Have you ever seen a black swan?

Dawlish is my favourite seaside town in Devon and is famous for its beautiful black swans. I visited Dawlish with my family just before lockdown and I highly recommend it. It is a scenic seaside resort and for more than a hundred years black swans have paddled up and down the small stream that runs through the town down to the beach. The black swans are so entwined with the town that fifty years ago they became an unofficial icon emblem of the town. 

When I visited Dawlish, I didn’t think I’d ever be writing about black swans in a technology blog, but you can never predict the future can you?

This is the point entirely; you simply cannot predict the future. The pandemic has shone a light on this and has amplified the criticality of business resilience, contingency planning and business continuity planning.

Black swans are a very rare breed indeed! Black swan events that catastrophically affect your business are also extremely rare, thankfully, but they do occur as we now know.  

Housing associations, executive leadership teams and Boards have had to reconsider the effectiveness of their incident response plans, business continuity plans and organisational readiness for future black swan events. This is basic risk management and supports executive efforts to stress test their operating environments and remove single points of failure and risks through a strong and robust control framework.  

Do you know how resilient your environment is? 

Have you identified your single points of failure that would stop your operations in their tracks? 

This time around it was Covid but next time it might be a fire, flood, cyber–attacks, ransomware, energy provision outages or international cyber terrorism etc etc! Or it could be a simple computer outage or data loss event that suspends your operational capabilities for a prolonged period. I really hope it’s not a meteor or the rise of the dinosaurs! These events can impact you in one of three ways: 

1. Financial losses – staff productivity, lost revenue income, contractual conditions 
2. Credibility and reputational losses with customers and other key stakeholders 
3. Organisational survival – if the organisation fails to recover from the event in a controlled manner, governance and viability could be critically compromised or scrutinised. 

Amongst business continuity circles we talk about black swan events routinely. Unlike in Dawlish, a black swan event is a very rare occurrence. In business, it represents an extremely negative event or occurrence that is impossible to difficult to predict. 

What is a black swan event?

A black swan event can be characterised by three distinctive hallmarks: 

1. The event has the potential to create a severe and widespread impact. 
2. The event has the potential to temporarily disrupt or destroy your business operations. 
3. After the occurrence of the event, leaders will rationalise the event as having been predictable (known as hindsight bias) 

One of the most important things leaders can do is create a climate and environment that delivers the notion of business resilience. Resilience is a bit like the Covid 19 vaccine in that it is never going to be a 100% but it will reduce the probability and impact of disruption to acceptable levels (know as the risk appetite). Risk, risk appetite and risk tolerance need to be owned and set by the top team, but the control environment needs to be designed and delegated to skilled professional practitioners. 

In my former roles, as digital and IT leader for housing associations, I would constantly talk about “SPOFs” – single point of failures. You can create organisational resilience by: 

1. Identifying your key services and assets 
2. Agree how quickly you need those services recovered if a black swan event was to hit. 
3. Agree how much data loss you can tolerate (if any!). 
4. Identify all the SPOFs across key services and assets, mitigate and test a range of recovery scenarios. 

It is also important to exercise vulnerability assessments against your key services and assets on a regular basis, rag (red/amber/green) rate each vulnerability based on risk and impact and treat them accordingly based on the assessed priorities.  

And across all management interventions and controls it is critical that residual risk scores are accurately reported against target risk scores to the senior team so that there is full opaque transparency and fluid performance data being reported up. As I say, it is the Board that owns the risk ultimately, so they need to be armed with accurate data and management information about your current position and current risk status including current risk exposure and untreated gaps in your defences. No one likes surprises, especially the Board! 

Our upcoming trend report

In TSG’s upcoming trend report, we discuss this topic in more detail and note how housing associations have recently embarked on the process of reflection concerning their resilience and business continuity plans. Cloud services provide an unprecedented platform to eliminate all SPOFs (single points of failure) from your on-premise environment. It is almost impossible to remove SPOFs entirely from on-premise computer rooms. Furthermore, your IT team generally work Monday to Friday, but colleagues and customers now demand your IT services and digital self-service platforms 24×7. Outages are just no longer acceptable. Cloud services offer superior SLAs (service level agreements), they experience less outages and are ‘always there’ using globally redundant, duplicated fault tolerant data centres. Can you say the same about your on-premise facilities? I doubt it very much.