Enterprise Risk Management, BC, COOP Blame woes On imaginary “Black Swan”

 

AN ARTICLE IN ENGLAND'S The Guardian with the headline Businesses worldwide count cost of coronavirus outbreak (https://tinyurl.com/vc3t3yv) quoted the boss of China’s biggest listed company, Alibaba, as describing the coronavirus outbreak as a “black swan” event that could have a significant economic impact.

 

”Black Swan” No.

Peking Duck, maybe.

Incompetent risk management planning: ABSOLUTELY.

 

Black Swan defined

According to England-based The Business Continuity Institute, a “Black Swan” is an event that strikes as a surprise, with a high impact on those affected. The Black Swan Theory was coined by Nassim Nicholas Taleb in 2007 and it revolutionised the way organizations think about risk management and forecasting.(https://tinyurl.com/r4zo5gg)

One of the main messages the author tried to convey is that current risk models are not efficient enough and hard-to-predict disasters can occur due to lack of perspective, the article continued.

I was, for many years, a risk management practitioner, I even was certified by The Business Continuity Institute (BCI), despite having some severe philosophical problems with it.

“Black swans” was one of the issues on which The BCI and I parted ways.

 

 

Practitioner’s cop out

To this scrivener, a “Black Swan” is a cop out. It shows the practitioner held too narrow a “perspective” — which may have been determined by the client — and a pathetic lack of knowledge of history.

 

Are rapidly spreading diseases something new in 2020? World War I claimed an estimated 16 million lives between 1914 and 1918. The influenza epidemic (H1N1) that swept the world in 1918 killed an estimated 50 million people. (https://tinyurl.com/j27npgb)

There is plenty of recent history of rapidly-spreading disease.

A quick search of the WWW turns up a Centers for Disease Control and Prevention (U.S. CDC) page titled Influenza (Flu) Past Outbreaks. (https://tinyurl.com/yx5l2h5r)

So where is the “Black Swan”?

 

Absences by the thousands

All along the supply chain, deliveries are interrupted.

Quarantines by governments stop or delay shipments.

Absences of personnel disrupt deliveries.

Vendors’ vendors fail to meet service level agreements..

Vendors fail to meet their customers’ service level agreements.

Sales personnel either are absent or quarantined to a specific locale.

Manufacturing slows or stops for lack of raw materials and personnel to turn these raw materials into product.

Office staffs are reduced to skeletons so A/R and A/P are delayed.

Finished products remain on the shelf.

Customers cannot sell products they don’t have (the manufacturer being a vendor).

Dominoes.

Every time there has been an epidemic, the supply chain takes a hit. The more wide-spread the epidemic, the longer the duration of the epidemic, the greater the impact.

Has this scenario ever played out before?

Yes, yes, and yes again.

So where is the “Black Swan”?

 

Narrow perspective

Too many practitioners are little more than IT Disaster Recovery people with a new title: “Business Continuity.”

Even many Business Continuity planners think only in terms of facility.

There HAS been some interest in supply chains, but this interest usually terminates at the critical vendors.

I was fortunate to work for American Express on a contract basis many years past. The Amex group for which I was engaged utilized vendors for almost everything.

One of the things I recommended, and my Amex boss agreed, was to have each vendor provide Amex with the vendor’s business continuity plan. Amex realized that a few vendors had good plans, a few not so good plans. Each plan was critiqued and the critique returned to the vendors. Amex knew which vendors could be expected to meet their service level agreement “no matter what,” and which vendors needed a secondary (alternate) vendor as backup.

 

Playing the “What if?” game

If a practitioner is thorough, that person will talk with everyone in the profit center and ask: What if? What could possibly go wrong?

This works best with groups of people; one idea generates another. No idea is too far fetched. (That’s why planners have risk vs. probability charts.)

Practitioners who think, having done one plan for a customer in Enterprise A that they know everything there is to know about ALL Enterprise A organizations need to be disabused of this faulty notion “yesterday.” Like snowflakes, no two are alike.

 

Ubiquitous other

When we worked together, my friend and IT guru, Ace Jackson would be amused that all of my risk lists included at the end: “ubiquitous other.”

The risk may have been a “Black Swan,” but since we were looking at the entire operation and what might happen if a risk we failed to consider occurred, we still were confident that the organization had mitigated “whatever it is” and could recover from “whatever it was” based on The Plan, The Training, and The Plan Maintenance.

My “ubiquitous other” may have been, strictly speaking a “Black Swan” it still would not be able to impact the organization the way the coronavirus has impacted many of Alibaba’s customers.

 

Black swan? It’s a lazy practitioner’s cop out.

---

PLAGIARISM is the act of appropriating the literary composition of another, or parts or passages of his writings, or the ideas or language of the same, and passing them off as the product of one’s own mind.

Truth is an absolute defense to defamation. Defamation is a false statement of fact. If the statement was accurate, then by definition it wasn’t defamatory.

Web sites (URLs) beginning https://tinyurl.com/ are generated by the free Tiny URL utility and reduce lengthy URLs to manageable size.

 

Comment on Black Swans

Enterprise Risk Management, Business Continuity, Disaster Recovery Coronavirus Proves need To plan ahead

A FEW YEARS AGO, before I gracefully retired, a person from Empire Today asked me to create a business continuity plan

• only covering its retail outlets,
• sans access to store personnel, and
• right now, over the phone.

I told Empire Today’s caller that

• covering only the retail outlets would not protect the business, and
• that I don’t create instant plans over the phone.

End of conversation.

I HAVE FOR MANY YEARS been a proponent of Enterprise Risk management.

Business Continuity, I decided, focused too much on an owned operation. In my not-at-all humble opinion, to protect a business, the practitioner must start with the vendors — and sometimes the vendor’s vendors — and follow the risk “yellow brick road” to the product or service’s final destination: the consumer.

In the case of Empire Today, the company gets its wood from the Far East.

I’m not certain WHERE in the Far East — my caller told me not to worry about supplies, only about the stores — but China’s coronavirus reminded me of the call.

Nothing new under the sun

Most practitioners remember, or should have read about, the last bird flu epidemic, or more accurately, bird flu panic.

Business leaders worried about missing personnel.

Being “facility focused,” they failed to consider

• Their vendors
• Movement of materials from the vendor site to the facility — even electronic data transfers
• In-house personnel, both profit centers and support staffs
• Are sales personnel available and active
• Movement of product to wholesaler or to customer
• Accounts Payable and Accounts Receivable — are the financial institutions functioning
• And, rarely considered, government interference — quarantines, lack of staff at international air and sea ports and border crossings

And these are just “off the top of my head.”

From Disaster Recovery to Enterprise Risk Management

Most people think that risk management started with IT disaster recovery.

It did not.

Back in the early 1960s, when I wore Air Force blue (on the few chilly days we had at Orlando AFB — now also retired), the military was practicing risk management pretty much across all operations.

Preventive maintenance for personnel and equipment was Standard Operating Procedure (SOP). We lined up to either give or receive inoculations to prevent illnesses wherever our Favorite Uncle sent us.

Hurricane threatens? The Charge of Quarters (this scrivener) went out to start the generator of each of the wards and the clinic. If a critical generator failed to start, patients were moved to a ward where the generator DID start.

Checking to see if the generators would crank, I learned after collecting my DD214, is the last step in generator testing. Making certain there is fuel and that the fuel is not contaminated precede the start-up test.

For all that, “disaster recovery” gained a following with the increasing dependency on IT.

As a consultant with what was then DMR in Tampa FL, I did a job for GTE Data Systems. The company wanted to map its national data network and to identify areas that needed to be improved.

Not long after the project completed, the network crashed, but thanks to the project, the network quickly was restored.

Not everyone learned the lesson.

I worked for ZIM Integrated Shipping Services in Norfolk VA. Zim’s headquarters in Haifa, Israel hired IBM to create a “business continuity” plan for the Norfolk (U.S. headquarters) operation. IBM produced a fine disaster recovery plan for the IT operations, but never stepped outside the data center. I later convinced the IT boss that his machines were of zero value if there was no one to use the data and Zim got a true Business Continuity plan — that promptly was shelved until after a storm closed the business for a week.

American Express realized the value of end-to-end risk management.

I was fortunate to work on an Amex project that covered several states and a multitude of vendors.

I suggested to the project manager that Amex request business continuity plans from each critical vendor for my review. It did.

The exercise (a) gave each vendor a free critique from another practitioner and (b) broadened my expertise by seeing what concerned other planners. Amex made getting vendor business continuity plans part of its contracting process.

We discovered that Amex needed to arrange back-up for some critical vendors.

No two plans are alike

I have created plans for national retail outlets, so creating a plan for Empire Today was well within my expertise.

But it is impossible to create a plan sans input from profit center personnel.

It is foolish to create a plan that covers only one aspect of the business.

I can imagine risks to individual sites — Lucent Technologies built a beautiful building and put its profit center behind huge glass windows on the building’s ground floor. Trouble was, the building was constructed on a flood plain.

Too late for enterprise risk management? True, but it pointed out the need to involve risk management practitioners early on in the planning.

But Empire Today wanted a single plan for all of its retail outlets.

Instantly, over the phone.

In all the years I created plans, only one other person demanded an instant, over-the-phone plan. He also didn’t get a plan.

Involve everyone

While at DMR I was part of a team creating a plan for a State of Florida department.

The State encouraged its people to candidly work with us and they did.

At one point the discussion turned to communication options.

The State uses microwave towers for much of its communications, especially law enforcement.

As everyone knows, Florida sometimes gets windy — very windy.

What happens if a microwave tower does down?

A retired Florida Highway Patrol office, working for his second state pension, suggested “Get a crane and hoist the dish high until the fallen tower is replaced.”

At Zim, I asked the HR manager what risks his department faced.

None, he replied.

Then his more experienced assistant entered the conversation and reminded him that missing federal I-9 forms can be expensive if the Feds want to check employee eligibility to work in the U.S.

Finally, the manager offered that a neighboring business might be a target of protesters and that a protest might spill over to Zim property, preventing personnel from entering or leaving the building.

Sometimes a planner has to “prime the pump.”

A long way from the coronavirus

We have come a long way from considering the impact of the Chinese coronavirus, but with enterprise risk management, nothing is “out of scope.” Very often one thing leads to another, as with the case of Zim’s HR personnel.

While all plans have the same basic skeleton, every plan is unique.

Plans cannot be created without input from both management AND the people doing the work.

Plans cannot be created instantly over the phone. (Usually, when that is the requirement, the “customer” is looking for a “freebie.”)

Finally, a true enterprise risk management plan is all inclusive and includes business continuity and disaster recovery.

---

PLAGIARISM is the act of appropriating the literary composition of another, or parts or passages of his writings, or the ideas or language of the same, and passing them off as the product of one’s own mind.

Truth is an absolute defense to defamation. Defamation is a false statement of fact. If the statement was accurate, then by definition it wasn’t defamatory.

Web sites (URLs) beginning https://tinyurl.com/ are generated by the free Tiny URL utility and reduce lengthy URLs to manageable size.

 

Comment on Vindication

ERM-BC-COOP Is it bird flu, Is it MERS, Does it make a difference?

 

The Threat du Jour is MERS - Middle East Respiratory Syndrome.

In ancient history - circa 2007 - the threat was avian influenza, a/k/a bird flu.

(Much before that - circa 1918 - it was the misnamed "Spanish Flu.")

I wasn't around in 1918 (no, I'm not THAT old), but I was around for the bird flu scare and, as did too many - most? - risk management practitioners, I started looking for ways to counter the threat.

Wash hands while singing "Happy Birthday."

Wear masks.

Avoid crowds.

Etcetera, et al, and all the similar inclusiveness words.

It's probably not necessary to my point - and I'll get to it shortly - but some words about MERS from people who know.

According to the U.S. CDC(&P), Middle East Respiratory Syndrome (MERS) is viral respiratory illness first reported in Saudi Arabia in 2012. It is caused by a coronavirus called MERS-CoV. Most people who have been confirmed to have MERS-CoV infection developed severe acute respiratory illness. They had fever, cough, and shortness of breath. About 30% of people confirmed to have MERS-CoV infection have died.

A coronavirus is, again according to the CDC&P, Coronaviruses are common viruses that most people get some time in their life. Human coronaviruses usually cause mild to moderate upper-respiratory tract illnesses.

The CDC&P has much more online; go forth and read.

But what about risk management practitioners? How should we prepare ourselves and our clients to face the threat?

First, what is the threat? Actually what are the threats. Let me count the ways.

1. Absenteeism
• Of personnel
• Of vendors
• Of clients
2. Inability to perform critical functions due to equipment failure
• Hardware failures
• Infrastructure (Internet) failure
• Power failures

That cannot be repaired/replaced due to lack of healthy personnel.

As with the avian influenza, MERS has a a fairly high fatality rate; 30% according to the CDC&P. However it seems to be less contagious than the bird flu.

Those practitioners who, often lacking Very Senior Management support, maintained the information gathered together for the bird flu are way ahead of the game as MERS threatens.

Practitioners who planned for the bird flu's impact are almost home free.

In manufacturing facilities, the practitioners know to recommend to management to slightly increase the on-hand supply of raw materials. They also know that, when possible, to stage completed product are geographically distant locations - not across the street or even across town, but 100 or more miles away.

Office personnel need the option to work someplace other than the office. Equally, they must be trained to the point that they are confident in working off site - knowing how to access the systems from a remote locations.

One company insisted that its personnel with off-site access actually access the company's systems remotely at least once every several months.

It should, but it won't, go without saying that the IT infrastructure needs to be evaluated in light of any new load or security changes/upgrades.

The practitioner needs to monitor the CDC&P and WHO to track the spread of MERS - and other mobile maladies - and to keep both management and staff aware. It is important to avoid panic on the part of anyone in the organization.

All personnel need to know the symptoms and all personnel need to know how management will react if someone contracts MERS - or any other contagious disease.

If personnel need to be furloughed, what will the organization provide?

HR questions must be considered, including:

• Will furloughed personnel lose vacation time
• Will furloughed personnel receive full or reduced pay
• How will pay be made if direct deposit is not used by some employees
• How will personnel be notified of furloughs, call-backs

The four questions, above, are just the tip of the iceberg. BUT, these are questions that should have been addressed when the bird flu was a threat.

As King Solomon is alleged to have uttered: אין שום חדש תחת השמש - There is nothing new under the sun.

I wonder what the medical threat du jour was in Solomon's time. There surely was one - or more.