Focused information supports sharp decision making

Good CEOs know that when it comes to the relationship between information and decision making, more is not better.

This is in contrast to the real politik reflected in the wry humour of "The Smokescreen" (in Yes Prime Minister, by Jonathan Lynn and Anthony  Jay, page 188). In the world of politics, perception is key. So decision making is dangerous - and to be avoided wherever possible. To this end, the passage from "The Smokescreen" notes:

"There are eleven stages in a decision making process -

1.  Informal discussions
2. Formal proposals
3. Preliminary study
4. Discussion document
5. In-depth study
6. Revised proposal
7. Policy
8. Strategy
9. Implementation plan circulated
10. Revised implementation plan
11. Cabinet authorisation"

The pasage goes on to note that any public servant should be able to ensure that if a policy is unwelcome, stage 11 will not be reached until the next election. Unfortunately this approach is seen too often - I guess that is why the television series was so popular with politicians.

In the real world, decisions have to be made - often quickly - and frequently under conditions of uncertainty.

It is under these circumstances that information which is focused on the decision makers' needs is critical. The decision maker may need to know all that is available to him or her. However it is more likely that they will appreciate a focused set of information tailored to their needs. At EPCB we address this requirement with a framework of information based on best practice business continuity standards, with which we then support clients to tailor to their context.

Excerpt from the Table used to Tailor Reports

The approach can be seen at "Tailored Reporting to meet your needs".

Innovative responses mitigate disaster impact (Christchurch 2011)

Christchurch impact indicator - dust rising from collapses after quake.

As the response moves to recognise the breadth of impact across the city, its infrastructure and its people, New Zealanders are applying several innovative "emergent resources" to mitigate the impact of this disaster.
Key issues are around "lifelines" - the networks that supply and link us to meet our core needs (from power, and water to communication).

The need to communicate is the glue that binds the efforts and three illustrations are apt:
1. Telecom NZ has 60 electricity generators and five portable mobile phone towers to keep the phone network up.
2. Google has set up an online finding service:

3. Online auction site Trade Me, set up a service linking people needing accommodation and assistance with those willing to offer it.

In this scenario of devestation, one hopes that these and other emergent, innovative approaches will be enough to see Christchurch get up and running.

Obvious and Necessary - modern risk management.

I came across an interesting article by Leon Gettler today titled "Risk management in the era of unpredictability" (page 6, in the Opinion and Analysis Business Section of The Age newspaper, 1 Feb 2011).

Interesting not only because it reflected a position dear to my heart, - but interesting because it was a lead article specialising in what I thought was "a given". Can it still be that modern companies and organisations HAVE NOT adopted a flexible approach to risk management? What are they thinking? The solution is necessary - and it is not difficult.

In terms of the necessity of the solution Gettler wrote:
"The conventional risk-management approach lists possible events and determines the probability of their occurring based on experience. You measure the costs and benefits of specific risk-protection measures and implement these measures for each risk. The problem is that it assumes risks are local and routine and fails to take into account the impact they may have on different organisations and states. It does not factor in the impact of the growing number of unlikely but potentially devastating events. It is an outdated approach that robs organisations of their agility. Clearly, these sorts of events are impossible to predict. So, how should organisations respond? It is a subject that should be reviewed by boards regularly. Companies should have scenario-mapping teams that report to the board and work with suppliers and customers to identify potential threats. Twenty-first century risk management is not about predicting the future. It is about systems and relationships that create an organisation agile enough to respond when disaster strikes. (my emphasis) As it will."

In terms of the solution being "straightforward", if an organisation asks the fifteen questions in the diagram below, they will have the necessary and sufficient profile - of both their vulnerability and their needs.

"One Off" disaster levies reflect poor policy.

This morning, Australians woke to page one headlines "PM Flags one-off flood tax".
This raises questions beyond those driven by party politics. It raises issues around how we, as a community, operate strategically. To what degree we operate sustainably.

Inundated floodplain development, Queensland, 2011

As a community, (in this case the "shared association" is as a nation) our constitution clearly nests the responsibility for the protection of life and property with State governments. Founded as a colony, we have a legacy of ports and hinterlands which have competed to attract development. A key discount lever used to attract development in the past has been "discounting". Sometimes with cheap flat land served with transport infrastructure and subsidised migrant labor. Sometimes with "light" requirements around standards. This has been so from flood plains to industrial zones. The outcome has been "hazard havens" where some States have imposed risks on citizens more severly than other States. Further, the benefits from such ventures do not generally go to those living near to the risky sites.

All of this is contextual to the challenges of the future.
Now - at a national level - we need to agree approaches to some fundamental questions.
By what country wide, consistently applied criteria will we address risks?

A systematic risk management framework

The risk management record of this national government has been characterised by a series of policy failures (from pink batts to school funding). Central to all of these failures has been the inability to bring the right questions to the table. The current knee jerk looks like the trend is embedded in their culture. One off fixes applied indiscriminately and an ignorance of insurance are indications of a government struggling to develop and apply a comprehensive and integrated approach. Unless a systematic and thoughtful approach is undertaken, we are likely to see further grounds for challenging the integrity of the current government.

New Business Continuity Standard for Australia's financial sector

The Private Sector is increasingly held accountable for quality risk management. In many cases this takes the form of mandated performance standards. The Australian Prudential Regulation Authority has recently released the draft of their proposed Business Continuity Management Standard. The proposed standard aligns with international best practices. It makes Boards accountable for very specific Business Continuity Management capabilities - summarised in Clause 21 - to include (at a minimum):
1. Business Continuity Management Policy;
2. Business Impact Analysis including Risk Assessment;
3. Recovery Objectives and Strategies;
4. Business Continuity Plan including Crisis Management and Recovery; and
5. Programs for Review and Testing of the Business Continuity Plan; and Training and Awareness of staff in relation to Business Continuity Management.

APRA's draft Business Continuity Management Standard (PDF)

In any Risk Management venture "Establishing Context" is crucial

There is a tendency for people to want to rush to the exciting stuff. To get their hands dirty with extreme event scenarios and risk assessments. That is a mistake.

It is important to pack your bags for the long trip - to lean your ladder up against the right wall - to start with an awareness of issues which might ambush "the end in mind". These phrases apply to any systematic risk management process - where an initial emphasis should be on scoping context. If not, believe me, it will unravel later.

So with many "burn and learn" examples over many years, may I suggest the following three key considerations:

1.    Develop a project plan to establish the risk management context which includes:

a.    the aims and objectives for the establishment of context;

b.    a matrix of stakeholders against their roles and responsibilities; and

c.    a budgeted and scheduled plan for anticipated research and consultation.

2.    Profile the entity for which “context” is being established (e.g. the structure of the organisation; or the demographics of a community) by mapping key networks including:

a.    relationships between people and organisations to identify and evaluate existing networks; and

b.    other network relationships that do not exist, but which might add value should they be developed and established through negotiation, consultation and marketing strategies to gain trust cooperation and support.

3.   Apply strategies to seek and obtain stakeholders’ co-operation and ownership of the risk management context including:

a.    establish and coordinate open communication structures among the networks mapped;

b.    consult with stakeholders to map their issues and needs across the following aspects or “spaces” - social, legal, technical, political, environmental, and financial; and

Establishing risk appetite early is fundamental

c.    identify criteria and thresholds for “acceptable risk” across the aspects or “spaces” identified with stakeholders; and document the level of agreement and divergence between stakeholders regarding risk criteria to be applied. Two sets of criteria should be addressed. Risk assessment criteria – that is, “what do we care about - and how much do we care”; and what are agreed risk treatment selection criteria to be applied.

Disaster Funds: Lessons & Guidance on the Management & Distribution of Disaster Funds

Please find reproduced below, in full, an email from Dr. John Twigg

Disaster Action - a great organisation - has just released what looks like a really useful new publication:

"Controversy surrounds many disaster funds, even decades after they were launched. Little guidance is available to those who take on the responsibility of managing and distributing funds in accordance with the wishes of the donors. Disaster Funds: Lessons & Guidance on the Management & Distribution of Disaster Funds, published by Disaster Action with support from the DCMS and the British Red Cross, fills that gap. It is an essential resource for emergency planners, fund trustees, administrators and managers."

Download from www.disasteraction.org.uk the ninety four page PDF and the five page nutshell pamphlet PDF

Return to EPCB's website - Risk Management 

Post disaster shelter and sustainability

Professor David Sanderson, Director, Centre for Development and Emergency Practice (CENDEP) at the School of the Built Environment, Oxford Brookes University has announced that as a follow-up to the ELRHA funded shelter conference held at CENDEP in September in association with CARE UK, the final report, presentations and podcasts awesome sessions are now available online at http://bit.ly/cSRhQs

The conference examined what role shelter should have in disaster relief and development while critically reflecting on its implementation at local and international levels. It was agreed, that while technological shelter solutions are important, good shelter practice always puts people first. This may mean reassessing practitioners' roles and responsibilities to include ways to work more successfully with affected people in a process, rather than focusing on providing an end product.

Simple things can put you at risk.

It is early days in the investigation of the fire which destroyed the Liverpool Council offices over the weekend but some interesting things are immediately apparent.


"The fire has thrown one of Sydney's biggest and busiest councils into turmoil, losing its website, meeting place and important items including strategic plans, engineering documents and development applications." (Ref Daily Telegraph, 16 Aug 2010)


News Clip Video of the Liverpool Council Fire, 14 Aug 2010.

There is a continuity plan in place - however it seems to have been underpinned by some interesting decisions.

First, backing up customer paperwork. In this case, the loss of development applications from the end of last week. A simple process analysis would place a "scan and file off site" step at the beginning of the process. This reflects respect for what the client is submitting - the backup process is not just about the assessment by the planning department. Or is it? So a question about "how and what" were they thinking arises.

Second, the commentary from the YouTube news video reports the building had no sprinklers. This means either the business continuity plan has not been nested within the organisations risk management arrangements or it has been nested and a cost benefit assessment advised not to install sprinkler systems. Which of these is so will be confirmed by the coroner.

Third, a key principles of managing a crisis is "communicate, communicate, communicate". In the modern world, best practice demands a "go to" webpage - even if it only tells customers what is available and what is not available. A default url to switch to is as important as a backup customer service centre line. Unfortunately this is not being provided (as of 11.00am Monday 16 Aug 2010)