Posts

I’m sure you’ve heard people referring to COVID-19 as a ‘Black Swan’ – something that no-one could have seen coming – but is that actually the case? Terrible though it is, I don’t think it’s accurate to describe the current situation as a Black Swan because we’ve had to deal with highly contagious, deadly diseases before. Calling this a ‘Black Swan’ is, therefore, a way to excuse a confused response: ‘how could we have prepared for something that no-one could see coming?’ ...

A while back, I wrote something on the need to speak up, even when it’s hard. That’s something we face as risk managers, but it’s also a necessity in other parts of our lives. I’ve also written about how there are risks that are so big and uncomfortable that they’re left in the corner: we pretend not to see them. I even wrote a whole piece on Jim Barksdales’ rule about snakes: “The first rule of snakes is, if you see a snake…Just take care of it”. Basically, if you see a problem, don’t stand around staring, debating whether it’s real or not, just deal with it. ...

Just-in-time inventory is the idea that the materials you need arrive just as you need them. This approach cuts down on the cost of storage space and reduces the amount of inventory sitting around doing nothing. A just-in-time approach is very efficient but very fragile. If the supply chain hiccups and inventory gets delayed, the knock-on effects shudder through the whole supply chain. Just in time inventory works, until it doesn’t Toyota discovered this in 1997 when a supplier’s factory burned down. Aisin Seiki was the sole-supplier of a critical part Toyota used in the majority of their vehicles, and the fire left them with just two-three days of inventory because of their just-in-time inventory system. Toyota’s recovery, which amounted to an almost national-mobilization of Japan’s industrial base, was incredible and taught manufactures the world over many valuable lessons. ...

I was thinking a while back about the idea of informed intuition: cases when you seem to be trusting your intuition but, in fact, you’re recalling deeper experiences and patterns that help with your risk-based decision-making. As I was building upon this idea, it became clear that I wasn’t onto any thing new but, instead, this has been explained in the work of, among others, Gary Klein and the RPD model. ...

In Amman, we’re in our 7th week of curfews, homeschooling, and weekend lockdowns, and things are starting to ease up so you can drive, the bigger stores are opening again, and in some people’s eyes, we can get back to normal. Unfortunately, as I’ve said previously, I don’t think we’re going back to how things were (‘normal’), and our ‘new normal’ requires some adjustments. Sadly, in some places, we’re treating the lifting of restrictions as an ‘all-clear’ which is only going to make things much worse. ...

I meant to write this piece a few months back, focusing on the first part. However, with the developments around COVID-19, I thought the second point was also relevant and timely. Plus, I thought it might do some good, but I’d love to know what you think. Please send me an email with your thoughts. Risk and security managers are often faced with the difficult task of defending the success of a risk management program with little or no supporting evidence. Ironically, the more successful a risk management program is, the less evidence there can be to demonstrate its effectiveness. So this success actually increases the perception that the program is unnecessary: after all, why have an expensive security program when you have few, if any, significant incidents? ...

Change is hard, and the transition from ‘peacetime’ to crisis is one of the hardest. Facing the spread of COVID-19, that’s where many of us find ourselves today: struggling to adjust to the reality of what we are facing. That might be personally, within your family, or at an organizational level. However, I can’t think of anywhere that’s going to escape this contagion so, no matter the level, we all have to transition and the faster, the better. ...

By now, you will probably have picked up that I enjoy a good old risk assessment. However, there are times when you don’t need a risk assessment to figure out what to prioritize. When something’s staring you in the face, it’s time to take action. So when a real crisis hits, the time for the risk assessment is over. So is the time to ‘wait and see.’ So is the time for asking, ‘why me?’ ...

In David McKee’s book for children ‘Not Now Bernard’, a young boy tries to warn his parents about a monster in the yard, but they’re too busy to pay attention. All they say is ‘not now Bernard’ and ignore him. In the end, the monster eats Bernard and moves into the house, but his parents are still too busy to notice. Look Out, Bernard! Illustration by David McKee I don’t think the author meant this to be a homily about risk management, but this will be a familiar refrain if you’re a risk manager. The slot for the update on the risk register gets pushed to one side. Or your data is dismissed out of hand because someone doesn’t like what they’re hearing. Or you simply get shouted down. ...

You need to fix a fatal assumption Most organizations and groups have contingency plans in place for when things go wrong. So do many families and individuals. They’ve spent the time thinking about what to do if someone gets sick, a product launch fails, a vehicle crashes, or there’s a fire. The problem is that most of these plans will fail because they’re based on a completely false and unrealistic assumption. ...