Major risks and threats will always exist, and plans must be in place to address them. However, the ability to maintain and manage the fundamentals and ongoing operational activities – and the minor risks to them – often becomes more important on a day-to-day and routine basis, as Phillip Wood explains in detail.
We seem to be living more and more in a world of extremes where there’s little or no middle ground between polar opposites of thought, opinion or, indeed, business approach.
The European Union – either we’re ‘In’ or ‘Out’. Government – you’re either with David Cameron or Jeremy Corbyn, while the moderates of any political hue are effectively grey and non-influential.
We invest time, effort, money and thought in causes and ideas, or we don’t, while the majority of those in the middle and at the less high profile, noisy and attention-attracting ends of the scale tend to miss out.
My view is that, in terms of organisational resilience, the middle is where it’s at. If we take a more considered look at what’s out there and what the emerged and emerging risks and their potentials may be then the majority are in the ‘Don’t panic’ range: constantly there and less well noticed until they happen or the impact becomes huge. Then we ‘go all extreme’ and begin to chase shadows and dreams in our hurried and perhaps belated efforts to reduce risks to their normal levels.
We can examine any number of examples of where this idea can be applied and is eminently applicable. Almost without exception, there are no Black Swans, few Eyjafjallajokulls and not many meteors smashing into us from outer space. I’ve lost count of the Deepwater Horizon and 9/11 references in discussions about what could happen to businesses.
In the world of cyber, we constantly hear about TalkTalk (that’s ‘recency’, whereby what happened most recently seems to be the most impactful or serious of episodes).
Such occurrences do happen. They’re big and nasty and sometimes they lead to major change. We remember them because they render big pictures as well as notable headlines and are large-scale in impact, but what about the small impacts and their effects? You know, the unnoticed blips and bumps that are ‘the everyday’? The aspects of life that don’t stop us, but don’t let us move ahead as effectively as we would perhaps like?
The everyday issues – the ‘grey’ events that we and our teams somehow manage to circumvent, overcome one way or another and work around – are the energy sappers. These are the business disablers. When they’re not managed properly, they can be exploited by those who wish to compete against us or may wish to cause us harm.
Expenditure of effort
Clearly, there’s another viewpoint take on all of this. We could say, and perhaps agree in some part, that if we’re managing to put in place workarounds and other ad hoc fixes for problems that arise, then we are indeed managing the problem, but what about the expenditure of effort that’s required just to keep moving in the right direction?
At this point, a sporting Case Study may be useful. A fairly long time ago now, Clive Woodward – then coach of the England rugby union team who would become a Sir in 2004 – took over a national side that wasn’t performing to its best, although it had good strategic management structures in place as well as some good people. Woodward decided that he was going to make some improvements, but what he didn’t do is consider extremes.
For him, changing the whole team wasn’t an option. He knew that he couldn’t influence the external environment (in this case the sporting opposition), and he also knew that he was working within a rigid and quite constrained management structure. These were ‘the big things’ and areas of huge profile that he knew he had to stay away from.
Woodward’s plan was a percentage game. In his book ‘Winning’ he explained that, given the aforementioned constraints, the best team would not be the one that improved by 100% in large, extreme bounds, but rather the one that did the small and almost all things 1% better in one hundred instances.
When applying such logic to the way in which we can run our organisations, in the way that we manage risks and in the manner that we address all of the aspects of our businesses to ensure we remain able to ‘survive and thrive’, it’s not a bad operating philosophy to follow.
The major risks and threats with their varying degrees of low probability, high impact contributing factors will always exist, and we need to have plans in place for them. However, the ability to maintain and manage the fundamentals and the ongoing operational activities – and the minor risks to them – becomes more important on a day-to-day and routine basis. We can apply this logic to every aspect of organisational resilience, including all elements of security from physical to virtual and on to crisis management and emergency management, of course, as well as to the one that most people seem to confuse themselves about a great deal: business continuity.
Thinking Clearly Under Pressure
While on the subject of Sir Clive Woodward and his managerial outlook, there was another good idea that probably gave him the additional 1% to allow his team to stand out above all others (albeit only for a brief period of time). He called it T-CUP: Thinking Clearly Under Pressure.
We probably all like to think that we’re good at this, and I’ve no doubt some of us are. However, for the majority it’s something that needs to be hard-earned through experience and concentrated effort. Thinking clearly under pressure means that, whether the things that happen to us are extreme (and thus drive a labour-intensive response) or more along the lines of the smaller, but potentially important small things, we can ease our pain.
Clarity of thought – and, therefore, clarity of action – will make the difference between poor planning/planning for planning’s sake and the ability to execute any plan or organisational response to incidents and issues effectively.
Sir Clive’s team used to train for that. He would always ensure that his players were as physically fit as possible so that they weren’t distracted by their own lack of fitness in their ability to think under pressure, and particularly so in the final and decisive elements of a physical and exhausting match. By default, those players were in a higher state of mental alertness and enhanced calm.
Those of you reading this who are not into sport have probably tuned out by now. That would be a shame, though, because what I’m really talking about here is mental and physical preparation for events and issues that may arise. This is applicable to all of us because, if you’re reading and/or contributing to Risk UK then you have an interest in the management of risk and its associated disciplines.
If you’re unable to recognise the small as well as the large issues, and make improvements to your organisation to manage and control them, and if you haven’t planned, trained and exercised to counter them, then you’re effectively unprepared.
Changing the culture within
Regardless of whether the issue is large or small, the impact could be the same. Just as importantly as recognising that this is an issue, it may be a good idea to recognise that you and your organisation have the power to improve significantly because you can orientate and change your culture and behaviours to meet the challenges of the mundane and the extreme.
It might be a good idea to look at your current organisational orientation, its plans and the way it does things. Are you prepared for everything? Probably not, and it would be unreasonable to expect that to be the case. Are you able to deal with the large and the small, and do you think that your people – including your leaders, managers and operators – are able to think clearly under pressure? Most importantly, how do you know?
Whether the perception within your organisation is that it cannot happen to you, that the issues that may affect you are too large and too ‘hot’ to consider, or whether you feel there’s not an adequate and appropriate culture in place to deal with and manage episodes that may arise, it’s incumbent upon you and your organisation to deal with and manage them.
If you cannot do so, you risk your bottom line or your ability to realise the service that you’re committed to providing. Your organisation can then be perceived to be unreliable or otherwise untrustworthy and irrelevant. That isn’t good.
We absolutely need to consider the whole organisation, and think about how we can make it more capable and effective without wholesale Draconian activity.
Phillip Wood MBE MSc is Head of the School for Management and Professional Studies and Head of Department for Security and Resilience at Buckinghamshire New University