Vicky McKim was once congratulated by a police officer for the thorough, state-of-the-art emergency kit she packed for her son’s car when he was a teenager. 

“It’s got nylon rope, it’s got tents, it’s got mylar blankets, it’s got granola bars,” McKim ticks off as she recalled the episode. “So then the officer calls and says, ‘I just want you to know that’s an awesome kit.’ ” 

Her son was fine — the officer initiated the stop only because of a broken taillight. As for McKim, it’s her job to think of everything that could possibly go wrong  – and tell her clients how to prepare for it all. 

McKim is the risk management and business resilience director at Aureon Consulting, which she joined in 2014. Today, she advises both Aureon and clients on risk assessment, disaster management and business continuity in the face of emergencies both natural and man-made. 

McKim got her start as an operations manager for Holmes Murphy & Associates in 1986. By the time she joined Marsh in 1996, her skills had grown from managing telecommunications networks to include business continuity, critical systems compliance and emergency assessments. McKim was the director of business continuance and protection at Aviva from 2006 to 2008 and worked as a business continuity consultant for five years before joining Aureon. 

When you meet someone for the first time, how do you describe your role? 

I really am focused on managing our operational risk. I don’t do the financial side so much, but I do focus on the environment, the governance risk and technology risks. 

I’ll look at the natural threats that are around a location. Here in Iowa, we’re in tornado zones, so obviously that’s the first one that comes to mind. 

There’s some of the other things that people don’t normally think about, like abandoned coal mines … What people don’t realize is about a third of the city of Des Moines is undermined by coal mines. So if we ever had things like a minor earthquake, just a little tremor, we could have some serious problems here in the metro area. … I also look at infrastructure that’s around us. 

Right outside [Aureon] we have the interstate not even 100 yards away. Very few people know that there’s a lot of hazmat … nuclear waste that’s going up and down that interstate constantly. 

On the governance side, we’re looking at onboarding/offboarding processes. 

We’re also looking at corporate governance, we’re looking at technology governance — not so much what they say, but what they’re actually practicing. Sometimes, what I find when I’m doing assessments for them, they’ll have policies … but when you actually go in and you assess for companies, you’ll find that they’re not actually doing what they say that they’re doing. … I’m also doing business continuity planning. That’s what you do when you can’t get rid of any more risk, you mitigated as much of the threat as you possibly can. … So we’ll look then at putting in a continuity plan, a business recovery plan, around those residual risks. Which brings us down to a further level of mitigation, where it’s an acceptable risk that that point. 

What are the misconceptions about your role?

A lot of times, people say “that will never happen.” That’s such a fallacy, and it happens all the time. They’re thinking of these catastrophic events — catastrophic events actually do happen. We’ve seen it here in the United States — you know, the Northeast blackout [in 2003], three days of no power. 
We also have, here in Iowa, the flooding, Parkersburg just disappearing off the map [in the 2008 tornado]. Things like sinkholes, things like workplace violence, those happen all the time. 

The other thing that I think is happening that people fail to recognize is the constant, small daily disruptions when you’re down. Maybe you have a contact center, and you’re down for two hours here or three hours there; that begins to erode your client confidence in your ability to deliver services. 

How do you begin?

There’s several different things I offer to our clients. One is just a gap assessment, so if they have plans currently, and they just want me to come in and take a look at their program and review their plans.

I can conduct risk assessments for them. That’s really beneficial for a lot of companies because they don’t look at risk. … I’ve talked to loss control agents about what they look at and what they review. There’s a big difference between what an insurance carrier is looking at and what an operational risk manager looks at as well. So I’m able to offer them a perspective that they’re not going to get from their insurance carrier. 

You believe that disaster preparedness extends beyond the office. Can you talk about that?

One of the things in this industry that’s super important is preparing your employees. Your employees are not going to be able to respond if they’re worried about their own families at home. 

It’s those kinds of things your kids know, “If something happens and I’m separated from my family, I know that I’m to go north on the interstate to the first McDonald’s and stop there and wait for my mom. And if they won’t let me stop there, I go to the next one. And my mom’s going to look at every McDonald’s along the way until she finds me.”

Without asking, without preparing your families, they’re not going to be able to effectively respond to help you recover when you need it. If you prepare them, they’re going to be better able to respond and come to your aid at the business level, because their families are taken care of. 

Can you share the story about your son’s gift when he was a child?

I was working at Marsh, and I was doing telephone system cuts and kind of doing business continuity on the side and was taking over that full-time role. Obviously when you think doom and gloom all day long, it kind of affects your personality a little bit. 

He gave me a little [toy] named Gilbert. And he said, “Mom, you need this little guy to cheer you up.” I still have him at home.

[At the office] we would play with him in one of those stress-relieving ways. One time, we had a little sand candle, and we would undo paper clips and stick Hot Tamales on them so that it looked like hot dogs. We would tape it to Gilbert and put it over the “fire,” and he would have a picnic. We would just do crazy things and we would laugh our heads off. 

When you’re thinking death and mayhem, and the environment’s super stressful, some people start drinking. They get their escape that way. I used Gilbert, which was a lot safer and saner. 

How important is it to have something like that? 

You have to have a way. My husband and I, we love the outdoors. Just for me to get out of the risk environment for a little bit and just go be normal … You have to be grandma, you have to be wife. You have to be mom or husband or father or whatever it is. I won’t watch sad movies. I absolutely refuse, because when you’re dealing with disasters, there’s enough trauma to last you a lifetime. 

What is something you’ve been reading/watching/listening to?

There’s a great book out called “Crisis Management,” and it’s by Regina Phelps. She’s been practicing probably longer than I have for disaster recovery and business continuity/risk management. She just put this book out there this year, and it’s phenomenal. It’s like a road map. If you’re going to implement, it’s a great read because she’s very, very practical. I find that’s what you miss sometimes with loss control agents, they’re not thinking practically. … That’s been one that has been a good read for me, good reminder on that emergency operation center and some of the things that go into that.