We are continuously admonished to do risk assessments and take action to mitigate them. The question is how to approach this. This post will build on an article in 25 February, 2011 National Post called “Understanding the need for risk assessment“, page 2, by Adrian Gordon, in a supplementary feature titled “An Independent report by Mediaplanet to the national Post.
First a point of clarification: although the author talks about risk, I hold the view that we are in an universe that is better described as filled with uncertainty. So I will use the U&R shortcut for uncertainty and risk.
Gordon sees the U&R process having three steps:
- Understanding the objectives of your organization.
- Understanding the U&R (the events that lead to these outcomes).
- Deciding what can be done to prevent or mitigate the U&R and planning to ensure essential organizational functions continue to operate in the event of a disruption.
Gordon goes on to make some very astute observations:
“All too frequently, the need for business continuity is expressed in terms of major events and disasters such as pandemics, earthquakes, floods, wildfires, hurricanes, tornados, winter storms or summer heat waves.”
“However, while these events should not be ignored, greater attention should be given to more common disruptions and their impact.”
He recommends that we look at external and internal U&R. He notes that internal ones can include:
- the very nature of the organization
- dependence on communications
- dependence on technology
- people (job U&R and potential for serious human error)
These can lead to such U&R events such as supply chain disruptions and single points of failure (key people, systems and equipment where there are no effective backups).
He wraps up by observing that we need to assess likelihood and impacts of these U&R and then develop appropriate strategies to deal (prevent/mitigate) with them.
Gordon has given us some useful insight into where we could locate our TM U&R.
- Supply chains – organizations often have external links that are particularly knowledge oriented and these might be easily disrupted (depends on the those organizations U&R management efforts).
- Supply chains – goods and services that we acquire use of as we operate (i.e., consumable inputs). At the end of the day – all goods and services have talent involvements
- Our internal critical roles – Gordon mentions single points of failure. All organizations have critical roles that if they become inoperative due to disruption can have devastating effects on the operations. Clue: any role that has critical knowledge and/or coordinating on other roles. My own experience is that these roles are seldom leadership ones at the second or higher levels in the organization. Higher leadership role disruptions have more subtle and longer term effects.
- Our internal critical roles – roles that maintain the operational support mechanisms including information and technology systems. As these systems become disrupted we call upon these system support people to recover these systems.
For those of us who are in organizations that operate in a competitive environment these U&R issues have additional complexity. Our ability to recover/sustain operations during U&R events is a comparative issue.
I have appreciated the insights by David Apgar (Risk Intelligence – Learning to Manage What We Don’t Know, HBR Press, 2006). He made two particularly useful observations:
- Understand which U&R confer an advantage to us if we were to learn more about them. Can we learn more and at a faster rate than our competition?
- Ensure you seek proficiency in those U&R areas where you can achieve an comparative advantage over your competition.
- Supply markets U&R (note both in the input and output sides are critical regarding talent). If you know these U&R better (not just whether, but also what are the causal drivers for these events) than the competition you have the potential for “first mover” advantage.
- Supply markets U&R (internal and external) concerning performance attributes. We build our business models around roles that have performance expectations. Expectations are built on assumptions of knowledge, attitudes, presence of mind, etc. Anyone of these may become “iffy” for any number of reasons. Knowing these and what drives deteriorating change can become a competitive advantage.
- Knowing what the costs and benefits of first mover advantages are, we can decide where we will make U&R mitigation investments and to what degree ( we have basis for doing the math)
- Choosing which U&R mitigation strategy is most appropriate. For example – “Should we intervene to influence the causal drivers for U&R event occurrence or should we just take out some form of insurance?”
One of the specific U&R situations that I try to get clients to look at from a diverse problem solving perspective is when critical roles are involved. Often the main reason a critical role becomes heavily U&R ladened is that no practical development of a backup is readily present (reasons can include: not enough volume of work to have a second person involved and provide development, the time to develop is a protracted one, “willingness to share” issues”).
At the heart of it: A critical role is critical because of the business model the organization has chosen to take on. Change the business model – you change the profile of your critical roles. In my mind this picks up a U&R notion that Gordon touched on: “The Nature of the organization”. We need to always remember, organizations are designed social systems – they are not immutable metaphysical entities that can’t be changed.
For those of us in the OD field, I highly recommend David Apgar’s book as an excellent primer on how to approach managing U&R. I especially like that notion that you need only be better than the other person in order to be successful at managing your U&R.