Productive Paranoia and - corporater.com · Productive Paranoia and Business Continuity interdependencies between risks within the organization. The scenario-building practices utilized

Business Continuity

ARTICLE

ProductiveParanoia and

Owe Lie-Bjelland, Director - Program Management, GPRC

Jonas Mentzsen Nesbø, Consultant – Global Program Management, GPRC

https://corporater.com/en/?utm_source=pdf&utm_medium=article&utm_term=bcm&cmc=pdf_bcm_index

The Corona pandemic has impacted us all. Organizations are experiencing a crisis due to loss of revenue caused by disruptions to their supply chains, markets or delivery capabilities. Business leaders are increasingly turning to operations, risk, finance and IT, asking for business impact analyses, continuity plans and crisis management. While business continuity management is common practice within some industries, to many it is a novel practice which seemed too costly or unnecessary just a few months ago. With a chorus of voices seeking to understand, adapt and learn from the Corona pandemic, a common question appears to be; could we, or should we have seen it coming? For companies seeking to improve their resilience, this is the wrong question to ask.

INTRODUCTION

Mr. James C. “Jim” Collins, is an American researcher, author, speaker, and consultant focused on the subject of business management, company sustainability, and company growth. He has conducted some brilliant research published across several books such as “How the mighty fall,” “Good to Great,” “Built to Last,” and “Great by Choice.” In the latter title, he and his co-author, Mr. Morten Hansen, present their research that involves 20,400 companies and a set of tests to identify high-performers and uncover the recipe to become one. Their research uncovered that 7 of

them not only slightly beat their competitors. 7 of the 20,400 were labeled “10X’ers”. They really thrived. Every 10X case beat its industry index by 10X or more. What were the common denominators for such a success?

PRODUCTIVE PARANOIA

In his book, he illustrates his findings by telling the story of Mr. Roald Amundsen and Mr. Robert Falcon Scott and their race to the South Pole in 1911. Both expedition leaders had the same ambition, comparable experiences, and their preconditions was a nearly perfect match. However, a long story cut short (Spoiler alert! Read the book, it’s highly recommended. At least, read his article)(i), Amundsen led his team to victory and safety while Scott led his team to defeat and death. Mr. Collins and Hansen are explaining the vital ingredients to turn ambition into reality – your ambition of a successful company that will thrive 10X compared to your competitors and survive any scenario.

“Business Continuity

Management is a natural extension of a risk

management system – the moredigitally

integrated your different risk domains are,

the easier it is to create a

holistic BCM program.”

1

To successfully achieve yourambition, Mr. Collins identified, among other things, three principles; “Fanatic Discipline,”“Empirical Creativity,” and “Productive Paranoia. According to Mr. Collins, part ofthe answer lies in the behaviors of our leaders. Mr. Amundsen asked his team many questions starting with the words, “what if.” To him, the importance ofhaving a plan B, a plan C, and even a plan D for a range ofdifferent scenarios were vital. Mr. Amundsen systematicallybuilt enormous buffers forunforeseen events;

When setting supply depots, Amundsen not only flagged a primary depot, he placed 20 black pennants (easy to see against the white snow) in precise increments for miles on either side, giving himself a target more than ten kilometers wide in case he got slightly offcourse coming back in a storm. To accelerate segments of his

return journey, he marked his path every quarter of a mile with packing-case remnants and every eight miles with black flags hoisted upon bamboo poles. Scott, in contrast, put a single flag on his primary depot and left no markings on his path, leaving him exposed to catastrophe ifhe went even a bit off course. Amundsen stored three tons ofsupplies for 5 men starting out versus Scott’s one ton for 17 men. In his final push for the South Pole from 82 degrees, Amundsen carried enough extra supplies to miss everysingle depot and still have enough left over to go anotherhundred miles. Scott ran everything dangerously close to his calculations, so that missing even one supply depot would bring disaster. A single detail aptly highlights the difference in their approaches: Scott brought one thermometer for a keyaltitude-measurement device, and he exploded in

“an outburst of wrath and consequence” when it broke; Amundsen brought four such thermometers to cover foraccidents.(ii)

Amundsen and his team returned to home base the exact day they planned. Scott never returned. Eight months later, the frozen bodies ofScott and two of his team companions were found; just 12.5 miles short of his last supply depot.

The fascinating story ofAmundsen and Scott is a motivating illustration of governance, risk and  compliance (GRC). The part we’re focusing on in this blog is about Risk Managementand its sister-discipline; Business ContinuityManagement and Resilience.

Legislators have since the financial crisis in 2008 adopted regulations for Banking &

Finance to ensure resilience in the market in case ofunforeseen events, even systematic unexpected events. Some organizations have adopted best-practice Business Continuity Management (BCM)to ensure resilience in such circumstances. However, manyorganizations lack the capabilityof BCM and, unfortunately, are suffering in this situation.

BLACK OR GREY SWANS

Many will argue that the pandemic caused by the Corona pandemic could not be predicted, and will classify it as a “black swan.” Politico Magazine posted an article(iv) recentlywhere they claim to have predicted a pandemic, and that policymakers could have seen it coming. In light of this article, the Corona-pandemic will be classified as a “grey swan,”maybe even a white one. An interesting observation when looking back at the SARS outbreak in 2003, is that the outbreak came in at least two waves(v) with two months apart. Are we prepared for anotherwave of the Corona pandemic? These are examples of what Mr. Jim Collins refers to as “Productive Paranoia.” And, just a personal comment – in risk terms, isn’t a pandemic an epidemic that comes with a lead time? And, vice versa, an epidemic is a KRI for a pandemic? That said, we would argue that in the aftermath of a “swan”, its color does not matter. What matters is whether the business was able to handle the consequences, and what it could do to improve its resilience. What makes some

companies different is thatthey account for one black, some grey, and many white swans to appear during a period – they plan for it – and they learn from it.

BCM IS NOT BETTER THAN THE SCENARIOS PLANNED FOR, OR?

Where Risk Management is focused on mitigating the risks posed by ‘known unknowns’, Business ContinuityManagement is focused on organizational resilience in the face of business disruptions. However, while the approaches of Risk Management and Business Continuity Management differ, the information required forstrategic decision making within these disciplines is similar. What are the elements that the business relies on? What are the assets and processes that generate value?

A common critique of BCM programs is that they will onlywork for scenarios that have been accounted for, but this confuses the central aim ofBCM; preparedness, with prediction. Amundsen did not try to predict what he would face on his journey, instead he planned for unexpected events that would impact his food supply, travel time, abilityto navigate and other crucial elements of his journey. Likewise, BCM seeks to identify the components ofthe business crucial to its success and build buffers to ensure resilience in case

unexpected events cause a deviation from ‘business as usual’. As with risk management, the purpose of a BCM program is to mitigate as much of the impact of the unexpected as possible, balanced against risk appetite and tolerance.

VALUE OF AN INTEGRATED APPROACH

While Risk Management and BCM are sister disciplines, these two domains often live separate lives within largerorganizations. This is unfortunate, as Business Continuity Management is a natural extension of a risk management system(vi). Without a system to consolidate, aggregate and filter this information, it can result in time-consuming and redundant work. These siloed approaches also often fail to account for

Productive Paranoia and Business Continuity interdependencies between risks within the organization.

The scenario-building practices utilized in BCM programs helps organizations gain a better understanding of these dependencies, as well as identify critical components of theiroperations where it might be worthwhile to develop contingency plans. By taking such steps organizations can reduce recovery time and facilitate effective crisis management that can often be crucial in mitigatingthe impacts of business disruptions. The more digitallyintegrated your different risk domains are, the easier it is to create a holistic and cost-effective BCM program.

One of the areas where BCM really shines is its ability to capture change over time that often go missing when analyzing the probability and consequences of discrete risk

events. Even now, it appears nearly impossible to estimate the impact of the Corona pandemic. However, a series of questions have alreadyemerged that will be the source of much debate going forwards; What if certain measures had been adopted sooner? What enabled certain organizations and countries to meet this challenge more effectively than others?

We believe much of the answer lies in organizational resilience. Many were unprepared for the Corona pandemic, from businesses to governments and supranational bodies. What remains to be seen is who will learn from current events. Perhaps the most important lesson for companies seeking to build resilience is to do as Amundsen did – ask “what if’s” and build buffers forunforeseen events. Less important is the color of the swan – black, grey, or white.

BCM programs and its components also go by othernames such as “Resilience,”“Disaster Recovery,” and “Continuity Planning,”. Implementing these programs is a requirement in a variety ofregulations(vii) across industries and jurisdictions and is mandated and referenced in dozens of certification standards and best-practice frameworks(viii). Depending on whether your organization has a regulatory obligation, if your organization is seeking resilience, or a combination of the two, ISO 22301 is a well-known and recognized standard to base a holistic BCM program on(ix). Corporater is a providerof integrated software for holistic governance, performance, risk, andcompliance (GPRC). Contact Corporater or one of ourmanagement consulting partners for more information regarding Business ContinuityManagement.

The Corona pandemic has impacted us all. Organizations are experiencing a crisis due to loss of revenue caused bydisruptions to their supplychains, markets or deliverycapabilities. Business leaders are increasingly turning to operations, risk, finance and IT, asking for business impact analyses, continuity plans and crisis management. While business continuity management is common practice within some industries, to many it is a novel practice which seemed too costly or unnecessary just a few months ago. With a chorus of voices seeking to understand, adapt and learn from the Corona pandemic, a common question appears to be; could we, orshould we have seen it coming? For companies seeking to improve their resilience, this is the wrong question to ask.

INTRODUCTION

Mr. James C. “Jim” Collins, is an American researcher, author, speaker, and consultant focused on the subject ofbusiness management, companysustainability, and companygrowth. He has conducted some brilliant research published across several books such as “How the mighty fall,” “Good to Great,” “Built to Last,” and “Great by Choice.” In the latter title, he and his co-author, Mr. Morten Hansen, present their research that involves 20,400 companies and a set of tests to identifyhigh-performers and uncoverthe recipe to become one. Theirresearch uncovered that 7 of

them not only slightly beat theircompetitors. 7 of the 20,400 were labeled “10X’ers”. Theyreally thrived. Every 10X case beat its industry index by 10X or more. What were the common denominators for such a success?

PRODUCTIVE PARANOIA

In his book, he illustrates his findings by telling the story ofMr. Roald Amundsen and Mr. Robert Falcon Scott and theirrace to the South Pole in 1911. Both expedition leaders had the same ambition, comparable experiences, and theirpreconditions was a nearlyperfect match. However, a long story cut short (Spoiler alert! Read the book, it’s highlyrecommended. At least, read his article)(i), Amundsen led his team to victory and safety while Scott led his team to defeat and death. Mr. Collins and Hansen are explaining the vital ingredients to turn ambition into reality – your ambition ofa successful company that will thrive 10X compared to yourcompetitors and survive anyscenario.

To successfully achieve your ambition, Mr. Collins identified, among other things, three principles; “Fanatic Discipline,” “Empirical Creativity,” and “Productive Paranoia. According to Mr. Collins, part of the answer lies in the behaviors of our leaders. Mr. Amundsen asked his team many questions starting with the words, “what if.” To him, the importance of having a plan B, a plan C, and even a plan D for a range of different scenarios were vital. Mr. Amundsen systematically built enormous buffers for unforeseen events;

When setting supply depots, Amundsen not only flagged a primary depot, he placed 20 black pennants (easy to see against the white snow) in precise increments for miles on either side, giving himself a target more than ten kilometers wide in case he got slightly off course coming back in a storm. To accelerate segments of his

return journey, he marked his path every quarter of a mile with packing-case remnants and every eight miles with black flags hoisted upon bamboo poles. Scott, in contrast, put a single flag on his primary depot and left no markings on his path, leaving him exposed to catastrophe if he went even a bit off course. Amundsen stored three tons of supplies for 5 men starting out versus Scott’s one ton for 17 men. In his final push for the South Pole from 82 degrees, Amundsen carried enough extra supplies to miss every single depot and still have enough left over to go another hundred miles. Scott ran everything dangerously close to his calculations, so that missing even one supply depot would bring disaster. A single detail aptly highlights the difference in their approaches: Scott brought one thermometer for a key altitude-measurement device, and he exploded in

“an outburst of wrath and consequence” when it broke; Amundsen brought four such thermometers to cover for accidents.(ii)

Amundsen and his team returned to home base the exact day they planned. Scott never returned. Eight months later, the frozen bodies of Scott and two of his team companions were found; just 12.5 miles short of his last supply depot.

The fascinating story of Amundsen and Scott is a motivating illustration of governance, risk and  compliance (GRC). The part we’re focusing on in this blog is about Risk Management and its sister-discipline; Business Continuity Management and Resilience.



BLACK OR GREY SWANS









2

interdependencies between risks within the organization.





“To him, the importance of having a plan

B, a plan C, and even a plan D for a

range of different scenarios

were vital.”


https://corporater.com/en/business-solutions/risk-management/?utm_source=pdf&utm_medium=article&utm_term=rm&cmc=pdf_bcm_index


INTRODUCTION



PRODUCTIVE PARANOIA









Finance to ensure resilience in the market in case of unforeseen events, even systematic unexpected events. Some organizations have adopted best-practice Business Continuity Management (BCM) to ensure resilience in such circumstances. However, many organizations lack the capability of BCM and, unfortunately, are suffering in this situation.

BLACK OR GREY SWANS

Many will argue that the pandemic caused by the Corona pandemic could not be predicted, and will classify it as a “black swan.” Politico Magazine posted an article(iv) recently where they claim to have predicted a pandemic, and that policymakers could have seen it coming. In light of this article, the Corona-pandemic will be classified as a “grey swan,” maybe even a white one. An interesting observation when looking back at the SARS outbreak in 2003, is that the outbreak came in at least two waves(v) with two months apart. Are we prepared for another wave of the Corona pandemic? These are examples of what Mr. Jim Collins refers to as “Productive Paranoia.” And, just a personal comment – in risk terms, isn’t a pandemic an epidemic that comes with a lead time? And, vice versa, an epidemic is a KRI for a pandemic? That said, we would argue that in the aftermath of a “swan”, its color does not matter. What matters is whether the business was able to handle the consequences, and what it could do to improve its resilience. What makes some

companies different is that they account for one black, some grey, and many white swans to appear during a period – they plan for it – and they learn from it.


Where Risk Management is focused on mitigating the risks posed by ‘known unknowns’, Business Continuity Management is focused on organizational resilience in the face of business disruptions. However, while the approaches of Risk Management and Business Continuity Management differ, the information required for strategic decision making within these disciplines is similar. What are the elements that the business relies on? What are the assets and processes that generate value?

A common critique of BCM programs is that they will only work for scenarios that have been accounted for, but this confuses the central aim of BCM; preparedness, with prediction. Amundsen did not try to predict what he would face on his journey, instead he planned for unexpected events that would impact his food supply, travel time, ability to navigate and other crucial elements of his journey. Likewise, BCM seeks to identify the components of the business crucial to its success and build buffers to ensure resilience in case



While Risk Management and BCM are sister disciplines, these two domains often live separate lives within larger organizations. This is unfortunate, as Business Continuity Management is a natural extension of a risk management system(vi). Without a system to consolidate, aggregate and filter this information, it can result in time-consuming and redundant work. These siloed approaches also often fail to account for

3






“In risk terms, isn’t a

pandemic an epidemic that comes with a lead time? And, vice versa,

an epidemic is a KRI

for a pandemic?”


(iii)

https://corporater.com/en/business-solutions/risk-management/business-continuity-management-bcm-software/?utm_source=pdf&utm_medium=article&utm_term=bcm&cmc=pdf_bcm_index


INTRODUCTION



PRODUCTIVE PARANOIA










BLACK OR GREY SWANS










The scenario-building practices utilized in BCM programs helps organizations gain a better understanding of these dependencies, as well as identify critical components of their operations where it might be worthwhile to develop contingency plans. By taking such steps organizations can reduce recovery time and facilitate effective crisis management that can often be crucial in mitigatingthe impacts of business disruptions. The more digitally integrated your different risk domains are, the easier it is to create a holistic and cost-effective BCM program.


events. Even now, it appears nearly impossible to estimate the impact of the Corona pandemic. However, a series of questions have already emerged that will be the source of much debate going forwards; What if certain measures had been adopted sooner? What enabled certain organizations and countries to meet this challenge more effectively than others?

We believe much of the answer lies in organizational resilience. Many were unprepared for the Corona pandemic, from businesses to governments and supranational bodies. What remains to be seen is who will learn from current events. Perhaps the most important lesson for companies seeking to build resilience is to do as Amundsen did – ask “what if’s” and build buffers for unforeseen events. Less important is the color of the swan – black, grey, or white.

References

[i] Collins, Jim. Great by Choice (Good to Great). Harper Business. Kindle Edition.[ii] https://www.investopedia.com/terms/g/grey-swan.asp[iii] https://www.politico.com/news/magazine/2020/03/07/coronavirus-epidemic-prediction-policy-advice-121172[iv] https://www.bis.org/publ/joint17.pdf[v] E.g. ISO31000, COSO, ISO27005, NIST RMF.[vi] E.g. NCEMA 7000, BASEL, Solvency, BSA, NISD, EBA Guidelines GL 44[vii] E.g. ISO22301, COBIT, ITIL, ISO9000, ISO27001, ISO20000, IEC 61508, 60300, 61804, ISACA G32, SAS 70, NIST 800[viii] https://en.wikipedia.org/wiki/Cyber_resilience

4

BCM programs and its components also go by other names such as “Resilience,” “Disaster Recovery,” and “Continuity Planning,”. Implementing these programs is a requirement in a variety of regulations(vii) across industries and jurisdictions and is mandated and referenced in dozens of certification standards and best-practice frameworks(viii). Depending on whether your organization has a regulatory obligation, if your organization is seeking resilience, or a combination of the two, ISO 22301 is a well-known and recognized standard to base a holistic BCM program on(ix). Corporater is a provider of integrated software for holistic governance,  performance, risk, and compliance (GPRC). Contact Corporater or one of our management consulting partners for more information regarding Business Continuity Management.


https://corporater.com/en/business-solutions/governance-and-business-agility/gprc-dashboards/?utm_source=pdf&utm_medium=article&utm_term=gprc&cmc=pdf_bcm_index

NORWAYHead QuartersCorporater ASHillevågsveien 244016 StavangerNorway+47 481 54 000

BRAZILCorporater Inc.Rua Vicente Ferreira, 57 – C15Jaguaré – São Paulo – SPCEP.: 05330-050Brazil+55 11 983553690

GERMANYCorporater GmbHBerliner Allee 4764295 DarmstadtGermany+49 6151 277 6060

INDIACorporater Asia Technologies Purva primus No. 236 5th. Floor Left Wing, OMR Thoraipakkam, Chennai 97, India+91 44 6653 1033

UNITED ARAB EMIRATESCorporater (Branch)Office 1901, Indigo Icon Cluster F.Jumeirah Lakes TowersP. O. Box: 309083Dubai, UAE+971 425 0298

UNITED STATESCorporater, Inc.3001 Knox St Suite 285 Box #29 Dallas, Texas 75205USA+1 800 670 8942

ROMANIACorporater Perf Mgmt SRLRiverside Tower - 11th FloorSplaiul independentei 291-293

Romania+40 752 027 780

060042 Bucharest

SOUTH AFRICACorporater (Pty) LtdAutoparks House, Ground FloorCnr Cross Road and Park Crescent

Gauteng 2193 South Africa+27 846 454 718

Glenhazel, 2193

Corporater is a global software company that empowers medium and large organizations

worldwide to manage their entire business on a rapid solution configuration business management

platform that adapts to their unique business model. We use our gains to make a social impact.

Corporater BCM software solution provides a digital platform to holistically govern, manage and

assure the organization’s business continuity program according to international best practices.

Contact us for demo at www.corporater.com/requestdemo

[email protected]

Corporater AS. All rights reserved.

Owe Lie-Bjelland, Director – Global Program Management, GPRC, Corporater Jonas Mentzsen Nesbø, Consultant – Global Program Management, GPRC, Corporater

Authors

UNITED KINGDOM Corporater UK Ltd. 6 Bevis Marks London EC3A 7BA United Kingdom

+44 741 913 9071


https://corporater.com/en/business-solutions/risk-management/business-continuity-management-bcm-software/?utm_source=pdf&utm_medium=article&utm_term=bcm&cmc=pdf_bcm_index

https://www.linkedin.com/company/corporater

https://twitter.com/corporater

https://www.facebook.com/CorporaterBMP

https://www.youtube.com/c/CorporaterGlobal

https://www.slideshare.net/corporater_BMP

www.corporater.com/requestdemo/?cmc=pdf_bcm_rd

Documents

Productive Paranoia and - corporater.com · Productive Paranoia and Business Continuity interdependencies between risks within the organization. The scenario-building practices utilized