Showing posts with label Ace Jackson. Show all posts
Showing posts with label Ace Jackson. Show all posts

Friday, February 14, 2020

Enterprise Risk Management, BC, COOP

Blame woes
On imaginary
“Black Swan”

 

AN ARTICLE IN ENGLAND'S The Guardian with the headline Businesses worldwide count cost of coronavirus outbreak (https://tinyurl.com/vc3t3yv) quoted the boss of China’s biggest listed company, Alibaba, as describing the coronavirus outbreak as a “black swan” event that could have a significant economic impact.

 

”Black Swan” No.

Peking Duck, maybe.

Incompetent risk management planning: ABSOLUTELY.

 

Black Swan defined

According to England-based The Business Continuity Institute, a “Black Swan” is an event that strikes as a surprise, with a high impact on those affected. The Black Swan Theory was coined by Nassim Nicholas Taleb in 2007 and it revolutionised the way organizations think about risk management and forecasting.(https://tinyurl.com/r4zo5gg)

One of the main messages the author tried to convey is that current risk models are not efficient enough and hard-to-predict disasters can occur due to lack of perspective, the article continued.

I was, for many years, a risk management practitioner, I even was certified by The Business Continuity Institute (BCI), despite having some severe philosophical problems with it.

“Black swans” was one of the issues on which The BCI and I parted ways.

 

 

Practitioner’s cop out

To this scrivener, a “Black Swan” is a cop out. It shows the practitioner held too narrow a “perspective” — which may have been determined by the client — and a pathetic lack of knowledge of history.

 

Are rapidly spreading diseases something new in 2020? World War I claimed an estimated 16 million lives between 1914 and 1918. The influenza epidemic (H1N1) that swept the world in 1918 killed an estimated 50 million people. (https://tinyurl.com/j27npgb)

There is plenty of recent history of rapidly-spreading disease.

A quick search of the WWW turns up a Centers for Disease Control and Prevention (U.S. CDC) page titled Influenza (Flu) Past Outbreaks. (https://tinyurl.com/yx5l2h5r)

So where is the “Black Swan”?

 

Absences by the thousands

All along the supply chain, deliveries are interrupted.

Quarantines by governments stop or delay shipments.

Absences of personnel disrupt deliveries.

Vendors’ vendors fail to meet service level agreements..

Vendors fail to meet their customers’ service level agreements.

Sales personnel either are absent or quarantined to a specific locale.

Manufacturing slows or stops for lack of raw materials and personnel to turn these raw materials into product.

Office staffs are reduced to skeletons so A/R and A/P are delayed.

Finished products remain on the shelf.

Customers cannot sell products they don’t have (the manufacturer being a vendor).

Dominoes.

Every time there has been an epidemic, the supply chain takes a hit. The more wide-spread the epidemic, the longer the duration of the epidemic, the greater the impact.

Has this scenario ever played out before?

Yes, yes, and yes again.

So where is the “Black Swan”?

 

Narrow perspective

Too many practitioners are little more than IT Disaster Recovery people with a new title: “Business Continuity.”

Even many Business Continuity planners think only in terms of facility.

There HAS been some interest in supply chains, but this interest usually terminates at the critical vendors.

I was fortunate to work for American Express on a contract basis many years past. The Amex group for which I was engaged utilized vendors for almost everything.

One of the things I recommended, and my Amex boss agreed, was to have each vendor provide Amex with the vendor’s business continuity plan. Amex realized that a few vendors had good plans, a few not so good plans. Each plan was critiqued and the critique returned to the vendors. Amex knew which vendors could be expected to meet their service level agreement “no matter what,” and which vendors needed a secondary (alternate) vendor as backup.

 

Playing the “What if?” game

If a practitioner is thorough, that person will talk with everyone in the profit center and ask: What if? What could possibly go wrong?

This works best with groups of people; one idea generates another. No idea is too far fetched. (That’s why planners have risk vs. probability charts.)

Practitioners who think, having done one plan for a customer in Enterprise A that they know everything there is to know about ALL Enterprise A organizations need to be disabused of this faulty notion “yesterday.” Like snowflakes, no two are alike.

 

Ubiquitous other

When we worked together, my friend and IT guru, Ace Jackson would be amused that all of my risk lists included at the end: “ubiquitous other.”

The risk may have been a “Black Swan,” but since we were looking at the entire operation and what might happen if a risk we failed to consider occurred, we still were confident that the organization had mitigated “whatever it is” and could recover from “whatever it was” based on The Plan, The Training, and The Plan Maintenance.

My “ubiquitous other” may have been, strictly speaking a “Black Swan” it still would not be able to impact the organization the way the coronavirus has impacted many of Alibaba’s customers.

 

Black swan? It’s a lazy practitioner’s cop out.



PLAGIARISM is the act of appropriating the literary composition of another, or parts or passages of his writings, or the ideas or language of the same, and passing them off as the product of one’s own mind.

Truth is an absolute defense to defamation. Defamation is a false statement of fact. If the statement was accurate, then by definition it wasn’t defamatory.

Web sites (URLs) beginning https://tinyurl.com/ are generated by the free Tiny URL utility and reduce lengthy URLs to manageable size.

 

Comment on Black Swans

Monday, June 3, 2013

ERM-BC-COOP:


Cite source


 

I have the privilege to review articles submitted to the Disaster Recovery Journal, DRJ.

It’s not a particularly big deal; I am one of perhaps two dozen reviewers.

I skip all articles that are solely IT; that’s not my area of expertise. For IT I turn to real IT mavens such as Ace Jackson, who also happens to be a reviewer.

This evening I read a really good article about hurricanes.

Well written, informative.

I told Editor Jon Seals to send it back to the author.

Why?

One simple omission: There was no attribution.

Who is the authority?

Unless the author is a meteorologist or climatologist, I want to know where the author got the information.

This was not an “opinion piece” such as I am wont to write; this article presented itself as documented facts.

When I was cub reporter, back before UP married INS to become UPI (before that I was a printer who often set “heds” from a California job case), I was told to “attribute everything.” I was to “report” not “make” the news, and there had to be a source. Back in the day, reporters tried to keep the fingers pointed at someone else – the source of the material.

Same thing as a PR flack – sorry, “practitioner.” At Tel Aviv University, the articles I penned always cited Professor This or Professor That.

I didn’t have to attribute anything in the mil-spec technical manuals I wrote; I was thought to know the subject on my own.

But DRJ is “journalism” in the broad sense of “keeping a journal.” The copy in the magazine – paper and digital – needs attribution unless, as previously noted, the story was “first person” or “opinion,” humble or, always in my case, “not.”

Is writing for the DRJ different than documenting a plan.

Not really.

It behooves the practitioner to cite the sources.

While every statement need not be directly attributed, the document’s sources must be acknowledged.

Acknowledging the sources does at least two things:

  1. It shows which Subject Matter Experts (SMEs) were involved in the decisions reached by the practitioner, and
  2. It acknowledges the sources’ effort; just about everyone likes to see their name in print

I’ll admit that Item 1 also serves as a Cover Your Assets (CYA) tool for the practitioner.

This citing sources is particularly important for the consultant and extremely important if the consultant is less than an SME in a specific discipline.

If I’m documenting an IT process, you can bet I’ll tell the world who provided the information.

Besides citing the source, practitioners are well advised to heed the admonishment to pilots:

When descending

From above

Be like porcupines

Making love

CAREFULLY

and proofread their documents CAREFULLY. Spelling and grammar ARE important; the practitioner’s image is important to the document’s credibility.

Unless the practitioner is the authority, a KNOWN authority, all statements of fact need to be attributed; the reader needs to know who made the statement.

As for the foregoing, I’ve “been there and done that,” so I am my own source. If you doubt me, ask Ace Jackson.