We’re learning a hard lesson about the value of having a programs for Business Continuity and even Risk Management and Cyber Security. When this is over, these will be – or should be - a major focus in your due diligence for suppliers, vendors, counter-parties and other organizations of interest. As stewards of your enterprises, you have a vested interest in ensuring that you only do business with those with current and effective programs. Conversely, they have a vested interest in convincing you that they do… whether they have programs or not. As someone who has been on both sides of the assessment process, I can tell you that some companies gloss over, dissemble or even flat-out lie about their Business Continuity, Risk Management or Cyber programs. Here are some tips to make that harder and cut through the flash and noise to understand – really understand – your counter-party risk! [Just substitute Risk Management or Cyber Security for Business Continuity when reading the below - the concepts still apply!]

1. Don’t take Yes for an answer. Ask open-ended questions. Asked “Do you have a Business Continuity Plan, most will say “Sure!” Ask who is in charge of it – an actual name. Don’t ask “Do you do testing?” Ask “When was the date of the last test? What type of test?” Ask “When was the date of the last Steering Committee meeting?” If they talk about an alternate work location (yes, in this post-COVID regime they still might be necessary), ask when the contract expires and the date of last occupancy for test or actual use.
2. Don’t take No for an answer either. Many orgs will offer their slick PowerPoint or PDF piece about how good their Business Continuity Program is. That’s not the plan – that’s talking about the plan. You want to see The Plan! Most orgs will counter your request to see plan documentation with “Sorry, it’s proprietary or confidential”. Some of that is legitimate – companies do not want to expose employee personal info or security-related data. Many do not trust where the documents will go. But some companies, frankly, hide behind this. There are ways around the objections. Execute Non-Disclosure Agreements (NDA’s) to make them feel at ease. Ask them to share via Zoom or similar. Ask to see subsets of the documentation. In some cases, I’ve flown to a site and examined plan documentation physically under their watchful view, kind of like government SCIF space. But do not settle for documents ABOUT the program – look for the documents that COMPRISE the program Another tip: ask to see, via Zoom or otherwise, the folders or SharePoint sites containing the documents. Look for last-modified dates: are they all yesterday same time? Ask to be shown the revision history, either on the page or the control block within the documentation (sign of a properly-maintained program).
3. Peek under the cover. Many enterprises only share the glossy PDF or PowerPoint that describes how robust and effective their program is. For me, that’s a yellow flag. Use that as a starting point, but don’t stop there. Ask to see the actual plan accouterments – not only the plan docs but the educational material, Steerco meeting minutes, Awareness material, issue logs, etc. Pick out some of the cool things they talk about and ask for the evidence
4. Tick each box. A proper Business Continuity Plan will address the essential elements of a program:
   
   Alternate Work Modes: what’s the strategy for contingency-mode operations
   
   Teams: established roles and responsibilities, with backups at least two deep and preferably three, with everybody knowing their part
   
   Communications: how to rally teams, get the word out, ensure employee safety and productivity
   
   Plans: actionable checklists with relevant and only relevant content, backed up, available to parties of responsibility
   
   Trained Employees: awareness and education driving adoption of the program and assuring competence and confidence no matter how people fit in, and exercise results.
   
   Ask to see each element in writing
   
   
5. Ride along. The best way to do due diligence is to watch it in action and be a part of it. Offer to your critical counter-parties your services and participation. Don’t ask, offer it. You can not only get the evidence that their plan does at least exist, but you’ll be testing how the communications and operational circuits flow between you and them. Best practice that I’ve observed was an Internet retailer who drove down Operations risk by dual-source supply of critical services, requiring the them to write a joint Business Continuity Plan to address cooperation between competitors and failover/failback, then facilitated a three-party exercise with both providers and them as customer.

Due diligence can be a rubber stamp, or it can be a valuable Risk Management tool to ensure your own organization’s resiliency.

The choice is up to you.


​

Not going to pick apart the many competing viewpoints, second-guess politicians and experts who (to be charitable) are learning as they go, or take sides for or against the anti-lock-down protests. Risk Management should not be political. Instead, I’d like to focus on why we’re continuing to get it wrong, and it’s not due to political agenda or ideology. It’s due to the cognitive biases we’re all subject to.

I’ve spoken on the Psychology of Risk at executive venues across four continents. The headline is that as global risks are getting bigger and more frequent, our ability to see risk is impaired by cognitive biases and psychological flaws – in other words, we are Built to Be Blind to Risk. The easiest one to understand is the Gambler’s Fallacy – the belief that if the roulette wheel throws five reds then black is ‘due’. It’s not – past events don’t impact present probability – yet casinos get rich.

COVID responses across governments have been fast and robust, but they have come with a price. The economic damage has been severe, not to mention the curtailment of many rights that we took for granted (at least in the US). As we learn more, and as our measures have taken the desired affect of “flattening the curve”, one would conclude that the measures can be fine-tuned to optimize and minimize the overall damage. But they haven’t been. Why? We now see three Cognitive Biases in play as our leaders struggle to understand and manage the risk.

Availability Bias
Availability Bias is the tendency to over-weight risks that are emotionally available. Two examples are child abductions and airline crashes. When these happen, they are in the headlines, they are stark and scary, and we look at them in fear. In reality, controlling for custody cases and gang activity, the chances of your child being abducted are infinitesimally small. Similarly, airline crash odds range from 0.0000185% to 0.0000091%, and more people walk away than we think.

COVID causes death. Lock-downs and forced unemployment also cause deaths. Deaths from stress-induced coronary problems, depression, suicide, alcohol and drug abuse, spousal/child abuse etc. are well known, measurable and documented in such sources as The Lancet, The National Bureau of Economic Research and Social Science and Medicine. Lock-down-related deaths might surpass deaths from the virus, but they are not emotionally available. Are our leaders talking about both? Nope.

Zero-Risk Bias
Zero-Risk Bias is the subconscious tendency to favor complete reduction of one risk over a greater net reduction across multiple risks. People, without realizing it, might take action to gain a five-point reduction of risk in one area while failing to realize that they could take small actions across several areas to gain a six-point reduction. Part of this stems from the difficulty of thinking multi-dimensionally. Part also stems from people’s subconscious need to cling to a totem in times of trouble.

All of our responses to date have been focused in reducing risk from a single source – COVID. The calls to reopen businesses are being met with much emotional resistance. “Lives Will Be Lost!” comes the call. Even if focusing on optimizing responses to minimize COVID deaths (which will not soon be completely eliminated) and deaths from other causes (see paragraph above) results in more net lives saved, people have difficulty seeing it.

Changing the Goal Posts
We humans suffer from an inherent emotional inertia. It is difficult to move past a position once we’ve anchored on it – think “deer in the headlines”. The crisis has forced us to temporarily adopt drastic and emotional measures, and in many cases, they have become larger than life. “Stay At Home!” and “Don’t Do Non-Essential Things!” are the new mantras. These mantras have shifted from being the means to a goal to being the goal itself. Many leaders are seeing the success of Stay At Home and Don’t Do Non-Essential Things and have become anchored to them. This has resulted in a reluctance to move off of this position when the original goal has been met; and, indeed, to double down when stressed. In many cases, the mantra of Don’t Do Non-Essential Things have moved leaders to take such measures as banning sales of garden seed and clothing; the mantra of Stay At Home has resulted in people being arrested for walking or taking their child to a park. In other cases, leaders are reluctant to move past the mantras when the “curve has been flattened”, the reaction has been “But the measures are working! We must continue to lower the death toll!”. That was not the goal. See? “Flatten The Curve” has become “Lower Deaths” has become “Just Stay At Home”.

The Way Forward: Multi-dimensional Risk Management
How do we get out of this endless loop? The answer is to think in several dimensions.

One dimension is to stop confusing the means with the end. If the means is “social distance, masks, sanitation”, then any business that can take these measures should be allowed to operate. What’s good for Costco should be good for Mike’s Bicycle Shop, given that the foot traffic at Costco is exponentially greater (therefore greater risk) than the foot traffic at Mike’s, and especially given that Mike has to feed his family. If a landscaper can adhere to the measures and still push a lawn mower around his customer’s yard by himself, then let him earn the bread for his table. The authorities should take themselves out of the position of picking what’s ‘essential’ – publish the measures and get out of the way, sanction those who can’t/won’t comply, be them Costco, Mike’s or the landscaper.

Another dimension is to stop the myopic focus on COVID as the sole enemy. Savvy leaders can optimize both COVID and economic harm and reduce total deaths. A job can be as effective a cure for death as a vaccine. Let’s focus on both.

Finally, let’s start to take a risk management approach. It’s called Risk Management not Risk Elimination. Not only can we not completely eliminate COVID death, it’s a fool’s errand to think we can. That might sound cruel and heartless (there’s that emotion again!), but public policy has always been based on balancing risk. The speed limits on our freeways are not 5mph because we accept that we cannot – and should not – view death reduction as the only element, and there’s a cost that comes with risk reduction.

Let’s get to Managing this Risk!