We recently came across an article written by Jonathan Evans (a former Director General of the UK’s MI5 domestic intelligence service), and Paul Martin, a Distinguished Fellow of the Royal United Services Institute (RUSI), and published some three years ago in depths of the onset of the COVID pandemic.
The article (facetiously, but alarmingly accurately) posits 14 Rules that large, complex organizations “should” adopt to ensure that they are adequately resilient in the faces of complex crises.
We highlight below a few of the key ones, with some of our own commentary, which may perhaps induce a little self-reflection:
- Have a Plan and Stick to it: This plan must long and detailed, with many diagrammes and annexes; and reassuringly authored by a “business continuity specialist” or consultant- neither of whom remain with the organization. If it is not precise, clearly it is not up to the task; and it must be oblivious to “sunk-cost” bias, so that all involved keep digging an ever larger hole when crisis strikes- perhaps for some collective “head-in-the-sand” communing. Of course, as Field Marshal von Moeltke famously said: “No plan of operations extends with certainty beyond the first encounter with the enemy’s main strength.” In other words, make sure that you have alternatives and options available, and not just The Plan
- Take Comfort from Your Risk Register: Beloved of regulators everywhere as evidence that management actually is aware of the risks which an organization supposedly faces. This will have been constructed years ago by the firm’s risk management specialists, with many ill-defined or nebulous terms; and brought out in fetishistic ritual at least twice a year for review by The Board, preferably at the end of an all-day board meeting. The Board’s role is to admire the artefact for its aesthetics. Perish the thought that its members should actually have a robust discussion, or suggest any changes!
- Have Faith in Quantitative Risk Models: Make sure that your planning is based upon highly-complicated quantitative models developed for the financial services industry. We all know how well those performed during the GFC
- Stay Focused on Immediate Returns: Current Return on Equity (RoE) is what you are rewarded for. “Resilience (whatever that means) costs money and does not feature in your accounts”. Efficiency and productivity are what really matter
- Do not Bother with Semantics: Trying to clarify what “resilience” or “business continuity” actually mean is pointless. Everyone knows that all you are trying to do is to limit the damage after bad things have happened
- Ignore the Human Dimension: Trying to assess and factor in how people are likely to behave in a crisis is an unnecessary extravagance. After all, we now have Generative AI to tell us what to do
- Leave Everything to the Specialists: Clearly, it is their job to sort out all this mess. Involving executive management or the Board is simply a distraction from their “strategic” responsibilities
- Keep Moving People About: HR “best practice” requires ensuring that people are moved sufficiently frequently to meet their expectations, and avoid bogging them down in acquiring relevant knowledge and experience.
We could go on, Dear Reader; but you should by now get the drift…
As one can infer (and as the pandemic all too clearly demonstrated), one of the key attributes of a truly resilient organization is the ability to make swift assessments, and adapt to changing realities, rather than remain wedded to “The Plan”
We commend the article as one that should be read in its entirety.
The Awbury Team
Awbury Insights 