William Sandover, Special Advisor, Risk Advisory Group • October, 2018
A few years ago I was invited to chair a session on resilience and contingency planning at a conference of oil industry travel buyers in Texas. So I thought I should come up with an easy and memorable definition, which in the end I formulated as
Keeping going when things get hotter and
Getting out before things get too hot
I used somewhat more oil industry language…. and should have added
Knowing what you do if you do not mange to do the second.
It will be apparent that there are two components to this process. The first is information and analysis so that you are able to assess the local temperature and – equally important – when it might be about to change. The second is having plans ready to deal with – and preferably anticipate – a change in temperature.
In a previous job, my role was to monitor the world and track events which could have an impact on the company’s operation and people. To help in this process, and to help prepare top management for things that might go wrong, I developed a system of dual scores for the places in which the company operated.
Most organisations that have a threat and risk analysis capability tend only to score the current situation (although they may well have “what could go wrong” scenarios in the back of their minds). What we did was to create a second score based on what might happen over the coming six months. I will not claim that the “might” was rigorously scientific; rather it was something like “reasonable chance of something happening”. So pure black swans are not included – although most black swans seem to look rather greyer when they have flown past.
The first of the two scores drives an organisation’s current security and safety arrangements and advice to its employees. The second leads to having in place, or having plans to put into place at very short notice, arrangements that “harden” the operation so that it can continue to operate if or when things do get hotter, and contingency plans for, e.g. evacuating staff if they get hotter still.
The CEO will, of course, hate having to pay for things (satellite phones, contracts with security companies) that might well never be needed but having these arrangements in place not only enables you to keep operating when others are getting out, it also enables you to satisfy your duty of care to your staff and avoid potential civil and criminal liabilities (“You mean to tell this court that your organisation thought that the risk of ……. breaking out was so low that you could send people there without taking any measures?”). CEOs and CFOs probably resent paying for lifeboats on cruise ships……
In most cases, the two scores are not likely to be markedly different: the country concerned is already quite risky and the situation could deteriorate further. In other cases the scores might be significantly different – an otherwise safe environment at risk of a conflict breaking out with its neighbour. In the former case, current arrangements may be elastic enough to cope with a worsening environment. But in the latter case they almost certainly won’t.
So how do you go about getting the required degree of foresight? It may be enough to rely on the press and internet news sources. But for many places, coverage is scanty and not necessarily reliable. And what maybe newsworthy may not necessarily be important to your operation. In which case you may need to employ, or buy in, a greater capability. Remember: duty of care requires you to take measures against reasonably foreseeable occurrences – an objective test and not what you might think might happen.
William Sandover is Special Advisor, Intelligence and Analysis, at the Risk Advisory Group.