’m sitting, I’m looking at this list, I’ve got everybody in kind of a prioritized fashion, you know, certainly, you know, you will have gained some of the insights about that particular individual and why they’re important just from the, you know, just from the interviews that were, you know, that were performed.
But, you know, it’s a good idea to, you know, to go back to, you know, go back to folks within the organization and make sure you’ve kind of collected up or gathered a list of what are all the functions that this person is critical for. And then from there, you know, now you take that list and certainly talking with the individual themselves, you know, and whatnot, almost treat it as a, you know, business continuity for personnel, you know, if you will. So what we’re trying to do is we’re trying to make sure that, you know, if the number one that’s on your list were to get hit by the bus, that we aren’t screwed, you know. So, you know, that’s where you can lay out a game plan for, you know, cross-training of that particular person’s, you know, that particular person’s expertise or realms where they’d have a lack of redundancy and implementing some cross-training. It may mean that you need some additional resources, may need that you mean that you need to kind of plug their knowledge with, you know, with a vendor, you know, that type of thing. But anywhere where you’ve got, you know, those gaps in knowledge, that’s what you’re trying to, you know, trying to close up.
Now, some of the, you know, some of the elements that, you know, some of the elements that are on that list are going to be directly related to so-and-so’s experience. You know, there isn’t a magic wand to, you know, to make up for. somebody that has a decade of experience in a particular realm but the sooner that you get going on the cross training the sooner that you get other people involved the greater their length of time gaining that same experience you know will, will be put into effect and that’s one that will take time to you know to basically level out if you will but you know it’s really more of a initially it’s really more of a tactical, tactical approach to make sure that you’ve got somebody else sitting there that can go through and. and kind of take care of you know take care of any of those realms of knowledge now the reality is, is that you know we talk about it from a hit by the bus perspective right but you know how often how often have things just gone to hell in a hand basket when you are talking about you know, somebody goes on vacation, you know, somebody suddenly falls, you know, falls ill or sick, needs to be out for, you know, short-term disability or, you know, even for a couple of days, you know, depending on the timing of what that individual needed to do during the time that they were unavailable, even under those circumstances, that lack of cross-training, lack of institutional knowledge can, you know, certainly cause, you know, cause issues within the organization. So all the way around, you know, whether it’s a hit by the bus scenario, whether it’s they moved on to a new job scenario, you know, you’ve done the forethought and the planning so that you’re, you know, you’re not screwed if anything should happen to that particular individual.
That makes sense. Now, how often should an organization like Validate or Update there hit by a bus listening? Well, I mean, you know, if you think about it this way, you know, over the course of time, things change. We change vendors, we gain new clients, we, you know, have lacks of resources, you know, etc. So things change within an organization, you know, fairly constantly. And certainly the circumstances of me, you know, and over that period of time, you’re also starting to lay out, you know, kind of your cross-training, you know, regimen, etc. So there’s a lot of things that start to change as time starts to pass. I mean, I would recommend they do it at least once a year, you know, annually seems to be a pretty good cycle for how often to do it without it being overkill. That doesn’t make, it doesn’t make any sense to go ask people every week, right? You know, but once a year, yeah, that’s about the, that’s about the right time. You know, certainly as this exercise is performed, you know, the outputs from the gathering up and summarizing of that data most certainly should, you know, should go and be inserted into the organization’s, you know, risk assessment findings so that it’s down, it’s documented. We’ve got, you know, and game plans ready, you know, almost look at them, you know, each person that falls, you know, in your, in your top five, you know, on your hit by a bus listing. Each of those people probably need their own kind of mini project, if you will, for, you know, the, you know, kind of the cross training and redundancy that that’s needed. But, you know, what I’d recommend is, you know, go into it once a year, add those things into your risk assessment, you know, start moving forward with the internal projects. And I would prioritize, you know, subsections of the cross-training to be laid out kind of, you know, for quarterly, you know, going forward. That way you’ve got your eyeball on targets of resolution, you know, kind of as you’re going through the year.
The other upside is that it provides, you know, kind of detailed input and feedback to the risk assessment process, which you can then use as justification, you know, with your when it comes time for your annual assessment and whatever certification you happen to be going up against. Now you’ve got, you know, kind of some activity on resolution or mitigation of the, you know, of the identified risk from the risk assessment. You can use that as some justification for the annual assessment that you go through to show that, yes, we’re making progress against our, you know, against our listings on our risk assessment. So that usually goes a long way. But yeah, I’m a huge fan of lay out those targets kind of into quarterly chunks so we can just keep things moving. It’s so easy to get, just get tied up in, you know, tied up in day by day and putting off things that, you know, seem that important, you know, but going through the, the exercise of the of the hit by a boss, you know, it really brings a fine point on to, you know, onto the notion of, you know, things that we need to do, you know, for, you know, you know, that just in case moment, if you will.
Sure. Any interesting stories about the notion of being hit by the bus lately, Adam? Well, as luck would have it, and what honestly spurred, you know, spurred this particular conversation. There is an individual who shall remain unnamed that’s actually associated with TCT that sent me a note and said they literally had just been hit by a bus and my emotions went through a series of stages if you will. The initial was well at least it was that person that was sending me the hey by the way I got hit by a bus you know so I knew they were I knew they were they, they were not had not been creamed by the boss but no that said it was it was just a situation where you know, where they were, you know, they were on a bike and a boss basically didn’t, you know, didn’t yield went in front of them and they slammed right into the, you know, right into the side of the bus ended up, you know, having some issues with, you know, with their arm and neck and scrapes and cuts and all sorts of fun stuff. But, you know, I was, I was eternally grateful that they, they did not get creamed by the bus. That said, it did lead to some, you know, some various hilarity around, you know, me, me kind of applauding the dedication to, the dedication to TCT by being the only individual thus far that had actually gotten hit by a bus..
So that was, that was, that was the first one. That was a first for me. But, you know, it, it really, it, it kind of brought home, you know, the, the, the whole notion of, you know, why have I been using this approach, you know, for, you know, for so many years, because you just, you don’t know what’s going to happen, you know, a minute from now, 30 seconds from now, you know, let alone tomorrow or next week. So, you know, anything can happen. And, you know, it’s, it’s, it just kind of drilled home the point that, you know, you’ve got a, you know, these are things that you need to, you know, you need to have a game plan for, in terms of, of ensuring that you’ve got, you know, that type of, of redundancy, you know, within your organization. But like I said, I was, I was just very, very glad that this particular individual that, that they were, they were in the grand scheme of things were, were going to be okay. Cause man, that was, that was scary as hell hearing, hearing the story about, about what, what had actually occurred. It was nuts.
No doubt. No doubt. Indeed.
Alright Adam parting thoughts and shots for the folks this week. Well, you know when we’ve hit it numerous times throughout you know through throughout this particular episode but you know planning for redundancy planning for contingencies. It’s an important exercise for, for every organization. You know, you want to when you’re doing this, you know, a lot of folks will, you know, kind of build the all I know who the, you know, I know who the important departments are, whatever. Well, guess what, I mean this is something to consider all the way from, you know, kind of sea level. Um, you know, including yes, the, you know, whatever the top of the food chain happens to be at your organization, whether it’s a CEO or a president or uh, you know, whatever But you know them the rest of the folks at c-level are you know, kind of important individuals But bring it all the way to the bottom of your food chain, you know, there’s uh, you know, you you’d be You’d be surprised. Um When you know when I’ve done these discussions with folks, gone through talk through um, you know kind of you know What do they do and what types of things are involved and who is it that they believe should not get hit by the bus? You know, etc You learn a ton about you know, kind of what’s going on? Uh in that, you know in that particular organization and there are a lot of times where, where we’ll trip across something Um that quite frankly most of the people in the organization didn’t have it, you know didn’t even know I didn’t have any idea that you know, you know, Sarah was doing fill in the blank or you know That she you know, she was the only one that you know that had this particular information, etc um, and you know that in, in some cases the You know the ripple impacts, um of a hit by, by the bus event, um in some cases those effects if not addressed could be you know catastrophic for an organization in in other cases It, it, it just is it’s pain. It would be painful But regardless, um, you know everybody, everybody at an organization. I mean they’re, they’re, they’re getting a paycheck because they’re bringing some form of value to the company Um, so, you know, it’s, it’s all about understanding You know, what is the value that you know that these folks are bringing and you know, where do we have? Um, you know kind of some room for room for improvement.
You know, the other the other element within the organization Um, you know is also focus with specialized skills, right? That’s something that you need to consider when you’re going through. So I’ll give an example. Let’s say it’s in or in the IT department. Yes, you may have three network administrators as an example. Well, I guarantee you that one or two or all three of those network administrators has some form of specialized knowledge about a particular piece of technology that they are primarily responsible for or have a great deal of experience in where the others don’t. So looking for those within the organization with the specialized skillsets and whatnot, that’s important. So when I was saying, going in and doing these kind of interviews across the organization, as you’re planning out who all do we need to talk to, who all do we want to talk to, etc, etc, etc. You know, plan it out as best you can, but just be cognizant of, of those that have those specialized skills, so that you can get them, you know, kind of get them into the mix. The other thing that I was going to mention is that, you know, as you’re going through, I can, I can tell you in most cases, I’ll be going through and I’ll be conducting the interviews at a, you know, at a particular organization and I’ll have started the list with, hey, I want to talk to these whatever, 14 people type of thing. As I’m going through and doing the, you know, doing the discussions, doing the interviews, talking to people, you know, things will pop up where, you know, like anyone, you want to know what? Yeah, I, I am going to need to add Maria to this list because, you know, a bunch of people are bringing up stuff about, about, you know, what Maria does and what Maria knows and whatnot, even though she wasn’t on the list, don’t be afraid to tweak and alter the, the interview list. It’s, the exercise is most importantly to identify those realms of, of, of lack of contingency or lack of redundancy. So don’t be afraid to, you know, go throw additional warm bodies into the, into the mix, if you will, as you’re going through and doing the, you know, kind of the interview process, because you are going to discover things as you’re going through and conducting those interviews, which will be, you know, important to kind of bring to fruition, you know, and bring to their, to their natural conclusion, you know, by, by going down each of the rabbit holes that presents itself as you’re, as you’re going through and running through the interview process.
Nice. And that right there, that’s the good stuff. Well, that’s all the time we have for this episode of compliance unfiltered. I’m Todd Cachill. And I’m Adam Gosling. Hope we help to get you fired up to make your compliance suck less.
