Hunting the Black Swans in Your Continuity Program
This is Vol. II, No. 4 in the DRG ongoing series regarding hunting and mastery of the black swans in your continuity program.
"Black Swans" in your Continuity Program are those events that remain outside the range of normal expectations, and may well produce a significant negative impact when they occur. For reasons of budget, culture, or simple lack of awareness, we just do not see or deal with these potentially devastating exposures in our enterprise continuity capability. This series discusses some of the most common of these "black swans" in business continuity programs, those that are really staring us in the face and screaming for attention.
Quarry 1: Employee Availability for Response Activities.
Quarry 2: The Level of Individual Employee Commitment to BCM
Quarry 3: Exercising Your Plans
Quarry 4: Exercising Your Plans: Objectives and Annual Programs
Quarry 5: Exercising Your Plans: Business Unit Continuity Plans
Quarry 6: Exercising Your Plans: Technology Recovery Plans
Quarry 7: Exercising Your Plans: Logistics, Communications, and Support Plans
Quarry 8: Lessons Learned
Quarry 9: New Year's Resolutions
Quarry 10: 10 Steps to Building a Black Swan-free Business Continuity Management Program
Quarry 11: New Year's Resolutions
Quarry 12: Developing "Black Swan Sighting" Skills: Warm-up Exercises
Quarry 1: The Centrality of Power: Seeing the Connections
Quarry 2: Power Outages: Isolation Effects
Quarry 3: Power Outages: How Employers Can Get Involved
Volume II: Quarry 4: Cascading Effects on the Support Fabric
This month we continue our discussion with the cascading effects of an extended power outage. We will look first at a number of areas that will affect us individually and personally, as well as at wider effects on key societal aspects. Again, the intent is to get your imaginations oiled and spinning. In order to understand what may happen, we need to:
- Include rather than exclude.
- Accept that the improbable will occur, and that the effects may be wide-reaching and not now fully understood.
- Understand as much as possible about the conditions under which these improbable effects will become visible.
- Define those conditions where cascading effects will occur – trace these linkages through the social fabric to know where the breaks will occur – especially when the impact seems minor at first, but grows quickly into a compelling issue.
- Understand high and low priorities - life support will be at the top of the list, but diversions such as entertainment and sports may also become much higher priorities.
Later we will start to explore how we can counter these cascading effects, as well as what we can do now to become more resistant to their impacts. Right now we are interested only in identifying them and tracing their immediate and more subtle impacts.
It is still the 25th day of a power outage in the US Northeast. West as far as Buffalo; south as far as Washington, D.C., including the states of Maine, Vermont, New Hampshire, Massachusetts, Rhode Island, Connecticut, New York, New Jersey, Pennsylvania, Delaware, Maryland, Virginia, and Washington, D.C. It is a Wednesday in August. The temperature is expected to reach the low 90’s today, with humidity at a relatively moderate 78% - 86%. Today we will be looking at cascading impacts in the areas described below. Please note that the areas chosen are not intended in any way to be complete or to be representative. They are chosen for the ease with which the readers’ imaginations may engage with them.
Transportation: Goods and People
It is likely that only now, more than 3 weeks into the event, are priority arrangements being enforced. And perhaps not even yet in some particularly politically sensitive areas.
How does a trucker with fruits and vegetables from the State of Georgia get that load up to the farmer’s customers in Boston? No power means NO capability to pump gas, remember. It will take some time for the authorities to understand that shortages are serious and continuing. Will large trucking firms set up fuel depots inside the affected areas? Or just outside the borders? Will these private sector facilities be looted? How will government get involved?
What happens to air traffic? Surely many flights will be cancelled as fuel stocks decline at airports in the affected area? But what will be the flight priorities and how will they be enforced? Will visitors from other countries get “stuck” in New York, Boston, Philadelphia, etc.? Will they have priority on departing flights? What will they do if they do not have sufficient funds for hotels and food while they are delayed? Is this an airline responsibility? Is this a public services responsibility?
What happens to mail services and product deliveries through UPS, the Post Office, and other delivery services? Will shipping firms receive priority fuel allocations?
JIT Strategies: Groceries, Pharmaceuticals
Over the last 20-30 years, retail organizations from supermarkets to pharmacies to have fine-tuned their inventory control and product replenishment systems to provide maximum capability to meet customer needs with minimum need to stock product at their sales locations. This strategy is normally referred to as JIT – Just-In-Time. By now you should be able to leap to an immediate understanding of how this strategy might create serious problems during our power outage scenario. These supply problems will quickly cascade to major medication and food supply issues for the affected populations. It is likely that government would need to step in quickly, but not at all clear how this would be done for such a large area with so many people, and with so many political jurisdictions.
The JIT strategy has also affected hospitals and their pharmacies, as storage space for supplies became less and less available as demand for patient facilities has surged. But if that is the case with hospitals and pharmacies, it is certainly even more aggravated at smaller medical practices and individual practitioner facilities. Closure of these facilities will aggravate an already serious supply shortage at hospitals. This will become a continuously increasing problem. Gradually the quality of medical care will decrease precipitately as supplies and necessary equipment become more and more scarce due to delivery problems. How will the government and/or the private sector intervene to help to address the shortages? Is there a way for medical facilities outside of the affected zone to get supplies to the affected area? Will hospitals act independently?
Increase of Crime
All of these stresses, including food and water shortages, excessive heat and lack of cooling facilities, food and water distribution problems, increasing fragility of the population and potential emergence of water-borne diseases will begin to cause spikes in mortality rates. These and many other related issues will serve to raise the crime rate as the population becomes more and more stressed. Will curfews need to be established? If people are sleeping outside to avoid the heat of air-conditioning-less highrises, how will they be protected? How long will it be before shelters can be provided for large sectors of the population? How can all of these people possibly be evacuated? How will local authorities cope with all of these challenges? At what point should the National Guard be deployed? And how will this be coordinated across all of the political zones in the affected area?
And what about providing something to do for those who cannot work because their workplaces are closed? For those who are cut off from television and the internet? Maybe set up recharging stations for hand held devices? Or emergency internet cafes? Or professional games in sports venues? All of these would be great for relieving stress and therefore anti-social behavior (otherwise known as crime).
If you review the above issues even superficially, five areas emerge as critical:
- Early Acceptance of the continuing nature of the event is critical. The earlier the authorities understand that this will be a long-term event, the earlier they will be able to organize facilities and support for the affected populations. And particularly for those more fragile members, such as the ill, the elderly, those with continuous medication needs, and those with medical emergencies.
- Priority-setting. The earlier decisions can be made on the delivery of essential products and services to places/people where they are needed most, the better the affected populations will be able to weather the event.
- Discussions need to be made NOW among government, military, and private sector participants to discuss options in the event of such long-term interruptions. These should result in guidelines to be used in individual incidents by all parties. Included should be a system of event severity / duration measurements that will allow decisions to be made earlier to implement recovery and protective measures. The private sector should be fully leveraged in these measures.
- Effective communications and quick reactions are necessary to minimize negative outcomes to individual emergency situations. Flexibility and individual initiative must be encouraged while simultaneously maintaining the benefits of formal authority structures. No, this is NOT impossible.
- New solutions to emergent challenges must be encouraged and adopted where appropriate by workers within those environments. Responders “in the trenches” must be allowed to implement ideas that work for the individual cases with minimum bureaucratic oversight. Private sector models may be useful here.
An event of the magnitude that we are discussing here may still seem extremely improbable to you. However, if we consider the number and extremely high sophistication level of cyber attacks that we experience on a regular basis, it is well within the realm of possibility. It is less and less improbable with every passing day.
You should now be better able to understand the value of this type of reasoning to the building and implementation of an effective response. If you cannot imagine the event, you cannot train for it, design a response, rehearse / refine that response. And by the way, there is a lot that can be learned about much less serious (and more probable) events by taking this detailed approach. But that is for September…..see you then!
About the Author
Kathleen Lucey, FBCI, is President of Montague Risk Management, a business continuity consulting firm founded in 1996. She is a member of the BCI Global Membership Council, past member of the Board of the BCI, and the founding President of the BCI USA Chapter. IBM chose her as the first winner of its Business Continuity Practitioner of the Year Award in 1998. She speaks and publishes widely in both North America and Europe. Kathleen may be reached via email at email@example.com.