Resilient Thinking

Protecting Organisations in the 21st Century

Philip Wood

• Publisher: IT Governance Ltd
• Year: 2012
• eBook ISBN: 9781849284356
• Topic: Computer Science
• Subtopic: System Administration
• Index: Computer Science

In Resilient Thinking, Phillip Wood discusses the importance of thinking laterally about potential impacts on your organisation and examines a new approach to resilience management. As you read this book you will learn how to recognise potential risks and threats, put cost-effective and workable plans into place and minimise the impact of an incident.

CHAPTER 1: THE SPAGHETTI BOWL OF RESILIENCE

In this introductory chapter, we will have a look at the idea of resilience as a tricky subject, the influence of people, and the concept of planning. We will also consider the idea of resilience as a whole formed of various components.

The secret art

Let’s face it, not only is the world difficult and dangerous, it’s also cut-throat and competitive. The resilience industry is no less a warzone than any other, and competition and jockeying for position are understandably common. What is interesting to me is that resilience professionals and practitioners – business continuity, security and safety managers, for example – although they often look on each other with a degree of disdain, are more often than not cut from the same cloth. Let’s see if you recognise this profile: male, middle-aged, ex-police or military, officious and practising their own ‘secret art’. These types, who have now been joined by the ‘IT crowd’, seem to be quite adept at building a false mystique around simple principles, and as we forge ahead through the book, hopefully you’ll begin to recognise the fact that there is no reason or substance behind taking this approach.

And here, it’s useful to start our journey together with some clarity – there are many strands to resilience, but it isn’t complicated. There is a lot to do when an incident occurs, but the whole thing doesn’t have to be difficult. And the resilience ‘professional’, who jealously guards plans and supporting information and revels in the ‘I-know-something-you-don’t’ approach, is, quite frankly, a waste of money. Your organisation deserves better than that, and the individuals who may suffer because of that approach certainly do. Resilience, with its complicated systems, procedures and terminology, is a refuge for the ‘Sir Humphreys’¹ of this world.

So, in starting from the start and before we move into the detail of resilience and turn to the discovery of the magic formula for saving your organisation, let’s try to pull the rug from under the feet of the ‘Humphreys’ and try to establish some assumptions about resilience and its components. It’s probably quite fundamental that from this point we at least understand in our own minds what the various elements of resilience actually are, because once we know what we’re talking about then perhaps we can go ahead and figure out how to go about saving your business. It’s a useful exercise to try to unravel the spaghetti bowl of resilience and straighten out the tangles.

One of the sad facts of life is that modern organisations must operate in the context, and against a background, of problems, events and trends which have the potential to develop into significant safety, security and continuity threats. These threats, some of which may have been in existence for a considerable time, and others, which have been the more recent result of either malicious human intent or omissions, have the potential to combine and to link together and to have a consolidated impact which could be far more serious and far-reaching than if they were to occur in isolation, either temporally or geographically. Organisations, big or small, public or privately owned and run, must be able to deal effectively with the range of potential threats which can materialise and cause ‘business’ failure. The organisation has to learn to become resilient – to protect itself, to absorb shocks and survive and capitalise on any opportunities that may arise – because, in simple terms, those that cannot achieve that happy state will fail sooner or later.

Moreover, this is a multilevel issue. Not only can threats have adverse effects on individual organisations, groups of businesses and other enterprise organisations, but also they can become risks with impact at local, national and international strategic levels. Further down the line, consequential or later impacts of risks have the potential to spread beyond initial points of protection failure and even to change in effect as they move onwards and develop from where they hit originally. Therefore, it is important to recognise and act upon such threats before they become too difficult to manage, control and mitigate. Small fires can become raging infernos if all the conditions for growth are there.

Challenges and silos

Although it should be all-encompassing for a business, resilience professionals, in particular, have a crucial role to play in limiting the effects of threats upon their organisations. A considered and forward-looking resilience management process, with realistic and flexible mitigation planning, will provide an organisation with the ability to evaluate risks and to put in place effective countermeasures and associated processes and procedures. However, in a results-oriented environment where the focus rests on maintaining profitability, this can be a challenging process. If managers are overly focused on pure response processes and in putting in place measures which are localised and reactive, they may miss what lies over the horizon. And, although it is understandable to deal with local losses in the ‘here and now’, if managers fail to engage with, or to consider the effects of, current or forthcoming threats because they consider them to be outside their area of concern, then there is a risk of vulnerability to partially self-inflicted failures. That should not be what we are about at all!

Within any planning ‘suite’ or set of components (resilience-related or not) there will be various elements which have traditionally been the responsibility of separate departments or managers. This type of division, known as ‘stove-piping’ or ‘silo management’, has managed to keep apart activities which should perhaps be merged or, at least, complement one another. And this in turn may have a consequent detrimental effect on response capability, particularly if there are ‘gaps’ in coverage, either by omission or in ignorance. Omission and ignorance are dangerous for resilience professionals and practitioners; as we go along, we will discuss how we can apply thought and action to reduce omissions and avoid the pitfalls of ignorance.

Figure 1: Simple silos

This is a silo organisation. Silos 1 to 5, and there can be many more, represent the various organisational functions. For example, they could be:

• Silo 1 – Finance
• Silo 2 – Operations
• Silo 3 – Human Resources
• Silo 4 – IT
• Silo 5 – Security

In silo organisations, each separate area concentrates on its own world of activity and the points of interaction that often matter the most to them are those with the people at the top of the organisation. This is understandable. However, the problems caused by an introspective approach, such as this, can be significant. To make the organisation coherent and to reduce overlaps, overspends, misunderstanding and miscalculations, the components of the organisation should consult and consider the links and areas of potential duplication or failure.

To help us to begin from a basis of understanding what we need to overcome, we should think about the idea that, although silo activity is well recognised by most people, it remains prevalent even in progressive organisations, and is often the result of some relatively prosaic and simple human, rather than organisational, traits. People are problematic in silos and here are some thoughts about the reasons:

Figure 2: People problems

Often, not always but definitely often, silo working is negative and a bad thing. Because of this, many progressive organisations recognise the fact that blended and dynamic operational requirements (and risks) should lead to a blended and dynamic response, and the more forward-thinking of them have attempted or have managed to reconstruct their existing silos and associated behavioural and organisational norms into integrated functions. Such planning will incorporate all functions in a merged manner in order to provide not only business efficiencies, but also a concerted and reliable response, and ensure business survival. In a resilience context there is an absolute need to ensure survival by identifying where the areas of incoherency, mismatch and potential protection and resilience failure may arise, and by planning to ensure that the subsequent risks are minimised to acceptable levels. Avoiding and countering the fixed mindsets that keep silo thinkers happy and comfortable (we’ll come to checklisters later) is crucially important for the development of effective, flexible and dynamic protection, which in itself is essential to meet the equally flexible and dynamic threats, risks and impacts that we face.

Some thoughts on resilience planning

Thanks for reading, by the way, and I am really pleased that you are here. You could have chosen to read one of the very many textbooks available which give you a good outline of definitions and allow you to build a comprehensive dictionary of words with which you can then populate your resilience plans. There’s absolutely no problem with this; some people need checklists and some people don’t. However, you are not going to get any definitions in this book; what we are really going to look at is what you understand by resilience and what you can do to apply your understanding in the workplace – as a normal routine and in the event of something bad happening. More importantly, in fact fundamentally, we are going to ignore the constraints that defining things places on our minds and try to consider our own thoughts rather than someone else’s. If you really, really want the easy option that plagiarising an Internet-sourced checklist can give to you, go ahead and search them out. Hopefully you’ll come back to thinking later.

As far as my understanding goes, I think of resilience planning as being ready and prepared for something to happen, and as then having thought about and prepared ideas for response and recovery. That’s my understanding, but it might not be yours, which is fine. Ideas for absorbing shocks and bouncing back are what we need to develop. Further to that, it is also a good thing to consider putting your carefully sculpted final thoughts in some kind of recorded document – electronic or even on paper – and then ensuring that what you’ve spent so much time and effort over is provided to the people who need it. That means that they will then be able to use it, which will then make it useful.

That’s all good so far, but what we also need to do is consider ensuring that people who have the plans, and are included in them, actually read them. This can be quite a challenge and we will talk about this (and people in general) a little later. Going a stage further, even if they have read your fantastic plans, the next thing we need to think about is ensuring that they understand them and making sure that the plans can be made to work in the event of something bad happening. If you do all of these things in isolation (some things don’t follow automatically from others in some organisations) then all you’ve done is loosely combine some components of the whole process. These components need to be brought together closely and you need to ensure that any gaps between them are filled, meaning that there will be no opportunity for any undesired event to cause you any deeper trouble than you may have already.

If you want to get people to understand, it may help to develop some clarity. You can call what you do risk management, continuity planning, incident management, disaster recovery, contingency planning, crisis management – whatever you like; feel free. It doesn’t really matter what you call ‘it’, as long as you and your people understand it and what it means to you. It is a lot more difficult to unravel the spaghetti bowl of resilience when you don’t really understand what the ingredients are. It seems to me that there are a lot of people who try to keep the ingredients of resilience secret or try to confuse issues with different and little-known flavourings. There are a lot of people who, again and again, reuse the same recipe that was particularly well received on just one occasion. Some even try the ready-meal microwave short cut, or order in a takeaway. It may be worth thinking about the idea that, as with all recipes, the best ones have the simplest ingredients, but need care and a little expertise in preparation to impress the consumer.

Moving away from the food metaphors, but to underline the idea, it’s my opinion that the secret of good planning and, therefore, a good response is simplicity. If you can get to the root of the problems that may face you, and can then devise simple but effective responses and recovery options, then it is a good bet that these options will be effective. Being complicated just for the sake of it will benefit nobody; in fact it will probably make most of your workforce lose interest and have wider and deeper negative effects. So, let’s move forward and see what we can do to put in place resilience that will work, will suit your organisation and will help you to meet the problems that lurk over the horizon.

Parts of the whole

If you do want to unravel the spaghetti, it’s in your best interests to plan and organise things that can be understood and acted upon. Effective planning should concentrate on a clear process frame which can be flexed to manage dynamic impacts and will allow any incident or risk to reach successful resolution. Thus, flexibility in management will complement and enhance effective planning. By combining the various elements well, effective management aims to allow an organisation to maintain functionality, and it should be sustainable and realistic. Organisations should, thus, use any and all varied and appropriate methods at their disposal to plan and deal with incidents. So, if we are going to get anywhere, we should perhaps assume that resilience planning and measures should incorporate all of the risk, incident, emergency, crisis, business continuity and disaster recovery functions – all on their merits and as contributors to improving survivability.

Now, I will concede that there are some people who will really disagree with this, who will think that we should separate everything out and that all the component parts of resilience should be different and dealt with separately. Good for them; but in reality, and with an enlightened view to support it, effective planning will aim to provide a studied and informed blend of the various component elements, ensuring that you have an agile and appropriate response to incidents. It’s worthwhile remembering here that some problems may not happen quickly, they may develop over a long period of time. In fact, you might not even see them coming. Therefore, the agility of thought that we are talking about and the ability to navigate comfortably and confidently between the various component elements becomes even more important. You need to be able to flex your response to the dynamics of problems that may arise. And you can’t sit by and watch it all happen either.

Spectators, who are prepared to allow things to happen and develop around, over, behind and in spite of them, will find themselves looking uselessly at events that will rapidly become uncontrollable. It is one of the big and repeated lessons from history – think about it for a moment – that, without fail, prevarication and late intervention lead to bad things becoming worse. And if we work on the principle that history can and will repeat itself for eternity, if you are responsible for putting in place intervention, protection, prevention and resilience, and if you fail to meet your responsibility, pain and sorrow will be heading in your direction.

Hopefully now it is becoming quite obvious that, with the aim of pr...

Table of contents

• Cover
• Title
• Copyright
• Preface
• Abouttheauthor
• Acknowledgements
• Contents
• Introduction
• Chapter 1: The Spaghetti Bowl of Resilience
• Chapter 2: Looking for What’s Coming over the Hill
• Chapter 3: Is Your Business Prepared? Are You Prepared?
• Chapter 4: Breaking Free from Conventional Thought
• Chapter 5: Problems and Responses
• Chapter 6: Case Study
• ITG Resources